{"id":86729,"date":"2023-06-05T13:09:42","date_gmt":"2023-06-05T17:09:42","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=86729"},"modified":"2023-06-05T13:09:42","modified_gmt":"2023-06-05T17:09:42","slug":"understand-supported-filevault-recovery-and-user-scenarios","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios","title":{"rendered":"Understand Supported FileVault Recovery and User Scenarios"},"content":{"rendered":"\n<p>To decrypt a FileVault encrypted device, either enter a password for a FileVault encrypted user or, if all passwords have been forgotten, a recovery method can be used to access macOS Recovery Mode.&nbsp;<\/p>\n\n\n\n<p>Available recovery methods for&nbsp;<a href=\"https:\/\/support.apple.com\/en-us\/HT204837\" target=\"_blank\" rel=\"noreferrer noopener\">FileVault<\/a>&nbsp;include: <\/p>\n\n\n\n<ul>\n<li>AppleID<\/li>\n\n\n\n<li>Personal Recovery Keys<\/li>\n\n\n\n<li>Institutional Recovery Keys<\/li>\n<\/ul>\n\n\n\n<p>A device can also be encrypted with a combination of these recovery methods. When the JumpCloud FileVault policy is applied, a Personal Recovery Key is escrowed to the JumpCloud console and can be used to decrypt the disk if passwords are lost or forgotten. AppleID and Institutional Recovery Keys can be used as FileVault recovery methods, but you must boot to recovery to use those methods.<\/p>\n\n\n\n<p>If a Personal Recovery Key is set as the only FileVault recovery method, that key can be used to decrypt the disk at the FileVault decryption screen. Should a user forget their password, a prompt will appear after three failed attempts, if the personal recovery key for that system is entered, the system will boot to the login screen.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>JumpCloud recommends using the <strong>Personal Recovery Key<\/strong> recovery method as it offers the most flexible recovery for single or multiple user systems.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p>If an AppleID or Institutional Recovery Key is set as a FileVault recovery method, the system will require booting into macOS Recovery Mode to make use of those recovery methods. The AppleID specifically requires an internet connection in recovery to login to a user&#8217;s AppleID account.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>To prevent unauthorized users from resetting passwords, JumpCloud user account passwords can not be reset via macOS Recovery Mode. Any non-JumpCloud user account password can be reset however. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p>There are several scenarios where it would be inadvisable to use AppleID or Institutional Recovery Keys as FileVault Recovery Methods.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Inadvisable FileVault Recovery Methods \/ JumpCloud User Scenarios<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Apple ID Recovery with a Single User<\/strong><\/h3>\n\n\n\n<p><strong>FileVault Recovery Method<\/strong>: AppleID<\/p>\n\n\n\n<p><strong>System Configuration<\/strong>: One JumpCloud User Bound to system<\/p>\n\n\n\n<p>If a single JumpCloud user is bound to a FileVault encrypted system with an AppleID recovery method, that user could get locked out of their system indefinitely if they were to forget their password. At this time, JumpCloud accounts can not have their passwords reset in recovery mode to prevent unauthorized access.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Institutional Recovery Key + Personal Recovery Key with a Single User<\/h3>\n\n\n\n<p><strong>FileVault Recovery Method<\/strong>: Institutional Recovery Key + Personal Recovery Key<\/p>\n\n\n\n<p><strong>System Configuration<\/strong>: One JumpCloud User Bound to system<\/p>\n\n\n\n<p>If the Institutional Recovery Key + Personal Recovery Key combination is used when encrypting a Mac system with a T2 chip, and if the password for the single user is forgotten, the system must boot to recovery to make use of the Institutional Recovery Method.&nbsp;<\/p>\n\n\n\n<p>If a single JumpCloud user is bound to a FileVault encrypted system with the Institutional Recovery Key + Personal Recovery Key recovery method, that user could get locked out of their system indefinitely if they were to forget their password. At this time, JumpCloud accounts can not have their passwords reset in Recovery Mode to prevent unauthorized access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Supported FileVault Recovery Method \/ Single JumpCloud User Scenarios<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Personal Recovery Key with Single User<\/h3>\n\n\n\n<p><strong>FileVault Recovery Method<\/strong>: Personal Recovery Key<\/p>\n\n\n\n<p><strong>System Configuration<\/strong>: One JumpCloud User Bound to system<\/p>\n\n\n\n<p>A single JumpCloud user is bound to a FileVault encrypted system with a Personal Recovery Key recovery method. If that user is locked out of their system by forgetting their password, they could bypass the FileVault screen with the Personal Recovery Key. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the JumpCloud agent can change the user\u2019s password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Supported FileVault Recovery Methods \/ Multiple User Scenarios&nbsp;<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Institutional Recovery Key + Personal Recovery Key with Multiple User<\/h3>\n\n\n\n<p><strong>FileVault Recovery Method<\/strong>: Institutional Recovery Key + Personal Recovery Key<\/p>\n\n\n\n<p><strong>System Configuration<\/strong>: One JumpCloud user, one local administrator.<\/p>\n\n\n\n<p>A system is FileFault encrypted with an Institutional and Personal Recovery Key. If that user is locked out of their system by forgetting their password, they could either be provided the local administrator account password to bypass FileVault or enter Recovery Mode using the Personal Recovery Key. In Recovery Mode, the FileVault enabled local administrator account\u2019s password can be reset to enter the login screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the JumpCloud Agent can change the JumpCloud user\u2019s password.