Re: High Sierra asking for ‘disk password’ and won’t accept any

Same as my situation, but once I've use diskutil apfs decryptVolume to decrypt volume, but after I enter this command, quickly it crashed my macOS 10.13, then I can't boot my mac and also can't read any files anymore, after I boot into Recovery Mode to unlock the volume with my passphrase, all the encrypted files on the volume can be list and not modified, but they can't decrypt by FileVault2 and let me read raw encrypted data, and I use diskutil to check crypto users, that said I'm in decrypting action but paused state of my volume?

Is there have some way to have to continue decrypting in Recovery Mode? In previous coreStorage can be done this things by manual activating corestoraged in terminal to continue encrypting/decrypting, but in this APFS does have any way to migration successful or revert the state?

-bash-3.2# diskutil apfs listCryptoUsers /dev/disk2s1
Cryptographic users (4 found)
|
+-- EBC6C064-0000-11AA-AA11-00306543ECAC
|  Type: Personal Recovery
|
+-- EC1C2AD9-B618-4ED6-BD8D-50F361C27507
|  Type: iCloud
|
+-- 64C0C6EB-0000-11AA-AA11-00306543ECAC
|  Type: iCloud Recovery
|
+-- EFBB60F6-DD62-4520-9CBB-D82A9BEE35B9
|  Type: Local Open Directory
|
Background decryption migration (data on disk becoming plaintext) in progress
Migration type 3 (decrypting); state 1 (paused); pause state 0 (unknown)
Migration progress 0.0%
Migration time remaining 60.0 seconds
-bash-3.2#

I had this same issue. Of note, I also converted to APFS and have had a working BootCamp Partition setup with Windows 10. I just installed the Creators Update for Win10 and did some work on the WIndows Side, and then used the Apple BootCamp Control Panel utility to set my Apple partition as the startup drive. That brought me almost immidiately to the prompt for the Disk Password. And nothing I entered was working. Not sure what that password would be, e

either.

I was abel to reboot and hold down Option and then select my Apple Drive and it started up normally. BUT, rebooting again brought me to the same prompt for my Disk Password... I did the same, boot up holding down Option, selected my Apple Drive, and then once I was back at my desktop I went to Systemn Preferences / Startup Disk, and saw that nothing was actually selected there. Once I selected my Apple Drive as the Startup Volume, everything was working normally again.

I had the same problem on my 15" MacBook Pro early 2011 with a FV2 encrypted homemade fusion drive after it slept during install. To make matters worse it wouldn't even boot into the recovery partion (although it would boot into the password recovery utility). I ended up creating a bootable USB drive so I could get to an OS 10.13 terminal window.

After some research and a lot of trial and error I came up with a solution that worked for me:

1. Boot into the OS installer/recovery drive.

2. Open a terminal window. Run diskutil apfs list and find your boot volume

$ diskutil apfs list
APFS Container (1 found)
|
+-- Container disk2 87F8E3F6-28B8-4A98-847A-28C4370E1133
    ====================================================
    APFS Container Reference:    disk2 (Fusion)
    Capacity Ceiling (Size):      754964643840 B (755.0 GB)
    Capacity In Use By Volumes:  480886849536 B (480.9 GB) (63.7% used)
    Capacity Available:          274077794304 B (274.1 GB) (36.3% free)
    |
    +-< Physical Store disk0s2 A070CF3A-AFA8-4AFF-81E3-E77D75FD4685
    |  -----------------------------------------------------------
    |  APFS Physical Store Disk:  disk0s2
    |  Size:                      255716540416 B (255.7 GB)
    |
    +-< Physical Store disk1s2 46B2EB23-79BA-43A0-A99F-D50AAC6C66BF
    |  -----------------------------------------------------------
    |  APFS Physical Store Disk:  disk1s2
    |  Size:                      499248103424 B (499.2 GB)
    |
    +-> Volume disk2s1 6AAC9D56-EC44-38B3-9C50-1D6DA3020377
    |  ---------------------------------------------------
    |  APFS Volume Disk (Role):  disk2s1 (No specific role)
    |  Name:                      Macintosh HD
    |  Mount Point:              /
    |  Capacity Consumed:        461711589376 B (461.7 GB)
    |  Capacity Reserve:          None
    |  Capacity Quota:            None
    |  Encrypted:                Yes (Unlocked)
    |
    +-> Volume disk2s2 FA366E2A-B9CD-4822-AC93-3133635BAFD60
    |  ---------------------------------------------------
    |  APFS Volume Disk (Role):  disk2s2 (Preboot)
    |  Name:                      Preboot
    |  Mount Point:              Not Mounted
    |  Capacity Consumed:        18444288 B (18.4 MB)
    |  Capacity Reserve:          None
    |  Capacity Quota:            None
    |  Encrypted:                No
    |
    +-> Volume disk2s3 0E4E73B-B55D-4DEC-94A1-0A3DD20E73EC
    |  ---------------------------------------------------
    |  APFS Volume Disk (Role):  disk2s3 (Recovery)
    |  Name:                      Recovery
    |  Mount Point:              Not Mounted
    |  Capacity Consumed:        518926336 B (518.9 MB)
    |  Capacity Reserve:          None
    |  Capacity Quota:            None
    |  Encrypted:                No
    |
    +-> Volume disk2s4 38451C7D-33AA-42AE-A951-09CB95D25D2C
        ---------------------------------------------------
        APFS Volume Disk (Role):  disk2s4 (VM)
        Name:                      VM
        Mount Point:              /private/var/vm
        Capacity Consumed:        9842118656 B (9.8 GB)
        Capacity Reserve:          None
        Capacity Quota:            None
        Encrypted:                No

