Unable to authenticate at preboot after the administrator changed the user's password in Windows Active Directory

Technical Articles ID: KB79339
Last Modified: 1/28/2021

Environment

McAfee Drive Encryption (DE) - all supported versions

For supported environments, see KB79422 - Supported platforms for Drive Encryption 7.x.

Problem

A password change is made in Active Directory (AD) for a user that also exists as a DE user. The DE LDAP Synchronization task is run on the ePolicy Orchestrator server to synchronize User/Group details. But, the password change is not synchronized from AD.

The user can't authenticate in the preboot-authentication environment, when using the password changed by the Windows administrator in AD.

Cause

Password changes made within AD can't be synchronized from AD to an external password authentication system such as DE.

This AD security mechanism prevents passwords from being exported. A system can’t connect to a Windows Domain Controller while a user is authenticating in the Drive Encryption preboot environment. So, DE uses its own users authentication details. Although the user name might be the same, a preboot user and AD user are separate entities. Some changes can be synchronized from AD, such as samAccountName, DN, userAccountControl, but not the password.

Solution

To synchronize a user DE preboot password with Active Directory password, all criteria bellow must be met:

DE must be installed and activated.
The DE Product policy must have the following options enabled:
- Provide a Single Sign-On experience for Drive Encryption users (SSO) - Enable this option only when Autoboot option is not selected.
- Update the Drive Encryption user password to match the Windows user password (during Windows logon, or password changes).
- Periodically check domain credentials for changes and ask the user to recapture the Drive Encryption password if required.
- The Windows user name must match the user name of the Drive Encryption user before capturing SSO or synchronizing passwords
The user that is logged into preboot must be the same as the Windows user.
The password change must be performed after pressing Ctrl+Alt+Del (Credential Provider screen).
Suppose that you change the password from AD and the above policy options are configured in your Product settings policy. DE shows a pop-up message on the bottom-right corner of the screen to lock the system and unlock it again. This action captures the new AD password and synchronizes it with the DE user.
The system did not boot using Out-of-Band to bypass preboot.
An Emergency Boot was not performed on the client to bypass preboot.
An Administrative recovery was not performed on the client to bypass preboot.

Affected Products

Drive Encryption 7.2
Password Recovery

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Unable to authenticate at preboot after the administrator changed the user's password in Windows Active Directory

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Unable to authenticate at preboot after the administrator changed the user's password in Windows Active Directory

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title