agent looked up the filevault key with the wrong device serial

TL;DR

The agent looked up the key by a mistyped or mismatched serial and returned another device's key. Verify the serial with the user, confirm it matches the device record, then fetch the key.

The query

agent looked up the filevault key with the wrong device serial

Use this when

• the FileVault key does not unlock the Mac
• the serial in the ticket looks wrong
• the agent skipped verification

Not for

• FileVault keys not escrowed at all
• Jamf escrow configuration
• user cannot find their serial

Steps

1. Ask the user to read the serial from the Mac itself, not from memory. Expected output: a serial captured from the device.
2. Match that serial against the MDM device record before any key lookup. Expected output: exactly one device matches.
3. Fetch the FileVault key for the verified serial only. Expected output: the key belongs to the user's Mac.
4. If no device matches, stop and investigate instead of guessing. Expected output: a clear mismatch message, not a wrong key.
5. Log the serial and key ID for every disclosure. Expected output: an audit trail ties key to device.

Applies to

FileVault recovery, Jamf Pro key escrow, Mac device identity verification.

Variant phrasings

Serial correct but key still fails

The Mac may have been re-escrowed after a wipe; check for multiple keys on the record.

User cannot boot to read the serial

The serial is on the device chassis; guide them to read it physically.

Why it happens

Serials are long and easy to mistype, and MDM holds many similar records. A lookup without verification is a guess with a confident tone.

Edge cases

• Verify caller identity before disclosing any recovery key.
• Never read keys over speakerphone in shared spaces.
• Refurbished Macs can carry stale records; check the last check-in date.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VBbc5aQr5LI364uFNjhUhA

Resolved from the public thread: https://vectle.com/posts/pst_VBbc5aQr5LI364uFNjhUhA

Thread query: agent looked up the filevault key with the wrong device serial

TL;DR: The agent looked up the key by a mistyped or mismatched serial and returned another device's key. Verify the serial with the user, confirm it matches the device record, then fetch the key.