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">AppleID + Personal Recovery Key with Multiple User<\/h3>\n\n\n\n<p><strong>FileVault Recovery Method<\/strong>: Institutional Recovery Key + Personal Recovery Key<\/p>\n\n\n\n<p><strong>System Configuration<\/strong>: One JumpCloud user, one local administrator.<\/p>\n\n\n\n<p>A system is FileFault encrypted with an AppleID and Personal Recovery Key recovery method. If that user is locked out of their system by forgetting their password, they could either be provided the local administrator account\u2019s password to bypass FileVault or enter Recovery Mode with the AppleID credentials and then reset the password of the local administrator account to get to the login screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the JumpCloud Agent can change the JumpCloud user\u2019s password.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Personal Recovery Key with Multiple Users<\/h3>\n\n\n\n<p><strong>FileVault Recovery Method<\/strong>: Personal Recovery Key<\/p>\n\n\n\n<p><strong>System Configuration<\/strong>: One JumpCloud User bound to system<\/p>\n\n\n\n<p>A set of JumpCloud users are bound to a FileVault encrypted system with a Personal Recovery Key. If any user is locked out of their system by forgetting their password, they can bypass the FileVault screen using the Personal Recovery Key. Alternatively, a different user\u2019s password can be used to bypass the FileVault screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the JumpCloud agent can change a user\u2019s password.<\/p>\n\n\n\n<p>If a non-JumpCloud user account was provisioned on this system, that account\u2019s password could be reset in Recovery Mode. That user\u2019s password could be used to bypass FileVault and gain access to the login screen. Once at the login screen and when connected to a network (either a known wifi network or with an ethernet connection) the JumpCloud Agent can change the user\u2019s password. Alternatively, if no known network is available at the login screen, that newly reset user account can be used to access the OS and connect to a network.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>To decrypt a FileVault encrypted device, either enter a password for a FileVault encrypted user or, if all passwords have [&hellip;]<\/p>\n","protected":false},"author":218,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2925,2852],"support_tag":[],"coauthors":[3011],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Understand Supported FileVault Recovery and User Scenarios - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn about Apple FileVault on macOS devices, and understand supported and unsupported recovery scenarios using JumpCloud.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Understand Supported FileVault Recovery and User Scenarios\" \/>\n<meta property=\"og:description\" content=\"Learn about Apple FileVault on macOS devices, and understand supported and unsupported recovery scenarios using JumpCloud.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"890\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"nickconrad\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios\",\"url\":\"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios\",\"name\":\"Understand Supported FileVault Recovery and User Scenarios - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"datePublished\":\"2023-06-05T17:09:42+00:00\",\"dateModified\":\"2023-06-05T17:09:42+00:00\",\"description\":\"Learn about Apple FileVault on macOS devices, and understand supported and unsupported recovery scenarios using JumpCloud.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Understand Supported FileVault Recovery and User Scenarios\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Understand Supported FileVault Recovery and User Scenarios - JumpCloud","description":"Learn about Apple FileVault on macOS devices, and understand supported and unsupported recovery scenarios using JumpCloud.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios","og_locale":"en_US","og_type":"article","og_title":"Understand Supported FileVault Recovery and User Scenarios","og_description":"Learn about Apple FileVault on macOS devices, and understand supported and unsupported recovery scenarios using JumpCloud.","og_url":"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios","og_site_name":"JumpCloud","og_image":[{"width":890,"height":525,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 minutes","Written by":"nickconrad"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios","url":"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios","name":"Understand Supported FileVault Recovery and User Scenarios - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"datePublished":"2023-06-05T17:09:42+00:00","dateModified":"2023-06-05T17:09:42+00:00","description":"Learn about Apple FileVault on macOS devices, and understand supported and unsupported recovery scenarios using JumpCloud.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/understand-supported-filevault-recovery-and-user-scenarios#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Understand Supported FileVault Recovery and User Scenarios"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/86729"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/218"}],"version-history":[{"count":3,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/86729\/revisions"}],"predecessor-version":[{"id":88566,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/86729\/revisions\/88566"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=86729"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=86729"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=86729"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=86729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}