Password shown as incorrect when generating recovery data on a Mac system

Technical Articles ID: KB95055
Last Modified: 2021-12-14 13:50:50 Etc/GMT

Management of Native Encryption (MNE) 5.x
Apple macOS FileVault
Mac - All supported Operating Systems

To view supported environments, see KB79375 - Supported platforms for Management of Native Encryption.

An incorrect password is shown when you generate new recovery data. You see the problem when MNE prompts you to enter the user password.

NOTE: An incorrect password is shown even though the correct password has been used in the timed interval.

Sequence of events that leads to the problem seen in the system's terminal application window:

In the terminal window, run the command below:

sudo fdesetup changerecovery -personal -user <user_name>
Enter the user password when prompted.

Output:
The system displays the error: Unable to change key.

This issue is with macOS and FileVault.

Do the following:

Contact Apple support and open a Service Request.
Contact us to open a Service Request, and reference this article.

To create a Service Request, log on to the ServicePortal:
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields. Your password and instructions are emailed to you.

To successfully generate new recovery data, you can specify the current recovery key in the MNE password prompt, instead of the user password.

To test this alternate process using the User's Unique Identifier (UUID):

On the Mac client, open Terminal.app from the /Applications/Utilities folder.
Run the command below:

sudo fdesetup changerecovery -personal
When prompted to enter the user name, type the user's UUID. See the example below:

User name:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
When prompted, enter your password.

NOTES:

If successful, you’re provided with the new recovery information:

New personal recovery key = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
Make sure to import the new recovery information into the MNE client. For details, see KB82481 - How to regenerate recovery key, when FileVault is enabled and key is invalid.
As a general best practice, we recommend that you make sure all data on the system is backed up.

This article is available in the following languages:

Knowledge Center