Hey @MacJunior how are you?

I my case, I have a policy with the option Disk Encryption -> Issue New Recovery Key:

The policy is being applied to a smart group with the following conditions:

- Filevault 2 enabled
- disk encrypted
- FileVault 2 Individual Key Validation is Invalid

(The conditions are connected with and)

Hi there,

could you share with me the criteria you have setup for hardware key rotation? I just want to make sure it's the right one.