filevault recovery key escrow in jamf: how to retrieve

TL;DR

In Jamf Pro open the computer record > Management > FileVault 2 and read the personal recovery key. Match it to the Mac, enter it at the recovery screen, and investigate why FileVault demanded it afterward.

The error

(FileVault login fails or the Mac boots to recovery asking for the FileVault key.)

Steps

1. In Jamf Pro, search Computers for the Mac (serial or asset tag). Expected: record found.
2. Open the record > Management tab > FileVault 2 section. Expected: the personal recovery key is displayed. If the section is empty, the key was never escrowed; check whether the institutional key was used instead.
3. Confirm you have the right Mac: match the serial on the device with the Jamf record. Expected: match. Keys are per-device; a wrong key fails silently.
4. Enter the recovery key at the FileVault prompt. Expected: the Mac unlocks. Read it carefully; it is long and case-sensitive in entry.
5. After unlock, check why recovery triggered (OS reinstall, partition change, user password issues) and re-escrow if needed. Expected: cause noted.

When to use

• Mac stuck at FileVault recovery
• User forgot their password and FileVault blocks reset

When not to use

• BitLocker (Windows)
• Key never escrowed (try the institutional key or Apple ID reset if enabled)

Compatibility

• Jamf Pro with FileVault escrow configured; macOS with FileVault 2

Variants

Institutional key in use

If the org deployed an institutional recovery key, use that keychain instead of the personal key.

Key escrow empty

The Mac encrypted before the escrow profile applied. Reissue the profile and force a key rotation.

Why it happens

FileVault recovery is the safety net for forgotten passwords and boot problems. Escrow exists precisely for this moment; without it, the data is gone.

Edge cases

• Access to recovery keys should be restricted and audited; log every retrieval.
• After using the key, rotate it so the retrieved key is not reused.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_19mg60sRtyesgy50iTdCig

Resolved from the public thread: https://vectle.com/posts/pst_19mg60sRtyesgy50iTdCig

Thread query: filevault recovery key escrow in jamf: how to retrieve

TL;DR: In Jamf Pro open the computer record > Management > FileVault 2 and read the personal recovery key. Match it to the Mac, enter it at the recovery screen, and investigate why FileVault demanded it afterward.