Hello,
Use sudo in Recovery or Target Disk Mode (No GUI Login)
Avoid logging into the account via the GUI. Instead, do the following:
Boot into macOS Recovery or connect the machine in Target Disk Mode.
Use Terminal and authenticate with the JAMF admin account via sudo.
Run a command to reset the user's password: sudo dscl . -passwd /Users/username newpassword
This method does not trigger the GUI password change policy, thus preserving JAMF's rotation.
Use Screen Sharing or SSH (Remote Access Only)
Enable Remote Login (SSH) or Screen Sharing on devices.
Connect using: ssh admin@hostname
Once connected, reset the user's password from the command line as above.
This avoids GUI login and keeps the password rotation working.
Note: Ensure SSH is enabled in your configuration profiles or prestage settings.
Use JAMF Policy with “Reset Local Account Password” Payload
Create a self-service policy or on-demand JAMF policy that allows IT to reset a user's password remotely:
Scope to your IT team or specific device.
No login required on the device.
This avoids using the local admin account altogether.
Create a Second Admin Account (Manual/Non-Rotating) for Emergency Access
Create a separate local admin account not subject to the password rotation or policy that forces a change on login.
Use this account only when GUI login is necessary.
Keep this account well-protected and documented for emergency use only.
Best Regard,
Helen
