Generating and Escrowing a New Personal Recovery Key Using Terminal

Jamf Pro Documentation 11.30.0
Solution
Application
Content Type
Technical Documentation
Utilities & Services
version
11.30.0
ft:locale
en-US
vrm_version
11.30.0
You will need to generate a new personal recovery key (PRK) under the following circumstances:

  • FileVault is enabled and a valid key is not escrowed.

  • You are switching from an institutional recovery key to a PRK.

  • FileVault was enabled on the computer prior to being managed with Jamf Pro.

If Jamf Pro has a valid recovery key and you want to generate and escrow a new key without user interaction, see Issuing a New FileVault Recovery Key Using Jamf Pro.

You can generate a new PRK automatically or manually.

To automatically generate a new PRK, you can use a third-party script like Escrow Buddy. For more information, see the following resources:

To manually generate a new PRK using Jamf Pro, follow the procedure below.

Note:

Turning FileVault off and on is not required to generate a new PRK. However, a local computer user with a secure token will need to provide their password when generating the new key.

Requirements

  • A configuration profile must already have been deployed to the computer to escrow the PRK to Jamf Pro or another escrow server.

  • The computer must have a local user account with a secure token.

  1. Execute the following fdesetup command in Terminal:
    sudo /usr/bin/fdesetup changerecovery -personal
  2. Enter the username and password of the user with the secure token. The new PRK will be generated and displayed to the end user.
  3. Execute the following command to trigger an immediate Jamf Pro inventory update:
    sudo /usr/local/bin/jamf recon

The new PRK will be escrowed in Jamf Pro or another escrow server.