Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Freeclimbingfool

macrumors newbie
Original poster
Dec 6, 2017
1
0
I turned on my MacBook Pro 2015 15" tonight and this is what it is showing... have I been hacked!? What's going on
 

Attachments

  • IMG_0277.JPG
    IMG_0277.JPG
    704.1 KB · Views: 693
I turned on my MacBook Pro 2015 15" tonight and this is what it is showing... have I been hacked!? What's going on

Don't panic. This is a known bug. You haven't been hacked.

I ran into this a while ago and pulled my hair out trying to fix it. I'll try to recall the issue as best I can.

It's caused by a combination of FileValut, Guest User sharing, and Find My Mac. If you have FileVault turned on it forces you to use Listed Users login. If you have Find My Mac enabled a guest account MUST exist, but this account is limited to Safari only. When you fiddle with Guest Sharing under these conditions it causes this weird second Guest User account to appear that you can't log into. In fact, I was able recreate the problem simply by fiddling with the Guest Account / Parental Controls. Just turning certain check boxes on and off when both FileVault and Find My Mac are enabled will create this bug.

The fix is actually quite simple as I remember it. Open the terminal and find your /Users folders. If you delete all the guest accounts it should recreate the necessary one and fix this issue. I think. I think this was the fix. I remember trying all sorts of things and the fix was actually super simple and the first thing I should have done, because it became pretty obvious when I actually thought about what has happening. In fact I think I even had folder there called "Guest User" which I only found when I went into Users and tried to create a Standard User account called "Guest" and delete it just to see what would happen. It only then occurred to me to check /Users and see that, despite having deleted every account except my own via System Preferences there was a rouge Guest User (or maybe just Guest) account. It just needed to be deleted. I tried clearing preferences, disabling SIP and clearing preferences, etc. and all sorts of other things but it was just a duplicate account that got created that need to be removed. Don't go through all the trouble I did. Look for the rouge account and delete it.

Let me know if this works out for you. If not, I'll see if I can recall more specifically what the fix was. This drove me crazy for like 4-5 hours, so hopefully it won't do the same to you.
 
Last edited:
Use the below command in Terminal:

'sudo fdesetup remove -user Guest" and type enter.

It will ask for administrator password, enter it and there you go.

The rogue "Guest Account" on the far left will be gone.


The disk password issue usually appears if when you did a clean install of High Sierra you enabled APFS (Encrypted.) If you were to do a clean install of High Sierra again, and just choose APFS, once High Sierra is installed you would enable enable FileVault, and you will not have that "Disk Password" account either. That is the only way I was able to get that "Disk Password" to disappear. Of course this is when High Sierra had just come out, and I am not really sure why installing the latest update 10.13.2 would enable that account. The "Disk Password" account is the account that will decrypt the drive and then usually is the same as your Administrator account. You can use your Admin account or "Disk Password" account and you will get in to your account. Hope this helps. Need anymore help, post back.

:apple:
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.