Skip to main content
This guide applies to Mac computers

​
About FileVault & Recovery Keys

FileVault is a built-in feature of macOS that encrypts the boot drive. During setup, FileVault generates a Recovery Key, allowing an additional method of access to the drive should all FileVault enabled users’ passwords be forgotten.
  • Learn more about how FileVault secures your Mac computers and changes login behavior
  • Learn how to use the FileVault Recovery Key to reset a user’s password
  • Learn about the User Experience with FileVault

​
About the FileVault Library Item

The FileVault 2 Library Item enforces FileVault disk encryption on enrolled Mac computers. Mac computers are prompted to complete FileVault setup after they restart. To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.

​
FileVault Configuration Options

Configure FileVault using the steps below. Enforcement and user experience are part of the same flow as the Library Item settings.
1

FileVault enforcement

Use the FileVault enforcement drop-down to choose:
  • Enforce immediately upon next login (Recommended): FileVault is required at the next login. The Enforce during Setup Assistant for Automated Device Enrollment option appears when this is selected.
  • Allow user deferral before enforcing (Not Recommended): The Prompt for restart if FileVault is not enabled option is hidden; a User Deferral drop-down appears instead so you can select how many login attempts are allowed before FileVault is enabled.
2

Enforce during Setup Assistant for Automated Device Enrollment (macOS 14+)

Recommended: Check this option to attempt to enforce FileVault during Setup Assistant for devices that enroll using Automated Device Enrollment.This selection ignores a FileVault skip screen setting in the Automated Device Enrollment Library item. See Enforcement and user experience during Setup Assistant for the full end-user flow and screenshots.
3

Prompt for restart if FileVault is not enabled

Check this option to configure forcibly restarting the Mac or reminding the end user to restart to enforce FileVault encryption. When enabled, set Prompt type (e.g., Force a restart after, or Remind to restart every…) and Force after (e.g., 30 minutes) as needed.
FileVault enforcement settings
4

Show user the FileVault recovery key when it is generated

By default, the FileVault recovery key is shown to the end user when the recovery key is created or regenerated. A common security practice is to not show the recovery key to the end user and allow team members to view the escrowed recovery key in Iru Endpoint.
5

Escrow recovery keys to Iru Endpoint

This option sends the recovery key to Iru Endpoint where it can be viewed by team members. If FileVault is currently enabled, this option will cause the Iru Endpoint agent to prompt the user for authentication before regenerating the recovery key.
6

Automatically rotate keys

Check this option to automatically rotate the recovery key on a regular schedule. When enabled, set Rotate keys after (days) to the period you want (for example, 90 days). This schedule continues on its own when Automatically rotate keys after viewing is also enabled. Iru Endpoint uses the RotateFileVaultKey MDM command to rotate the key.
7

Automatically rotate keys after viewing

Check Automatically rotate keys after viewing to rotate a recovery key after it is displayed. Set Rotate keys after viewing (hours) to how soon that rotation happens. Displaying the key in the device record, or retrieving it with the Enterprise API, starts this timer. Iru Endpoint rotates the key with the RotateFileVaultKey MDM command.
FileVault recovery keys settings including scheduled rotation and rotation after viewing

​
Enforcement and user experience during Setup Assistant

When you enable Enforce during Setup Assistant for Automated Device Enrollment (macOS 14+), Iru Endpoint attempts to enforce FileVault during Setup Assistant for devices that enroll using Automated Device Enrollment. This selection ignores a FileVault skip screen setting in the Automated Device Enrollment Library item. The end user first sees a FileVault Disk Encryption dialog: the organization has enabled FileVault for the Mac, and the user can turn on FileVault disk encryption and select Continue to encrypt the disk (no restart required). A Skip option may appear depending on configuration.
FileVault Disk Encryption dialog during Setup Assistant
The next screen displays the FileVault Recovery Key in a clear, prominent format and instructs the user to write it down and keep it in a safe place so they do not lose access to their data.
FileVault Recovery Key during Setup Assistant

​
View FileVault Recovery Keys

The FileVault Recovery Key dialog hides the key until you display it, and Iru logs who viewed the key and when. What happens after a view depends on Automatically rotate keys after viewing in FileVault Configuration Options:
  • On: Displaying the key starts Rotate keys after viewing (hours). When that time passes, Iru Endpoint rotates the key on the Mac with the RotateFileVaultKey MDM command.
  • Off: The key does not rotate after it is viewed. If Automatically rotate keys is on, the key still rotates on that schedule.
Retrieving the key with the Enterprise API (GET /api/v1/devices/{device_id}/secrets/filevaultkey) counts as a view and follows the same setting.

