Patrick Gallagher

The FileVault password is never going to update itself, it's always going to require user intervention. But you should move away from binding your Macs to AD and instead use the Apple Kerberos Single Sign-on extension. This will allow you to use local accounts, which are synced to AD. The Kerberos extension would pick up that the passwords don't match and will prompt the user to sync. Binding to AD is no longer recommended by Apple.