Keychain Hell

[pixellip]

Hi everyone

Keychains cause a lot of issues don't they.....it's so confusing. I am not the first to ask this I know.

 

A teacher renamed their windows password and the prompt came up to create or update a keychain when they tried to log in on their mac. When you get prompted what to do it's really confusing for all. Anyway.....

 

I did 'Create New Keychain' then the mac couldn't access their documents folder ( local documents) as it said they didn't have permission. I rebooted the mac and then they had access to their documents folder. What figures there? PS The macs are bound to AD

 

This happened again for a second mac (ie another user was having keychain popups as she had changed her AD password) so I did the same - i.e. create new keychain. ( Is it better to update keychain here? ).

 

Still loads of windows popping up about keychains and logins I couldn't get rid of. So I rebooted then went to keychain access and created a newkeychain from the keychain menu. Now I can't login as that user ( an Activ Directory User ). Doh!

Is there a way I can reset the keychain stuff for this user on this mac as administrator as there are no local accounts help on the mac?

 

Should I browse to their local home folder / Library / Keychains and delete what's in there / will it re-create them again? I've got myself into a pickle here but it's all good!

 

Thanks for your help and sorry to ask another keychain question!

Edited April 23, 2015 by pixellip

[Carter]

Keychains can be a pain but if you are dealing with AD make sure you select "Synchronize login keychain password with account" under the "Preferences/First Aid" tab.

If this is selected and a user changes their password and logs out and back into the computer they will get a prompt to input their old password. Once they put in their old password it will sync. The reason for this is so that a random user can't just reset their password somehow then freely gain access to their keychain. They need to know the password prior.

 

The issue we have is that people will change their password and they don't logout for weeks on end and then forget their password. The next time they restart their Mac or logout they will hit this wall.

 

The next option is to use the "Keychain First Aid" option in keychain. This has fixed the sync issue for staff a number of times. Go to "Keychain Access" menu then choose "Keychain First Aid". Next have them enter in their AD credentials. This should fix them up.

 

 

.

[pixellip]

That's great Carter - really helpful and detailed thanks so much!

 

Unfortunately for this user I have screwed something up. It's now displaying 'Password for library/keychain/login.keychain is not the same as login password so keychain can't be unlocked automatically' when I tried repairing the keychain for this user.

 

Is there a way of getting out of this?

Ta again - really useful post this one.

Edited April 23, 2015 by pixellip

[pixellip]

Don't worry I've managed to get into the user now.......sorry about that. Thanks again Carter - you were a lifesaver today!

Mike

[Carter]

Great to hear!

[Mikey1544]

We have this issue with Keychain migrator coming up before you login then you cna't login till it goes away but u need local admin account to get it to go away or restart the mac and pray it doesn't come up! I dont have a fix yet

[pixellip]

I just can't clear out the blasted messages coming up for this user regarding Keychains. It's saying Messages Agent wants to use the "login" keychain. I tried deleting the login keychain but it's still saying it.

I tried repairing it and it says it failed.

What on earth do you do to clear it out and start again! It is driving me nuts!

[Carter]

If deleting the keychains from ~/Library/Keychains does not work you may need to wipe the user account but I've never had it that bad that running the above didn't fix.

[pixellip]

Cheers Carter. The trouble is the user account doesn't reside in the accounts part of OS X - as it's an AD account. So do you delete the whole folder and login / get it to recreate would you think?

[discounteggroll]

sorry to chime in late but I have made an app out of an automated workflow that nukes the logged in users' keychains so those popups don't come back (until password is changed again). Keychain issues seem to have gotten a lot better in 10.10. Keep in mind this is as destructive to a keychain as possible and should be used as a last resort

 

https://drive.google.com/folderview?id=0B9Amn1dh911RNWhjUXFfRnE5cmc&usp=sharing

[HGBee]

Keychains can be a pain but if you are dealing with AD make sure you select "Synchronize login keychain password with account" under the "Preferences/First Aid" tab.

[ATTACH=CONFIG]30256[/ATTACH]

If this is selected and a user changes their password and logs out and back into the computer they will get a prompt to input their old password. Once they put in their old password it will sync. The reason for this is so that a random user can't just reset their password somehow then freely gain access to their keychain. They need to know the password prior.

 

The issue we have is that people will change their password and they don't logout for weeks on end and then forget their password. The next time they restart their Mac or logout they will hit this wall.

 

The next option is to use the "Keychain First Aid" option in keychain. This has fixed the sync issue for staff a number of times. Go to "Keychain Access" menu then choose "Keychain First Aid". Next have them enter in their AD credentials. This should fix them up.

 

[ATTACH=CONFIG]30257[/ATTACH] [ATTACH=CONFIG]30258[/ATTACH]

 

.

 

Thanks Carter, I swear the keychain is a living hell

[Carter]

In the wend the easiest solution if it just won't fix is to backup info and create a new user.