Description
FileVault Personal Recovery Keys (PRKs) are essential for ensuring security and recoverability of encrypted devices. Jamf Pro plays a crucial role by securely escrowing these keys, enabling administrators to retrieve them when needed. It is critical to ensure that PRKs are properly configured and escrowed to prevent recovery issues.
When computers already FileVault encrypted before being added to Jamf or are missing the Recovery Key found under the computer inventory record in Jamf under Inventory > Disk Encryption, we can deploy a script via Jamf Pro policy to issue a new Personal Recovery Key which can be escrowed by Jamf Pro.
In cases where a password is not known, the PRK is not escrowed, and no other accounts can log in to reset the password, a different Apple method is needed to reset the password. If these options don't work, it may be necessary to erase and re-enroll the device, ensuring proper PRK escrow configuration during the re-enrollment process.
Reissuing the PRK with a Script
Open the link to this script (https://github.com/jamf/FileVault2_Scripts) in a new tab, select the Code button, and then select Download ZIP.
Unzip the file.
Follow the steps below to add the script to Jamf Pro:
Open Jamf Pro and navigate to Settings > Computer management > Scripts > New.
Set a Display Name for this script.
Click the Script tab and drag the reissueKey.sh script from the unzipped folder from step 2 into the "Script Contents" field in Jamf. Once we release the mouse button the script contents should appear in the "Script Contents" box within Jamf.
Click the Save button.
If it doesn't already exist in Jamf Pro, create a configuration profile to escrow the Personal Recovery Key. If a configuration profile with the escrow personal recovery key exists, skip to step 5.
Go to Computers > Configuration Profiles > New and give the configuration profile a name.
Click on the Security & Privacy payload and select Configure.
Click the FileVault tab.
At minimum click the toggle to Include Escrow Personal Recovery Key and fill in the Escrow Location Description.
Add computers to the Scope of the configuration profile and hit Save.
Create a policy to deploy the script:
In Jamf Pro, navigate to Computers > Policies > New.
On the General tab: specify a "Display Name" for the policy, set the Trigger to "Recurring Check-in", and leave the Frequency on "Once Per Computer".
Click Scripts and hit Configure
Click Add for the reissueKey.sh script created in step 3.
Select the Maintenance payload, click Configure and leave "Update Inventory" checked. This will force the computer to submit inventory when the policy runs.
Click on Scope and add desired computers or computer groups to the scope.
Click Save.
Once the policy is pushed out to the computer, it should reissue a key for the computer. After the computer submits inventory (at least one time if not two), the new key will be escrowed in Jamf under the computer inventory record in Inventory > Disk Encryption.