FileVault from previous MDM handover to Jamf?

[vantive]

So I have machine that I am migrating from Workspace One to Jamf Pro. Is there a way to leave FileVault enabled after unenrolling from Workspace One - and then having Jamf Pro issue a new recovery key? 

Hoping to do this with zero touch.

I am researching how to turn off file vault via Workspace One at the same time.

[TheAngryYeti]

Don't unencrypt the device prior as it causes more of a hassle - just take down the key if something doesn't go right with the process.  Next, enroll the Mac into Jamf, scope a configuration profile for escrow of the FileVault key and then run this script: https://github.com/homebysix/jss-filevault-reissue it will reissue the key and redirect it to Jamf for storage. 

[vantive]

New to Jamf - so Jamf can escrow the keys from a device that is already encrypted? Well that makes thing a bit simpler. 
Looks like homebysix script has not been updated since Catalina. Anyone know if any issues with Monterey?

[Louie]

This is the most recent https://github.com/homebysix/jss-filevault-reissue/blob/main/reissue_filevault_recovery_key.sh

Works great with Monterey, they all leverage the same native functionality in the CLI from fdesetup changerecovery

[TheAngryYeti]

Thanks for linking directly @Louie  - it does work very well on Monterey.  When we run into this situation due to migrations etc....this is one that is highly recommended. 

[elliotjordan]

Hi all! I'm the maintainer of the jss-filevault-reissue workflow referenced above, and I've got a quick update that may be of interest to you.

My team has published a new tool called Escrow Buddy, which regenerates FileVault keys at the loginwindow, thus avoiding the need to prompt users for their password later. It should be suitable as a drop-in replacement for my previous jss-filevault-reissue workflow at most organizations.

You can read more in this announcement on the Netflix Tech Blog, and this post on my site specifically covers migrating from my old workflow to Escrow Buddy. Escrow Buddy's source code and installer are available on GitHub.

Thanks!