Migrating to new JSS instance - FileVault 2 keys

If you migrate the mySQL database as well, the individual keys will come with it.

Unfortunately, we're trying to avoid doing that. We're trying to start from a clean install and import things that we need from the old server. The clients will all enrol to the new instance via a policy from the old server.

I know that 9.92 introduced an option to generate a new FileVault key, which will work for some clients - but not all. My questions I guess is asking more if there is a way to export the FileVault keys and the machine associations.

No, there's no way to export FV2 Recovery keys, either in a static list/csv form or in a database format that you can import back into the JSS. If you're starting over with a new database, you're going to need to re-issue all your Recovery keys because it won't be possible to migrate them into the new one, without doing a wholesale db migration.

I had a feeling it wouldn't be and the security reasoning makes sense. I'll snapshot the VM and then import the DB to test against. Although we don't have a huge number of clients - our users, like many others, are very difficult to get their Macs back for something as simple as generating a new key.

@dgreening, I thought of that too but like our Windows clients, we don't allow the management user in FileVault 2 for security reasons. We can't have a local account (where the password doesn't change often) to have access to unlock a drive that leaves the building.

Thanks all

We can't have a local account (where the password doesn't change often) to have access to unlock a drive that leaves the building.

Same reason we don't enable the management account for FV2, and since Apple doesn't allow accounts enabled for FV2 to be hidden on the login screen…

What are you trying to avoid by NOT migrating the DB? There are plenty of tables that could be purged while maintaining computer records and associated keys if you want to reduce bloat.

We've seen odd behaviour from the old server and the DB - a few tickets have been raised in the last 6months with JAMF support. Performance recently dropped right down and we found the Tomcat instance was running but not accessible - full server reboots fixed this.

I had suggested to my manager that maybe we could start a fresh and migrate clients over slowly. I've now migrated the old DB into the new server and will just go through it thoroughly and purge all the guff we don't want or need.

If you're not running MySQL 5.6 I highly recommend upgrading to it. We were having sever performance issues until we upgraded. Aside from the JSS being optimized for it it is a very noticeable upgrade from 5.5 and lower

Here is a guide for how to proceed. We purposely migrated our database due to a forced URL changed, and this worked for 15,000 Macs:

MacBrained Reissuing FileVault Keys

Your TAM may directly provide you with this link and its associated script as well.

Here's another vote for the MacBrained solutions suggested by @bmarks .

We used it to transition machines from being manually encrypted to escrowed in our JSS.

@bmarks, thanks so much. We have a similar but much more basic version of that process that we used to originally enrol encrypted Macs to the original Casper instance. This looks much cleaner and nicer from a user point of view. I'll give this a go too - we're still a few weeks away from migrating the new server to production.

Thank you again all for your suggestions.