Our policy enforces disk encryption and PIV logon. Users can initiate a adpasswd command in terminal but it doesn't take a new password. They can try to change passwd in System Prefs but that also does not take the current password. I have to move them into an OU that does not enforce yubikey then let them change their password and reboot so it changes the FileVault password too. Last, I move them back into PIV group. Is there faster way? Our concern is that each user will need to visit the helpdesk to update FV password, which is unreasonable for remote users.
↧