I got locked out of my MacBook after losing the password and system recovery doesn't work

[iRock1]

I have a late-2008 aluminum MacBook running El Capitan. I lost access to the OS because of a password issue (basically I changed the password by “accident” and didn't had the opportunity to read much less write down the new one).

What I'm trying to do now is to access the recovery partition, so I can use Terminal to reset the system password from there. However, I'm having a really hard time getting to accomplish that.

First, for some reason cmd+r during startup doesn't work. At all. The Apple logo just appears as usual and then the regular boot process goes on. However, what's weird is that, as I keep the cmd+r keys pressed while the loading bar goes on, the screen starts to flash or tilt, as if the OS was trying to tell me something. What does this mean?

Second, I tried Internet Recover, using cmd+alt+r during startup. Again, the system just boots as usual.

Third, I connected an external drive which has two partitions, one of which is used for my Time Machine backups. Then I pressed alt during startup. To my amazement, the only thing that appears there is the main Macintosh HD partition. No recovery partition, no Time Machine backup. (I got to say that this is extremely weird, since I have no memory of deleting the recovery partition, and the external drive has been working normally in previous days.)

Fourth, I reseted the PRAM with cmd+alt+p+r and then tried everything mentioned above again. Everything stays the same.

At this point I'm running out of ideas and I don't know what the hell is going on, not to mention that I'm on the go, therefore I don't know anyone with a Mac so I could use a USB stick to make an Install drive.

Perhaps there's something I could do from iCloud? Is it possible to reset my system password from there? FWIW I never confirmed the password change in iCloud (the OS would display a notification asking me to do so).

 

[Funsize93]

Maybe give this a try to force the setup assistant. If it works you can go through the initial setup again to create a temporary admin account which you can then use to update the password of your original admin account.

How to Re-Run the OS X Setup Assistant - The Instructional

 

[Fishrrman]

Don't do the following unless you have a backup or don't mind losing what's on the drive.

1. Go to ebay
2. There are folks there who will sell you a USB flashdrive with a copy of the OS installer pre-installed on it. Will cost you about $20
3. Buy one with the El Cap installer on it.
4. When you get it, boot from it
5. Don't run the installer yet.
6. Open Disk Utility and ERASE the internal drive to Mac OS extended with journaling enabled.
7. Quit DU and re-open the installer
8. Install a clean copy of El Cap on the empty drive
9. When done, set it up and start over.

 

[chrfr]

Second, I tried Internet Recover, using cmd+alt+r during startup. Again, the system just boots as usual.

Only Macs made in 2010 and later support Internet Recovery, so that's why that doesn't work. Do you have one of the original install DVDs that came with the computer? If so, you can boot from that and use the terminal there.

 

[CoastalOR]

I have a late-2008 aluminum MacBook running El Capitan.

Third, I connected an external drive which has two partitions, one of which is used for my Time Machine backups. Then I pressed alt during startup. To my amazement, the only thing that appears there is the main Macintosh HD partition. No recovery partition, no Time Machine backup.

I can explain the Time Machine booting problem.
Normally Time Machine is bootable to the archived Recovery partition on the Time Machine volume, BUT there was a bug with El Capitan that made Time Machine not bootable (if the TM backup is El Capitan). El Capitan was the only OS that had the TM bug that I know about.

 

[teidon]

Have you tried single user mode? Press CMD+S during start up. You will probably need to mount your main partition before you can do what you want to.

 

[iRock1]

Maybe give this a try to force the setup assistant. If it works you can go through the initial setup again to create a temporary admin account which you can then use to update the password of your original admin account.

How to Re-Run the OS X Setup Assistant - The Instructional

Have you tried single user mode? Press CMD+S during start up. You will probably need to mount your main partition before you can do what you want to.

Ok, I have good and bad news.

The good one is that using cmd+s I was able to re-run the OS X setup assistant and create a new admin account, and from there I was able to change the password associated to my original account.

The bad one is that as I logged in my original account, a ton of alerts appeared (related to iCloud, iMessages and dozens of other apps), asking me the unknown password "to use the login keychain". This means in practical terms I can't use that account. For instance if open up Safari the app will freeze. If I go to iCloud in System Preferences, the same.

