Question: Afternoons all,

So I have a MacBook Pro, 2018 TB with High Sierra that's bound to a Windows domain, built via JAMF.

We have one admin account on the machine which our IT team use then the user account where they themselves are also admins. I should point out I have admin rights on the machine.

Nothing special about these accounts as far as I'm aware.

However when my user logs onto the machine, to do their work and then reboots, at logon they are only prompted for the password for the IT admin account. They don't see the username and password fields.

I'm trying to go through the console logs but unsure what I'm even looking for.

I should have mentioned, I have admin rights but some features are locked down via JAMF security profiles.

Anyone else seen this issue?

Answer: 
FileVault is the clear case where the system will boot to a pre-OS screen and show you only the file vault enabled accounts. When you sign in and authenticate as one of these accounts, that unlocks a decryption key that allows the OS to be readable and starts the actual OS boot process.

You can determine which accounts have been enabled in FileVault by examining that system preference once you’re logged in to the running OS.

Since you managed MDM and JAMF - here is an article with great technical data on the need for a secure token to be provisioned for each FileVault enabled account:

* <https://derflounder.wordpress.com/2018/01/20/secure-token-and-filevault-on-apple-file-system/>

Your IT team should investigate JAMF Connect which extends the typical log in screen to let any AD allowed account log in. It also can be provisioned so that membership in an AD group maps to an admin local account or a non-admin local account. It’s an amazing tool and far better than binding which can have many down sides.

* <https://www.jamf.com/products/jamf-connect/>
I've just bound a MacBook Pro to a domain (for the first time), and have apparently had the same (painful !) issue. FireVault wasn't the culprit, because it isn't enabled by default.

The solution (inspired by [this thread](https://www.reddit.com/r/macsysadmin/comments/3kjmr7/binding_mac_to_ad_can_i_login_without_ethernet/)) was to **enable "mobile accounts" in the domain binding menu:**

[![screenshot of domain binding menu with circled option](https://i.stack.imgur.com/RkXDk.png)](https://i.stack.imgur.com/RkXDk.png)
*macOS Big Sur (11.2.3),* en français