Skip to main content
Question

Unable to unlock FileVault with fdesetup

  • February 22, 2017
  • 2 replies
  • 37 views
S
Forum|alt.badge.img+3

Hi all,

I discovered today that a few users have got an 'invalid' recovery key with jamf. After logging in via ssh I cannot seem to make any changes using fdesetup with users that are FileVault enabled on the system.
I am constantly getting the following error:

host-117-253-27-217:~ tcc$ sudo fdesetup changerecovery -personal
Enter a password for '/', or the recovery key:
Error: Unable to unlock FileVault.

Using fdesetup list I can confirm that all user accounts are enabled to unlock filevault. Anyone got any ideas how this can be fixed? thanks

    2 replies

    roiegat
    Forum|alt.badge.img+16
    • roiegat
    • Valued Contributor
    • February 22, 2017

    I use diskutil to unlock file vault.

    I use "diskutil cs list" to get the logical drive and then "diskutil cs decryptLV ${lvUUID} -passphrase $password" where lvUUID is the UUID of the logic drive.

    flyboy
    Forum|alt.badge.img+12
    • flyboy
    • Valued Contributor
    • February 22, 2017

    @sam.hummerstone, I ran into this problem a lot back with Mavericks. Typically, but not always, a simple reboot of the client machine was all it took to get things back up an running. When you are prompted for the password or recovery key, are you entering a known FV2 password, or are you trying to use the recovery key? Make sure you are using a password instead of a questionable key.

    Also, as you may or may not know, if you don't have a config profile to redirect the recovery key, issuing a fdesetup changerecovery will not update the key in the JSS. @roiegat's suggestion will do a full decrypt, so you'd have to re-encrypt when it finishes. When I had machines doing this I usually wound up doing the following:

    1. Reboot client computer
    2. Use a known FV2 password to add the JSS management account to FV2, if it's not already there
    3. Use a JSS policy to re-issue the individual key
    4. Verify new key is accurate: sudo fdesetup validaterecovery
    5. Remove the management account from FV2

    If all that failed, I was forced to decrypt the volume using an institutional key and then re-encrypt.

    Terms & ConditionsCookie settingsAccessibility statement