Oct 26, 2023 · Enabling FileVault with Jamf Pro makes the Macs in your environment require a user’s credentials to complete the boot process. ... an additional token that gets escrowed to MDM. Introduced in macOS 10.15. ... Beginning with Jamf Pro 10.43, the FileVault 2 Personal Recovery Key Attribute allows admins to identify and export all of the personal ...

Jun 24, 2024 · For that to happen, you typically will want a Configuration Profile deployed to the Macs that enables escrowing of the keys into Jamf. Basically, the profile tells the Mac that anytime FileVault is enabled (if it's not already), or if the key is rotated, the Recovery key should get sent back to the MDM (Jamf Pro) for safe keeping.

Sep 14, 2017 · Personal Recovery Key Encryption Certificate: Set to "Automatically encrypt and decrypt recovery key." This tells Jamf Pro to generate a signing certificate for use encrypting a device's Person Recovery Key. Selecting this option ensures Jamf Pro has the appropriate private key to decrypt the recovery key when collected by an MDM command.

Aug 31, 2021 · The only remedy is to use Jamf's reissue FileVault key script, but that's not an ideal solution for my organization. 0 Kudos Reply. All forum topics; ... the config profile is the one you've already setup.. the binary does some MDM calls that get that to renew.. and this is called by writing out a plist via policy. 0 Kudos Reply. Jmichaud93.

Dec 18, 2023 · I may be wrong about this, since I haven't personally used this feature, but I believe to use the "Issue New Recovery Key" option in a policy, Jamf Pro already has to have a valid Recovery key escrowed for the Mac. Basically, to cycle or refresh a FV2 recovery key, you need something to authenticate...

Jan 28, 2021 · This is expected, as the file_vault_2_id.xml is only generated to be used with the Jamf Binary, and we are enforcing FileVault via MDM here now. MDM uses the /var/db/FileVaultPRK.dat (by default) to store the PRK instead. In order for this file to be created however, FileVault enablement must be triggered and a PRK must be set.

Jun 12, 2023 · In early 2015, I presented a solution I developed for Pinterest for reissuing and escrowing missing FileVault keys in Jamf. The solution centered around an AppleScript-driven password prompt that provided input to the fdesetup tool. Combined with an escrow profile (or its predecessor the redirection profile), this would generate a new FileVault recovery key and store it …

Recovery Key and upload the recovery key to Jamf Pro. The recovery key must be a .p12, .cer, or .pem file. If you upload a .p12 file, you are prompted to enter the password that you created when exporting the key from Keychain Access. Choose "Current or Next User" or "Management Account" from the Enabled FileVault 2 User pop-up menu.

Escrow Buddy was created to escrow FileVault personal recovery key (PRK) to an MDM server. Escrow Buddy’s authorization plugin includes a mechanism that, when added to the macOS login authorization database, will use the logging in user’s credentials as input to the fdesetup tool to automatically and seamlessly generate a new key during login.

May 2, 2023 · There are some scripts out there for reissuing a FileVault key with Jamf. ... when deployed out to a Mac with an "Unknown" or "Invalid" FileVault recovery key, it will reissue the key & escrow it back to the MDM without a user needing to interact with anything extra. They are using an authdb plugin that passes the logged in users credentials ...