2. Now run diskutil apfs unlockvolume on your boot volume. Authenticate with your usual password

$ diskutil apfs unlockvolume disk2s1
...

3. Finally, run diskutil apfs updatePreboot on your now unlocked boot volume

$ diskutil apfs updatePreboot disk2s1
Started APFS operation
UpdatePreboot: Commencing operation to update the Preboot Volume for Target Volume disk2s1 Macintosh HD
UpdatePreboot: The Target Volume's OpenDirectory (non-special kind) user count is 1 and the Recovery (any of 3 kinds) user count is 2
UpdatePreboot: No custom Open Directory path given
UpdatePreboot: Using GivenVolumeMountPointOrNilIfNotMounted as MacOSSearchPath
UpdatePreboot: Using MacOSSearchPath's child dslocal path as OpenDirectorySearchPath
UpdatePreboot: MacOS Search Path = (nil=NotMounted) = /
UpdatePreboot: Open Directory Database Search Path = (nil=MacOSSearchPathNotMounted) = /var/db/dslocal/nodes/Default
UpdatePreboot: Successfully opened Open Directory database; setting AuthODNodeOrNil accordingly
UpdatePreboot: Mounting and ensuring as mounted the related Preboot Volume
UpdatePreboot: Preboot Volume = disk2s2 Preboot
UpdatePreboot: Preboot Volume Target Directory = /Volumes/Preboot/6AAC9D56-EC44-38B3-9C50-1D6DA3020377
UpdatePreboot: Considering APFS Crypto User EBC6C064-0000-11AA-AA11-00306543ECAC
UpdatePreboot: This is the Personal Recovery Key for this Volume
UpdatePreboot: Treating this APFS Crypto User as a Personal Recovery Key User
UpdatePreboot: Before rendering EFILoginUserGraphics user resources for type = EFI Login Personal Recovery Key User
UpdatePreboot: After rendering EFILoginUserGraphics Data=(0=Error)=0x7fb910f24b00=0
UpdatePreboot: Successfully added a Personal Recovery Key User to the building dictionary
UpdatePreboot: Successfully processed APFS Volume Crypto User EBC6C064-0000-11AA-AA11-00306543ECAC
...
UpdatePreboot: Considering APFS Crypto User 57A79AC6-ED71-4DE5-82BE-6B0ECFC5E2C
UpdatePreboot: Defaulting and requiring that this be an Open Directory User
UpdatePreboot: Treating this APFS Crypto User to be, and requiring to match, an Open Directory User
UpdatePreboot: Correlated APFS Volume Crypto User with Open Directory User 57A79AC6-ED71-4DE5-82BE-6B0ECFC5E2C aka "admin"
UpdatePreboot: All required data for this Open Directory user has been obtained
...
datePreboot: Writing Admin User Info File to path /Volumes/Preboot/6AAC9D56-EC44-38B3-9C50-1D6DA3020377/var/db/AdminUserRecoveryInfo.plist
UpdatePreboot: Successfully wrote Admin User Info File
UpdatePreboot: Checking for existence of Secure Access Token file /var/db/dslocal/nodes/Default/secureaccesstoken.plist
UpdatePreboot: Before copying Secure Access Token file /var/db/dslocal/nodes/Default/secureaccesstoken.plist into directory /Volumes/Preboot/6AAC9D56-EC44-38B3-9C50-1D6DA3020377/var/db
UpdatePreboot: After copying error=(0=success)=0
UpdatePreboot: Unmounting Preboot Volume
UpdatePreboot: Exiting Update Preboot operation with overall error=(0=success)=0

