Open Radar

 
Summary:
When running an OS update that restarts a FileVaulted computer and automatically logs in as the user that ran the update, the failedLoginCount of the user's record is incremented and can cause the user to not be able to authenticate as an admin or get a valid command prompt in the Terminal.

Steps to Reproduce:
1. Start with an admin account on a system that needs an OS update (i.e. 10.12 to 10.12b5).
2. Apply a password policy that locks the account after 5 failed login attempts. 'pwpolicy -setaccountpolicies -u "$username" /path/to/pwpolicy.plist' (see attached file)
3. Run the update and wait for the computer to restart
4. Authenticate as the user that ran the update.
5. Open system preferences and try to authenticate to a panel
6. Open the Terminal and look at the command prompt.

Expected Results:
The admin user should be able to authenticate to locked system preference panels.
The user should see a standard command prompt.

Actual Results:
The authentication dialog shakes as if the password is wrong.
The Terminal window shows
Login incorrect
login: 
and won't accept any user name.
To confirm the problem, logout and back in as another user and run 'pwpolicy authentication-allowed -u $problemusername' The system will report that they can't log in due to maxFailedAttempts.  Clearing failedLoginCount and failedLoginTimestamp will allow the user back in.