What can I do?

I can explain the Time Machine booting problem.
Normally Time Machine is bootable to the archived Recovery partition on the Time Machine volume, BUT there was a bug with El Capitan that made Time Machine not bootable (if the TM backup is El Capitan). El Capitan was the only OS that had the TM bug that I know about.

Whoa, that's a big fork up. What does this mean for users who in some cases would desperately need to boot from a TM backup? Are they just abandoned? Consider that El Capitan is the newest version of macOS that computers like mine can update to.

 

[treekram]

Ok, I have good and bad news.

The good one is that using cmd+s I was able to re-run the OS X setup assistant and create a new admin account, and from there I was able to change the password associated to my original account.

The bad one is that as I logged in my original account, a ton of alerts appeared (related to iCloud, iMessages and dozens of other apps), asking me the unknown password "to use the login keychain". This means in practical terms I can't use that account. For instance if open up Safari the app will freeze. If I go to iCloud in System Preferences, the same.

What can I do?

Whoa, that's a big fork up. What does this mean for users who in some cases would desperately need to boot from a TM backup? Are they just abandoned? Consider that El Capitan is the newest version of macOS that computers like mine can update to.

For the "login keychain" message, open the "Keychain Access" app (in the Utilities sub-folder in the Applications folder). Select "Local Items" on the top left and "Passwords" on the bottom left and your saved passwords (or your preference not to save the password) for Safari will appear on the right. I presume the iCloud password, etc. will show up here as well, but I don't use iCloud, iMessages. I use Firefox and the passwords aren't here - my guess is that Firefox doesn't use this keychain to store that. I also wouldn't know about your "other apps" - it would seem this is used for Apple apps - I don't know if non-Apple software would use it. The items with a blue "@" icon were created by a user and can be deleted - that may solve your issue. I was able to delete an item without the app asking for my login password. If you don't remember the website, etc. password you used for that particular item, you can right-click and ask it to "Copy Password to Clipboard" but it likely will ask for your password and I don't know if it's your current password or the password that was used when the item was created - if you use this you can try that and report back. I don't know about the items that have the icon of a pencil with ... after it. These look to be system items and should probably be left alone - you can research that if necessary.

If you click on "login" on the top left and key the bottom left on "Passwords", what I see is hardware passwords that I've entered so these can probably be left alone unless you have issues there.

About the El Capitan TM boot, if yours does not boot, use the USB installer that you used. It should have the option to restore a TM backup. Strangely enough, I have heard about the El Capitan TM non-boot issue but my encrypted TM backup does boot and having an encrypted TM backup makes it less likely to boot so I have no idea why mine can boot - it's a Firewire drive that started life as a Mountain Lion TM backup (for the same computer) so that may have something to do with it.

 

[teidon]

I have a late-2008 aluminum MacBook running El Capitan.

First, for some reason cmd+r during startup doesn't work. At all. The Apple logo just appears as usual and then the regular boot process goes on.

It is possible that if you have an old installation of macOS that you have updated to El Capitan, the Recovery partition hasn't been created to your system. Recovery partition requires some amount of disk space so creating it would require resizing one or more of the partitions. That is very dangerous action so the macOS updater probably won't do it.

As you have a TM backup this might be a good time to do a fresh install. This would get rid of at least some of the junk that your system has accumulated over the years and it will also create the Recovery partition. Just find yourself an USB stick, download the El Capitan installer and google instructions how to create bootable USB installer. After the install is complete you can restore the backup. You will want to restore the version of the backup that still has the old password in place.

But if you don't want to go that route you could probably just restore an old version of your keychain, one that was encrypted with your old password. Google around the files you need to restore. And in case that doesn't work you have no other choice but to delete your keychain and create a new from scratch. If you have iCloud Keychain syncing enabled this probably won't cause much trouble to you as most of the keychain content is synced between devices. But do make sure that you have a backup of the keychain (just in case) and that you remember all your important passwords.