​
Open the FileVault Recovery Key dialog

1

Navigate to Device Record

Navigate to the Device Record.
2

Access Device Action Menu

Open the Device Action Menu (ellipsis) in the upper right of the device record.
3

View Recovery Key

Select View FileVault2 recovery key.
Device Action Menu with View FileVault2 recovery key option

​
When rotation after viewing is on

1

Display the recovery key

The key is hidden. The dialog states that after the key is displayed, it rotates on the Mac after the hours you set in Rotate keys after viewing (hours). Select the eye icon to display the key and start that timer.
FileVault Recovery Key dialog with the key hidden and a note that the key rotates after viewing
2

Copy or hide the key

Select the copy icon to copy the key, or select the eye icon with a line through it to hide it. Select Done when you are finished.
FileVault Recovery Key dialog with the key displayed and a note that the key rotates after viewing

​
When rotation after viewing is off

1

Continue past the rotation notice

Iru states that the FileVault Library Item is not configured to rotate the key after viewing, and that viewing the key is still logged. Select Okay to continue.
FileVault Recovery Key notice that the key does not rotate after viewing
2

Display the recovery key

The key is hidden. Select the eye icon to display it.
FileVault Recovery Key dialog with the key hidden and a note that the view is logged
3

Copy or hide the key

Select the copy icon to copy the key, or select the eye icon with a line through it to hide it. Select Done when you are finished.
FileVault Recovery Key dialog with the key displayed and a note that the view is logged

​
Generate a New FileVault Recovery Key

You can force a Mac to generate a new FileVault recovery key by running the following command in Terminal. Iru Endpoint then captures the new key if the escrow option is enabled.
Terminal

​
Parameter: Report user accounts with FileVault Recovery Keys escrowed to iCloud

macOS allows users to store recovery keys with their Apple Account through iCloud. This is not recommended for enterprise-owned Mac computers because an unknown party may be able to retrieve the keys. Use this parameter to receive an alert when a recovery key is stored in iCloud. The alert reminds you to work with the user to remove the recovery key from their account.
Report user accounts with FileVault Recovery Keys escrowed to iCloud

​
Encryption Status

With APFS volumes, only the Data volumes will show as Encrypted: Yes in the Volumes section of the Device Details. This is expected behavior.
Device Details Volumes showing APFS Data volume Encrypted Yes
The startup disk is always encrypted on Mac computers with the Apple T2 Security Chip or Apple silicon, so FileVault encryption is nearly immediate. On other Mac computers, FileVault encryption can take longer depending on the amount of data, but it continues in the background.

​
User Experience with FileVault

If you have enabled the Escrow recovery keys to Iru Endpoint setting in your FileVault Library Item, any Mac that enrolls into Iru Endpoint that previously had FileVault enabled will automatically prompt your end users to regenerate their FileVault Key so it can be escrowed. When FileVault is set to Automatically rotate keys, and the Passcode Profile has the Maximum Passcode Age option enabled, a password older than the maximum age will be expired, and the user will need to create a new password before they can rotate and escrow their FileVault Recovery key. Please visit the User Experience with FileVault article for more information.

Reset a macOS User Password

Reset a local macOS user password remotely from the Iru Endpoint web app. Generate a temporary password and require a change at next login.

FileVault User Experience

See what users experience when FileVault is enabled on their Mac. Understand the encryption prompt, recovery key escrow, and restart behavior during setup.

Library Overview

Overview of the Iru Endpoint Library for managing apps, profiles, scripts, and configurations. Curate Library Items and assign them to device Blueprints.

Configuring Apple Enrollment

Configure Apple enrollment in Iru Endpoint: ADE, manual enrollment, enrollment codes, Setup Assistant, MDM profiles, and Blueprints.