Skip to main content
This article explains how to identify the cause of a login issue related to a password, resolve the situation (remotely or locally), and prevent future incidents.

​
Identify common causes

Common causes of login issues:
  • A forgotten password after a period of inactivity or a recent change.
  • A typing error related to the keyboard layout (e.g., switching from AZERTY to QWERTY).
  • A change in security policies (complexity, length, or rotation requirements).
  • A SecureToken issue on macOS — some password prompts at the login screen request a SecureToken-enabled account, not the employee’s regular login password.

​
Diagnose and secure

​
Avoid repeated login attempts

Ask the employee not to attempt multiple incorrect logins. On macOS, several failed attempts may trigger Recovery OS, making password recovery more complex.

​
Verify password entry with the employee

1

Ask the employee to type the password in a visible field

For example, the Username field, to check the characters entered.
2

Check the keyboard layout and input language

  • macOS: System Settings > Language & Region > Input method
  • Windows: Settings > Time & Language > Language & Region

​
Check the applied password policy

Administrators can define security policies (complexity, renewal frequency, rotation, etc.). Go to Settings > Security > Password policies and confirm the rule applied to the employee’s device. A recent policy may have required a password change.

​
Check SecureToken status (macOS only)

On macOS, some login prompts — particularly when unlocking FileVault, using admin-level features, or after a policy change — request a SecureToken-enabled account, not the regular login password. An employee may have the correct password but still be blocked if their account does not have a SecureToken, or if the prompt is for a different (admin) account that holds the token. To check SecureToken status on the device:
1

Open Terminal on the Mac

2

Run the SecureToken status command

3

Read the output

The output shows SecureToken is ENABLED or SecureToken is DISABLED for that user.
If SecureToken is disabled:
  • An admin user with SecureToken can grant it to another user:
  • Alternatively, you can use MDM > Profiles > Admin User Management to ensure a bootstrap admin account with SecureToken exists on all devices.
SecureToken is required for FileVault unlock and for granting other users permission to unlock encrypted volumes. If an employee cannot unlock FileVault even with the correct password, SecureToken is the most likely cause.

​
Reset the password

Choose the appropriate option based on the device status.

​
Option 1 — Renew the password remotely

Requirements:
  • You are an administrator of your company space.
  • The device is enrolled in the MDM.
  • The device is powered on and connected to the internet (Online).
  • An administrator session exists on the device.

​
Option 2 — Use the linked Apple or Microsoft account

If an account is linked to the device, follow the vendor’s procedure:
  • macOS: Sign in with the iCloud account (see the Apple guide)
  • Windows: Sign in with the Microsoft account (see the Microsoft guide)

​
Option 3 — Unlock with the recovery key (FileVault / BitLocker)

Requirements:
  • The device is enrolled in the MDM.
  • The device is not connected to the internet or is not communicating with the MDM.
  • Encryption is enabled (FileVault on macOS / BitLocker on Windows).
  • The recovery key is synchronized.
Actions:
1

Retrieve the recovery key

Open the device record and go to Information > Recovery key.
2

Unlock the session locally using this key

3

Set a new password

​
Option 4 — Fully reset the device

If none of the previous options work, the only solution is to fully reset the device.
This process erases all local data.

​
Prevent future incidents

To avoid future password-related login issues, implement the following actions:
  • Enable device encryption and ensure that each recovery key is properly stored.
  • Automatically create an administrator session on devices via MDM > Profiles > Admin User Management.
  • Plan and communicate security policy changes to your teams (effective date, complexity requirements).
  • Inform employees ahead of any global password renewal.