How to regenerate recovery key when FileVault is enabled and key is invalid

Technical Articles ID: KB82481
Last Modified: 2022-10-10 11:48:37 Etc/GMT

Environment

Management of Native Encryption (MNE) - all supported versions

Mac OS X Yosemite 10.10 and later
Mac OS X Mavericks 10.9.0 and later

For details of MNE supported environments, see KB79375 - Supported platforms for Management of Native Encryption.

Summary

OS X Mavericks 10.9.x and later releases:

Apple introduced a new feature that allows users to change or regenerate the recovery key for FileVault on their system using their current password.
A user can now regenerate a recovery key or change the existing recovery key to generate a new key.

MNE users can import or escrow the recovery key to ePolicy Orchestrator (ePO) using the import key feature in the client user interface.
The feature is available as Endpoint Protection for Mac.app under /Applications on OS X systems.

Sometimes, you might need to obtain a new recovery key for a FileVault-encrypted system before escrowing it to ePO. For example:

The user has enabled FileVault encryption before MNE is installed and the user doesn't know the recovery key.
In cases where the existing recovery key has been changed or become invalid.

After regenerating the recovery key, the user can import the new recovery key into ePO using the MNE import key feature available on the OS X client.

MNE 2.1.0 and later

A new recovery key escrow process is available for Mavericks and Yosemite Operating Systems. This feature applies when the Mac OS X FileVault has been enabled before MNE being installed.
Users will see the following after they enable in the FileVault Product Settings policy the option Prompt user to create a new recovery key on already enabled systems:
- Users are prompted to enter their FileVault password.
- After the password is entered, the recovery key is automatically imported into the ePO database.

Solution 1

All MNE versions
To change or generate a new recovery key for FileVault on Mavericks/Yosemite:

On the Mac client, open Terminal.app from the /Applications/Utilities folder.
Run the following command:

sudo fdesetup changerecovery -personal

The fdesetup command requests a password for '/' or the recovery key.
To generate or change the recovery key for FileVault, enter a password or recovery key. If the command is successful, command output looks like the following:

sudo fdesetup changerecovery -personal
Enter a password for '/', or the recovery key:
New recovery key = 'AXFZ-RXPC-N4OP-5WPR-UUL8-GXH6'

NOTE: The recovery key must be a valid recovery key to generate a new key. If your existing recovery key is invalid, you can generate the key using your password.
Copy the new recovery key (Example: AXFZ-RXPC-N4OP-5WPR-UUL8-GXH6).

To import or escrow the new recovery key to ePO using MNE 2.0 and later:

Copy the recovery key you received in the preceding steps.
Open the McAfee Endpoint Protection for Mac.app application.
Under Encryption, enter the FileVault recovery key in the Recovery Key input field.
Click Apply to import the new recovery key for FileVault in ePO. MNE validates the recovery key before it generates a new recovery key and escrows it to ePO.

NOTE: For security reasons, MNE changes the FileVault key again and escrows the new recovery key to ePO.

Solution 2

To import the recovery key to the ePO database, use the MNE CLI:

On the Mac client, open Terminal.app from the /Applications/Utilities folder.
Navigate to /usr/local/mcafee/mne/bin/MNEMacTool.
Use either of the following commands with sudo rights:

- -import-key

-i

Example:
sudo /usr/local/mcafee/mne/bin/MNEMacTool - -import-key AXFZ-RXPC-N4OP-5WPR-UUL8-GXH6

NOTE: The following message is displayed after you enter the above command:

The FileVault recovery key is imported to the McAfee ePO server successfully.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

How to regenerate recovery key when FileVault is enabled and key is invalid

Environment

Summary

Solution 1

Solution 2

Affected Products

Languages:

Title

Title

Knowledge Center

How to regenerate recovery key when FileVault is enabled and key is invalid

Environment

Summary

Solution 1

Solution 2

Affected Products

Languages:

Choose your region

Title

Title