If it ends with an overall error of 0 then that's it. Done! Reboot and be prepared to wait. The first boot took an an inordinate amount of time for me. I was patient and let it do it's thing and it paid off. Finder finally loaded and everything opened up to it's pre-upgrade status.

If you see errors while updatePreboot is considering the Open Directory User ensure your unlocked APFS volume is mounted and readable. It must have access to the local Open Directory search path (/var/db/dslocal/nodes/Default) to build a list of authorized users (AdminUserRecoveryInfo.plist) and an access token (secureaccesstoken.plist) and copy them onto the Preboot volume (/Volumes/Preboot/6AAC9D56-EC44-38B3-9C50-1D6DA3020377/var/db/).

I suspect it is updatePreboot that causes this problem during install. I have a working theory on why it is happening: The OS Installer reboots the system. After restart the CoreStorage volume is unlocked and converted to APFS after which the OS install process begins. When the install is complete, just before the final reboot, updatePreboot is applied to the FV2 boot volume. We have already shown that updatePreboot will fail if the FV2 volume is locked and I'm fairly sure FV2 volumes lock (or have the encryption keys destroyed) at sleep. Following this logic: if the machine sleeps during (or at the end of) the install process but before updatePreboot runs, the Preboot volume will fail to get updated. The machine then reboots: EFI sees the FV2 boot volume so it looks to the (improperly updated) Preboot volume for authorized users. EFI fails to find any admin users since updatePreboot could not read them from Open Directory on the locked boot volume so it displays the generic "disk password" prompt. This is also why neither the recovery key nor an icloud account will unlock the drive.

I hope this helps anyone with this issue. Also, please feel free to correct any glaring mistakes I may have made.

Scot

I ran into this last night, while upgrading Sierra to High Sierra on my new MacBook Pro (15", 2017), having never installed a beta. My scenario is slightly different than croaker's in that I have two users (with admin privileges, for what it's worth), and one could not be decrypted with the updatePreboot command, resulting in errors. Haraguroicha Hsu did give me the idea to decrypt the main volume, which took about 16 hours (100 GB of storage). But after the decryption completed, I restarted, the installation proceeded, and after about 30 minutes High Sierra was installed and running normally. So if running

diskutils apfs updatePreboot <disk-id>

doesn't work, I suggest decrypting the disk:

diskutils apfs decryptVolume <disk-id>

And then (after many, many hours) restarting. Be sure to turn FileVault back on when installation completes.

I had the same problem with a fresh install of :

Mac OS High Sierra

French language and French numeric keyboard layout

APFS (case-sensitive & encrypted)
Enabled FileVault

Installed BootCamp

After the BootCamp installation, I restard to set the default boot to Mac OS but I stopped on the FileVault password request for my account.
It wont recognize my password... On the top-right corner, it show "French - Numeric" keyboard layout is active but in fact it is not... I have to chose the "French - PC" layout and type like it was a PC keyboard to make my password works.

So, for me, it is not a problem of cryptography but simply a problem of keyboard layout...
Try some other keyboard layouts and test your password again and again.
It is way harder to find a working keyboard if your password contains symbols.

Good luck

Hi, i have a bigger Problem... I tried to upgrade to high sierra - the update stuck so I had to switch of my macbook pro retina 2012... Now I restarted and tried to install high sierra via recovery mode. 2 hours later macbook wants disk password - nothing works ... So I think I don‘t have any bootable system— what should I do now? Apple cant help me- they want me to delete the volume- but I have data which are not backuped... any ideas???

I just did my upgrade to macOS High Sierra with a volume that had FileVault2 enabled and had this happen (prompt for disk password but would not accept any password).  I ultimately called AppleCare... they had a note on the issue.