 

[iRock1]

For the "login keychain" message, open the "Keychain Access" app (in the Utilities sub-folder in the Applications folder). Select "Local Items" on the top left and "Passwords" on the bottom left and your saved passwords (or your preference not to save the password) for Safari will appear on the right. I presume the iCloud password, etc. will show up here as well, but I don't use iCloud, iMessages. I use Firefox and the passwords aren't here - my guess is that Firefox doesn't use this keychain to store that. I also wouldn't know about your "other apps" - it would seem this is used for Apple apps - I don't know if non-Apple software would use it. The items with a blue "@" icon were created by a user and can be deleted - that may solve your issue. I was able to delete an item without the app asking for my login password. If you don't remember the website, etc. password you used for that particular item, you can right-click and ask it to "Copy Password to Clipboard" but it likely will ask for your password and I don't know if it's your current password or the password that was used when the item was created - if you use this you can try that and report back. I don't know about the items that have the icon of a pencil with ... after it. These look to be system items and should probably be left alone - you can research that if necessary.

If you click on "login" on the top left and key the bottom left on "Passwords", what I see is hardware passwords that I've entered so these can probably be left alone unless you have issues there.

About the El Capitan TM boot, if yours does not boot, use the USB installer that you used. It should have the option to restore a TM backup. Strangely enough, I have heard about the El Capitan TM non-boot issue but my encrypted TM backup does boot and having an encrypted TM backup makes it less likely to boot so I have no idea why mine can boot - it's a Firewire drive that started life as a Mountain Lion TM backup (for the same computer) so that may have something to do with it.

It is possible that if you have an old installation of macOS that you have updated to El Capitan, the Recovery partition hasn't been created to your system. Recovery partition requires some amount of disk space so creating it would require resizing one or more of the partitions. That is very dangerous action so the macOS updater probably won't do it.

As you have a TM backup this might be a good time to do a fresh install. This would get rid of at least some of the junk that your system has accumulated over the years and it will also create the Recovery partition. Just find yourself an USB stick, download the El Capitan installer and google instructions how to create bootable USB installer. After the install is complete you can restore the backup. You will want to restore the version of the backup that still has the old password in place.

But if you don't want to go that route you could probably just restore an old version of your keychain, one that was encrypted with your old password. Google around the files you need to restore. And in case that doesn't work you have no other choice but to delete your keychain and create a new from scratch. If you have iCloud Keychain syncing enabled this probably won't cause much trouble to you as most of the keychain content is synced between devices. But do make sure that you have a backup of the keychain (just in case) and that you remember all your important passwords.

Hi,

In the end I was able to solve the Keychain problem following the steps indicated here: https://support.apple.com/en-us/HT202860 ("Create a new login keychain, if necessary").

Regarding the Recovery Partition, now that I have access to my account again I can see that, in fact, I don't have that partition. Why? I guess the explanation given by @teidon makes sense.

I'll create a Recovery Partition one of these days, though I'm not too inclined to having a system restore. To be honest, I'd never understood the purpose of it since I'm going to use TM to get my Mac to the current state anyway.

Thanks a lot btw.

 

[teidon]

I'll create a Recovery Partition one of these days, though I'm not too inclined to having a system restore. To be honest, I'd never understood the purpose of it since I'm going to use TM to get my Mac to the current state anyway.

If you do fresh install you can afterwards use Migration Assistant to selectively restore only specific things.

 

[iRock1]

I'm having a weird inconvenience after all these password changes. Every time I get online I get this message:



If I click on Details it sends me to System Preferences > iCloud, where I see my system username and I have to enter the system password. I've done it like three times until this point, yet macOS keeps displaying that message every time I get online.

 

[MBAir2010]

someone has infiltrated your password.
from 2016 to 2017 ever third month on a Friday at 3AM, my apple id password was changed, and i had to reset that for 5 devises.
i sent the email to apple live text tech help (waaaaaay back in October 2016 when they cared) and sure enough my user user name was compromised
the issue was resolved when apple finally decided to accept @me.com as the primary email user.
remember, apple was hacked a couple years ago and some users like me were infiltrated.
solution is to change your user email name.

obviously, I would wait until someone else has a better solution, since that us the beauty of this forum.