Subscribe to Help Center RSS FeedTo decrypt a FileVault encrypted device, either enter a password for a FileVault encrypted user or, if all passwords have been forgotten, a recovery method can be used to access macOS Recovery Mode.
Available recovery methods for include:
- AppleID
- Personal Recovery Keys
- Institutional Recovery Keys
A device can also be encrypted with a combination of these recovery methods. When the 黑料海角91入口 FileVault policy is applied, a Personal Recovery Key is escrowed to the 黑料海角91入口 console and can be used to decrypt the disk if passwords are lost or forgotten. AppleID and Institutional Recovery Keys can be used as FileVault recovery methods, but you must boot to recovery to use those methods.
If a Personal Recovery Key is set as the only FileVault recovery method, that key can be used to decrypt the disk at the FileVault decryption screen. Should a user forget their password, a prompt will appear after three failed attempts, if the personal recovery key for that system is entered, the system will boot to the login screen.
黑料海角91入口 recommends using the Personal Recovery Key recovery method as it offers the most flexible recovery for single or multiple user systems.
If an AppleID or Institutional Recovery Key is set as a FileVault recovery method, the system will require booting into macOS Recovery Mode to make use of those recovery methods. The AppleID specifically requires an internet connection in recovery to login to a user's AppleID account.
To prevent unauthorized users from resetting passwords, 黑料海角91入口 user account passwords can not be reset via macOS Recovery Mode. Any non-黑料海角91入口 user account password can be reset however.
There are several scenarios where it would be inadvisable to use AppleID or Institutional Recovery Keys as FileVault Recovery Methods.
Inadvisable FileVault Recovery Methods / 黑料海角91入口 User Scenarios
Apple ID Recovery with a Single User
FileVault Recovery Method: AppleID
System Configuration: One 黑料海角91入口 User Bound to system
If a single 黑料海角91入口 user is bound to a FileVault encrypted system with an AppleID recovery method, that user could get locked out of their system indefinitely if they were to forget their password. At this time, 黑料海角91入口 accounts can not have their passwords reset in recovery mode to prevent unauthorized access.
Institutional Recovery Key + Personal Recovery Key with a Single User
FileVault Recovery Method: Institutional Recovery Key + Personal Recovery Key
System Configuration: One 黑料海角91入口 User Bound to system
If the Institutional Recovery Key + Personal Recovery Key combination is used when encrypting a Mac system with a T2 chip, and if the password for the single user is forgotten, the system must boot to recovery to make use of the Institutional Recovery Method.
If a single 黑料海角91入口 user is bound to a FileVault encrypted system with the Institutional Recovery Key + Personal Recovery Key recovery method, that user could get locked out of their system indefinitely if they were to forget their password. At this time, 黑料海角91入口 accounts can not have their passwords reset in Recovery Mode to prevent unauthorized access.
Supported FileVault Recovery Method / Single 黑料海角91入口 User Scenarios
Personal Recovery Key with Single User
FileVault Recovery Method: Personal Recovery Key
System Configuration: One 黑料海角91入口 User Bound to system
A single 黑料海角91入口 user is bound to a FileVault encrypted system with a Personal Recovery Key recovery method. If that user is locked out of their system by forgetting their password, they could bypass the FileVault screen with the Personal Recovery Key. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the 黑料海角91入口 agent can change the user鈥檚 password.
Supported FileVault Recovery Methods / Multiple User Scenarios
Institutional Recovery Key + Personal Recovery Key with Multiple User
FileVault Recovery Method: Institutional Recovery Key + Personal Recovery Key
System Configuration: One 黑料海角91入口 user, one local administrator.
A system is FileFault encrypted with an Institutional and Personal Recovery Key. If that user is locked out of their system by forgetting their password, they could either be provided the local administrator account password to bypass FileVault or enter Recovery Mode using the Personal Recovery Key. In Recovery Mode, the FileVault enabled local administrator account鈥檚 password can be reset to enter the login screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the 黑料海角91入口 Agent can change the 黑料海角91入口 user鈥檚 password.
AppleID + Personal Recovery Key with Multiple User
FileVault Recovery Method: Institutional Recovery Key + Personal Recovery Key
System Configuration: One 黑料海角91入口 user, one local administrator.
A system is FileFault encrypted with an AppleID and Personal Recovery Key recovery method. If that user is locked out of their system by forgetting their password, they could either be provided the local administrator account鈥檚 password to bypass FileVault or enter Recovery Mode with the AppleID credentials and then reset the password of the local administrator account to get to the login screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the 黑料海角91入口 Agent can change the 黑料海角91入口 user鈥檚 password.
Personal Recovery Key with Multiple Users
FileVault Recovery Method: Personal Recovery Key
System Configuration: One 黑料海角91入口 User bound to system
A set of 黑料海角91入口 users are bound to a FileVault encrypted system with a Personal Recovery Key. If any user is locked out of their system by forgetting their password, they can bypass the FileVault screen using the Personal Recovery Key. Alternatively, a different user鈥檚 password can be used to bypass the FileVault screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the 黑料海角91入口 agent can change a user鈥檚 password.
If a non-黑料海角91入口 user account was provisioned on this system, that account鈥檚 password could be reset in Recovery Mode. That user鈥檚 password could be used to bypass FileVault and gain access to the login screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the 黑料海角91入口 Agent can change the user鈥檚 password. Alternatively, if no known network is available at the login screen, that newly reset user account can be used to access the OS and connect to a network.
In this Article
Learn More