The solution was:

Boot into the recovery OS by

- Power off the Mac

- Press-and-hold CMD+R while powering on and wait for the machine to boot.

- Select "Disk Utility"

Within Disk Utility

- Select your internal volume (e.g. "Macintosh HD" unless you've renamed it)

- Select the "Mount" icon (along the top)

It will prompt for a disk password but this time YOUR normal login account password will work and the volume will mount.

Take note of the "Device" name (there's a table with information about the mounted volume... the device name will be in the lower right corner).  The device name may be something like "disk2s1" - write it down... you need to know that device name for the next step.

Exit Disk Utility

Select the "Utilities" menu along the top and pick the "Terminal" app.

Within the terminal window you are now at a root prompt.

Type (at the root prompt #):   diskutil apfs updatePreboot name-of-device

e.g. if your device was 'disk2s1' then the command would be:   diskutil apfs updatePreboot disk2s1

That will take a moment (you'll see pages of messages fly by).  Once you see the root prompt (#) return, it's ready.

Reboot your mac.  You're done!

The mac should now boot normally  (altough if you're just upgraded to macOS High Sierra then you'll get the normal set of screens that appear the first time you log in after the upgrade... e.g. it'll probably ask you to login to your iCloud account, etc. etc.)

Anybody else getting "did not recognize verb "apfs" "  in Terminal?

Hello,

I have just fixed my MacBook Pro 2015 after chatting with Apple and the actual command I had to run - as I had the user account missing issue - was this:

diskutil apfs updatePreboot “/Volumes/Macintosh HD” -od “/Volumes/Macintosh HD/Recovered Items/private/var/db/dslocal/nodes/Default”

***There is a space between Recovered and Items***

Please note I had no issues with running first aid on my drive, I just got the DISK PASSWORD prompt after trying to install High Sierra

Once I ran that command and restarted the installation continues for about 20 mins, it then restarted and I saw my actual login screen

Hopefully this will help someone in the same situation as me, as the other stuff on this forum did not work but as you will see it is quite close to the command apple gave me which is ran via RECOVERY boot and opening Terminal

During the macos upgrading, I encountered the same issue as "Disk password" required, but password didn't work.

I fixed it with below commands:

Steps:

1. Issue commands "diskutil apfs list" to find out the APFS volume disk name like "disk1s1".

    For Macbook pro, the mount point should be "/Volumes/Macintosh HD"

    For Macbook air, the mount point should be "/Volumes/air"

Let's suppose the APFS volume disk is "disk1s1", and you use Macbook pro(the mount point is  "/Volumes/Macintosh HD").

2. Issue the following commands to unlock the disk

    diskutil apfs unlockvolume disk1s1

3. Issue the following commands to updatePreboot for this disk

    diskutil apfs updatePreboot disk1s1

4. Check the error message, you may get error code as "error=-69569"

5. Issue the following one line commands to updatePreboot, check the command carefully again and again.

diskutil apfs updatePreboot disk1s1 -od /Volumes/Macintosh\ HD/Recovered\ Items/private/var/db/dslocal/nodes/Default

After the command issued successfully. hard reboot the macbook, restart. Problem fixed!

Problem is I can’t mount the APFS disk to copy the users/tokens into the Preboot volume. I’m able to unlock the volume disk, but said it failed to mount. I tried unmounting disk0 and unlock/mount disk2 as suggested, but same mounting failure. I can confirm that “diskutil apfs list” shows that disk2s1 is “Encypted: Yes (Unlocked)”. I had FileVault on in HS, then upgraded to .1 and this happened. Any suggestions or ideas from here?

Hi everyone and thanks for your input here!

I have the same problems with the final version of High Sierra right now.

Unfortunately I got another error when I tried to unlock with diskutil apfs unlockvolume:

Error unlocking APFS Volume: Couldn't mount disk (-69842)

Before that I ran diskutil apfs list and got different than croaker:

APFS Volume Disk (Role):  disk2s1 (No specific role)
    |  Name:                      Macintosh HD (Case-insensitive)
    |  Mount Point:               Not Mounted
    |  Encrypted:                 Yes (Locked)

I have no knowledge of that stuff  And I couldn't find a solution with the error -69842 in other forums.

Does someone has an idea how to fix that?

Thank you so much!