FileVault Recovery

If a user forgets the login password, the administrator can send a personal recovery key to the remote user, to allow them to log in. The key is a string of letters and numbers separated by dashes.

1. The user locates the serial number of the locked device.

   Step	Instructions
   1	Find the serial number of the locked device. It is usually printed on the back of the device.
   2	Give the serial number to the support representative.

2. The Administrator gives a recovery key to the user.

   Step	Instructions
   1	Get the serial number of the locked device from the user.
   2	In the Endpoint Web Management platform, go to Computer Management > Full Disk Encryption Actions > Recovery > FileVault Recovery Media.   The FileVault Recovery Media window opens.
   3	In the Computer's Serial Number field. type the serial number.
   4	Click Get Recovery Key.
   5	Give the recovery key to the user.

3. User resets their password.

   Step	Instructions
   1	Get the Recovery Key from the support representative.
   2	Restart the Mac.
   3	In the FileVault pre-boot Authentication before the Operating System loads. screen, click the ? button A message shows: If you forgot your password you can reset it using your Recovery Key.
   4	Type the Recovery Key, and click -> A progress bar shows.
   5	For Local Users: In the Reset Password window, the user enters a new password, and optionally, a password hint. Click Reset Password.

How to update the Personal Recovery Key (PRK) for Native Encryption Management FileVault, see sk138352.

1. Show the disk volumes on the Mac. Run this command:

   diskutil apfs list

   The volume to recover is the OS Volume. It has a name similar to disk2s1.

2. Run this command:

   diskutil apfs unlockVolume <Diskname> -passphrase <personal recovery key>

   The volume is now unlocked.

3. Get the list of apfs cryptousers. Run:

   diskutil apfs listcryptousers <Diskname>

   For example:

   diskutil apfs listcryptousers disk2s1

   For a local user, select the UUID of the user that has Type: Local Open Directory User

4. Decrypt the volume. Run:

   diskutil apfs decryptVolume <diskname> -user <user UUID>

5. Enter the password of the local user

6. To monitor the progress of the decryption, run:

   diskutil apfs list

1. Run this command:

   diskutil cs unlockVolume <lvUUID> -passphrase <personal recovery key>

2. The user interface shows a prompt to allow access. Enter the keychain password.

   The volume is now unlocked.

3. Start the decryption. Run:

   diskutil cs decryptVolume <lvUUID>

4. When prompted, enter the password for the local user.

5. To monitor progress of the decryption, run:

   diskutil cs list