I am looking for a solutions to get the recovery key in my JAMF console for those mac devices recovery key is missing, but user should be interrupted. I can see it has happened for both personal and institutional key. What is the main concept of personal recovery key validation, some time it is showing invalid or unknown but recovery key is there, strange! Please help to understand and also with a perfect resolution I am looking for. BTW device is getting encrypted by a config profile and to escrow the key in JAMF.
We're also seeing some machines that have had new FV recovery keys (PRK) issued followed by a recon, which does update it in Jamf. Fast forward a week or so and those same machines are back on the list of "unknown" with some of them not having the key available once again while others just have the status of "unknown".
Still nothing that I've seen or heard of yet. Seems like there is definitely something up but perhaps we'll see some of a resolve as we begin upgrading to Ventura.
Not sure if anyone else has seen the same issue on any Ventura machines yet?
Some say a reboot makes Valid stick. Run the PRK Re-issue policy again, user enter password, but this time the Mac reboots. So a reboot somehow makes "Vaild" stick...This seems to be working on some of the Macs / users that I have worked with...
I was told by support that this is "expected behavior because the process that Apple uses to grab that key can be inconsistent." And Jamf support said that I should run a recon after the reissue key policy runs. I already have a recon as part of that policy, but was told that isn't enough.
So sadly this is still happening and I have not yet found a real solution or explanation.
Hi all! I'm the maintainer of the jss-filevault-reissue workflow referenced above, and I've got a quick update that may be of interest to you.
My team has published a new tool called Escrow Buddy, which regenerates FileVault keys at the loginwindow, thus avoiding the need to prompt users for their password later. It should be suitable as a drop-in replacement for my previous jss-filevault-reissue workflow at most organizations.
You can read more in this announcement on the Netflix Tech Blog, and this post on my site specifically covers migrating from my old workflow to Escrow Buddy. Escrow Buddy's source code and installer are available on GitHub.