Managing Desktop Password Reset on macOS

Desktop Password Reset (DPR) for macOS includes a simple built-in configuration utility called DPRConfigurator.app that facilitates configuration updates.

To change the value of the configuration parameters for DPR, follow these steps:

1. Go to the master system or the system where the Configuration Utility is deployed.

2. Update the desired attributes and select Save to store your changes.

3. Ensure that the file name for deployment is config.json.

Configuration Options

The following options can be set using DPRConfigurator.app:

FileVault Support

When Desktop Password Reset (DPR) is configured, it automatically updates the user's FileVault password whenever their account password is reset. This ensures that the FileVault password stays in sync with the user's account password, maintaining seamless access to their encrypted files and directories after a password change.

Prerequisites

For DPR to update the FileVault password during a user password reset, ensure the following conditions are met:

1. In the DPR configuration, ensure the Update FileVault option is enabled. This setting is enabled by default.

2. Configure a management account's credentials for DPR to use. For more information, refer to Creating a Management Account.

3. Ensure FileVault is enabled on the user's device.

4. The user account performing the password reset must have a Secure Token.

FileVault Management Account

DPR requires a management account on each local device to automatically update the FileVault password when a user resets their account password. The credentials for this account must be stored in the system keychain.

Creating a Management Account

To minimize password rotations and avoid updating stored credentials in the system keychain, SailPoint recommends creating a dedicated management account for DPR. However, you can skip this step and share an existing suitable account's credentials with DPR.

To create the _sailpointdpr management account, run the following script:

sudo ./create-management-account.sh new_password my_admin my_admin_password

Expected output:

2025-05-08 12:38:47.431 sysadminctl[3236:49518] - Done!

This user is prevented from logging in and remains hidden from the login screen. However, the user is visible on the FileVault unlock screen.

Sharing Credentials with DPR

To store the management account's credentials in the system keychain and grant DPR access to the keychain item, run the following script:

sudo ./store-management-account-credentials.sh _sailpointdpr new_password

If you're using an existing management account, specify the correct username instead of _sailpointdpr.

Deleting the Management Account

To delete the _sailpointdpr management account, run the following script:

sudo ./delete-management-account.sh

Verifying Your Setup

While an end-to-end test will reveal configuration errors, you can also check that the requirements are met by following these steps:

1. Verify that FileVault is enabled:

   Run the following script:

   fdesetup status
   

   Expected output:

   FileVault is On.
   

2. Check that the management account:

   1. Is an admin:

      Run the following script:

      dscl . -read /Groups/admin GroupMembership
      

      Expected output:

      GroupMembership: root admin _mbsetupuser _sailpointdpr
      

   2. Has a secure token:

      Run the following script:

      sysadminctl -secureTokenStatus _sailpointdpr
      

      Expected output:

      Secure token is ENABLED for user
      

   3. Is prevented from logging in:

      Run the following script:

      dscl . -read /Users/_sailpointdpr UserShell
      

      Expected output:

      UserShell: /usr/bin/false
      

3. Verify that the credentials are in the keychain:

   Note

   Attempting to print the password fails due to limited access controls.

   Run the following script:

   security find-generic-password -s "SailPoint DPR Management Account"
   

   Expected output:

   keychain: "/Library/Keychains/System.keychain"
   version: 256
   class: "genp"
   attributes:
   0x00000007 <blob>="SailPoint DPR Management Account"
   ...
   

   To see the access control, view the item through Keychain Access.

   Screenshot

   

Exporting Configuration to Remote Systems

To update the DPR configuration on all remote systems, perform the following steps:

1. Run the configuration application, set the desired configuration values, and save the configuration file to a known location. The name of the file must be config.json.

2. Copy the configuration file to all remote systems, using an existing solution such as a Mobile Device Management (MDM) product. The required location for the config file on the remote devices is /Library/Application Support/SailPoint/DPR/config.json.

Enabling Logs

By default, DPR writes log messages to the macOS unified system log, using the subsystem com.sailpoint.dpr. These logs can be viewed in one of two ways:

• Using console.app, by searching for subsystem:com.sailpoint.dpr

• Using the log command line as root. For example,

  log show --predicate "subsystem == 'com.sailpoint.dpr'"

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.