It’s good practice to have a backup of important things in your life. You wouldn’t only keep one set of keys to your house or car. The same goes for your FV2 Encrypted Mac. The FileVault Personal Recovery Key is your backup key to your Mac. If your account password is not working or if you can’t remember the password, the Recovery Key will be the only way to get to your data.
Two Different Types of FileVault 2 Recovery Keys
When encrypting your Mac, you have two different types recovery key options.
- (PRK) Personal Recovery Key – Every Mac has a unique Recovery Key.
- (IRK) Institutional Recovery Key – One Recovery Key for every Mac
While it may be convenient to have one key for every Mac, having a Institutional Recovery Key is like having a Master Key to an Apartment Complex. If that key is stolen or lost, the bad guy has a key to every single apartment unit. The same thing goes for the (IRK) if one user has the key, it’s known for every single Mac.
The PRK is the way to go, as each Mac has a unique key.
I previously wrote about how to use the PRK to recover data from a Mac using Target Disk Mode.
https://mrmacintosh.com/filevault-2-target-disk-mode-unlock-using-the-personal-recovery-key/
Why Would Would I Need to Change my Personal Recovery Key?
Here are a few reasons why you might need to reissue or generate a new FileVault 2 Personal Recovery Key.
- 1. The Computer Record was deleted from your MDM.
- 2. The MDM Recovery Key Entry is corrupted.
- 3. The Recovery Key is not working.
- 4. The PRK is given to a user and you want to cycle and protect it.
- 5. The PRK user is missing, or the ? mark is not showing at FV2 login.
- 6. If you need to reenroll a Mac into a different MDM.
A good example of #2 is when Jamf Pro 10.7.1 screwed up the recovery key display in every computer record. This defect was fixed in Jamf Pro 10.10.
https://www.jamf.com/jamf-nation/discussions/31910/filevault-2-personal-recovery-key-issue
Reissue the FileVault 2 Recovery Key with FV2 Enabled Username and Password
To generate a new FileVault 2 Personal Recovery Key we will be using the fdesetup binary.
First you can check to see if your Mac is using a PRK or IRK.
sudo fdesetup haspersonalrecoverykey = true or false
sudo fdesetup hasinstitutionalrecoverykey= true or false
Now we can change the recovery key using username and password.
sudo fdesetup changerecovery -personal
Enter the user name:mrmacintosh
Enter the password for user 'mrmacintosh':
New personal recovery key = 'Z5V7-K464-PEVT-09OX-Q2EW-8FO8'
This works for 10.13 – 10.15
Reissue the FileVault 2 Recovery Key using the Current Personal Recovery Key (PRK)
Staring in 10.14, you can now use the current Personal Recovery Key to generate a new PRK.
You will be using the UUID of the Personal Recovery User and the current PRK as the password.
Find the UUID of the Personal Recovery Key User
sudo fdesetup list -extended
ESCROW UUID TYPE USER
0A1BCDC3-49BD-4E00-B741-813E143AD1E2 OS User mrmacintosh
EBC6C064-0000-11AA-AA11-00306543ECAC Personal Recovery Record
Note: The UUID of the Personal Recovery User is the same very every FV2 Encrypted Mac.
Let’s change it.
sudo fdesetup changerecovery -personal
Enter the user name:EBC6C064-0000-11AA-AA11-00306543ECAC
Enter the password for user 'EBC6C064-0000-11AA-AA11-00306543ECAC':
New personal recovery key = 'Z5V7-K464-PEVT-09OX-Q2EW-8FO8'
For the password field, all we need to do is enter in the current FV2 PRK.
NOTE: If you want to send the Recovery Key to Jamf Pro, you need to run Recon twice.
Running commands are great for 1 or 2 Macs, but what if I have to fix more than that?
The guys at HCS Technology Group wrote up an excellent article showing us how to create a policy for this. The policy will search for all Macs that do not have a valid recovery key and will remediate with a script kicked off by a Jamf Policy.
https://hcsonline.com/images/PDFs/Jamf_Recovery_key_Filevault.pdf
Credits
Hat Tip goes out to Johan McGwire aka yohan on #MacAdmins. He brought up the 2nd way to reissue the Personal Recovery Key with the current PRK. Johan the expert behind the following projects. Check them out!
Also HCS Technology Group, I can’t say enough about these guys. They have written some of the best MacAdmins guides available today!
Get the full list HCS White Papers, visit this link.
http://hcsonline.com/support/white-papers.
Follow them on Twitter! https://twitter.com/HCSTechnology
What is MDM? Please define your acronyms.
MDM is Mobile Device Management. I believe this blog’s target audience is Apple system administrators who will already be very familiar with this term, in this same way you might be familiar with WiFi or e-mail, so this isn’t a term the author would normally be expected to define for the intended audience.
Here is a good starting point if you would like to learn about MDM in relation to Apple products: https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/web