Pasted

Unlock FileVault with the user's old password. Use the local administrator account if the user forgot their old password.


A second login screen is shown as the password entered is not valid in Active Directory. Login with the user's current AD password.


Start the MacOS Terminal app


Delete this user from FileVault. Enter the current Active Directory password when prompted by sudo.
sudo fdesetup remove -user username


Add this user back into FileVault. Enter the current AD password when prompted by fdesetup.
sudo fdesetup add -usertoadd username


Reboot device. User can now unlock FileVault with their current Active Directory password, and only one prompt is shown.