Jamf Pro showing disk not encrypted but showing recovery key

[jonna1006]

I am using the Jamf Pro native vault configuration to escrow recovery key to Jamf Cloud after enabling vault. But recently some of machines I am managing showing not encrypted but I did receive the recovery key, while 1 MacBook Pro (M1) will not show "encrypted" and "recovery key" no matter what I tried. Can you anyone help?

[junjishimazaki]

On the mac, have you tried sudo jamf recon? If that doesn't work, you can try creating another recovery key and reconing it back to Jamf.

On the mac in terminal: sudo fdesetup changerecovery -personal

This will prompt for a user that has a secure token and the password. Then it will generate a new key. once it does, run sudo jamf recon.

[BWonderchild]

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[jonna1006]

Is there anyway to push script to achieve this? I currently have 3 MacBook Pro that will not show as "encrypted" and escrow recovery key to Jamf.

[BWonderchild · Accepted solution]

You sure can, yes. Jamf has a great page that details it: https://docs.jamf.com/10.27.0/jamf-pro/administrator-guide/Scripts.html . Regarding the actual script, could be as simple as:

#!/bin/sh

# Change the recovery key
sudo fdesetup changerecovery -personal

# Force device to check into Jamf
sudo jamf recon

exit 0

[jonna1006]

I confirm that above script working like magic, thank you so much for your help!!

[Matt_Roy93]

I am experiencing a similar issue in our environment, it seems the profile to encrypt the drive may have ran and cached a key in the past but when the device was re-enrolled, re-imaged, etc. it did not apply the actual encryption.  I would try deleting the device and re enrolling this if possible to remediate.

[Matt_Roy93]

If you push an additional profile for FV2 it will fail over and over because a key is present already.