macOS FileVault recovery key not showing in Hexnode after user forgot passwordSolved

Hi @wilma,

A missing FileVault recovery key in Hexnode usually means the key was never escrowed to the portal before the device reached the lockout state. You can verify if a key is available by navigating to Manage > Devices > select the Mac > Device Info > Security Info.

If the FileVault recovery key field is empty, the common causes are:

1. FileVault was enabled before Hexnode enrollment: If FileVault was turned on during macOS Setup Assistant or manually before the device was enrolled, Apple does not allow Hexnode to retrieve that pre-existing personal recovery key. Hexnode can report that FileVault is enabled, but it cannot pull the old key from macOS.
2. The FileVault policy did not fully sync before lockout: If the policy was assigned but the Mac did not complete the escrow process before the user got locked out, the recovery key would not have been uploaded.

To answer your questions regarding recovery:

• Pre-boot Syncing: Network connectivity at the FileVault pre-boot screen does not mean the device can complete MDM communication or upload escrow data. The key escrow has to happen while macOS is fully running. (Note: The bootstrap token being escrowed also does not guarantee that the personal recovery key was escrowed, as they are separate items used for different workflows).
• Apple Business Manager: No, ABM cannot disable FileVault, bypass the FileVault login screen, or recover a missing personal recovery key.

Because the user does not know the password and there is no saved recovery key, Hexnode cannot unlock or decrypt the Mac remotely. The practical recovery path in this situation is to boot the Mac into Recovery Mode, open Recovery Assistant from the top menu bar, and choose Erase Mac. This wipes the device completely so macOS can be reinstalled.

For future deployments, make sure the FileVault policy is applied after enrollment and confirm that the recovery key appears under the device security information before handing the Mac over to the user. If FileVault was already enabled before enrollment, rotate or reissue the recovery key through a managed FileVault policy where supported, then confirm that the new key is escrowed.

Best regards,
Eden Pierce
Hexnode UEM

Understood. Thank you for the help, that sorted it out.