Get the recovery key for a locked disk

Before you start

• This is an IT task. It assumes you look after your company’s computers. If that is not you, do this together with the person who does.
• The permission for irreversible device actions (“manage_device_destructive”; search for that name in AdministrationAccess Control). It is separate from managing devices. On a new instance only administrators have that permission. Without it you see a “Recovery key escrowed” label instead of a button.
• Zonitix already holds the computer’s recovery key. A BitLocker key is sent by the Windows agent. A FileVault key is not sent by the Mac agent: it arrives through Apple MDM, for a Mac enrolled in it. A key is held only for a computer whose disk is encrypted with FileVault or BitLocker and whose key has arrived.
• A reason you are willing to have on the record. Every reveal is written to the audit log with your name and the reason.

Reveal the key

1. 1

   Step 1: Open the computer

   Go to DevicesInventory, find the computer and click the “View details” icon on its row. Finding a machine is covered in Manage a device day to day.

2. 2

   Step 2: Find the key button

   On the “Overview” tab, look at the “Capacity” panel. When a key is held, a button reads “Reveal FileVault key” or “Reveal BitLocker key”. Click it.

3. 3

   Step 3: Give your reason

   A window titled “Reveal FileVault recovery key” (or BitLocker) names the computer and reminds you the reveal is logged. Under “Why do you need this key?”, type a reason of at least 3 characters in “Reason” and click “Reveal key”.

   Zonitix may ask you to prove it is you again first. This is called step-up.

4. 4

   Step 4: Use the key before it hides

   The key is shown in a small window with a countdown: “Hides in 45s”. Read it out to the person at the computer, or type it in yourself, then click “Done”.

   When the countdown ends the key is hidden again. To see it once more, repeat steps 2 and 3. Each time is logged separately.

Replace a FileVault key that someone has seen (Macs only)

1. 5

   Step 5: Know what happens by itself

   A key that has been read out is no longer a secret. If the reveal window said “After you view this key, a new one is created at the Mac’s next login.”, nothing more is needed: the Mac makes a new key the next time a FileVault user logs in with their password, and sends it to Zonitix.

   That behaviour is the switch “Rotate a recovery key after it’s revealed” on the “FileVault recovery-key rotation” card in DevicesSettings. The same card can replace every key on a schedule, with “Rotate recovery keys every”. Click “Save rotation” after a change.

2. 6

   Step 6: Or ask for a new key yourself

   In the same “Capacity” panel, the “FileVault recovery key” line shows the key’s state, for example “Escrowed” with a date. Click “Rotate at next login”, type a reason under “Why rotate this key?” and confirm.

   The line then reads “New key at next login”. The current key keeps working until the Mac has made the new one.

What you should see

If something goes wrong

There is no Reveal button, only "Recovery key escrowed"

A key is held but your role lacks the permission for irreversible device actions. Ask an administrator to reveal it, or to add that permission to your role.

There is no button and no label at all

Zonitix holds no key for this computer. On a Mac, the FileVault recovery key line says why: "FileVault off", or "Not escrowed — deploy a FileVault profile". Without a held key, the disk can only be unlocked with a key the person or your company kept somewhere else.

The window shows an error instead of a key

The message says why, or reads "Not permitted or unavailable." Check your permission and try again. The failed attempt is not a reveal.

The FileVault line says "Waiting for a password login by a FileVault user."

The new key is made only when someone who can unlock FileVault logs in by typing their password. A Touch ID or smart-card login does not count. Ask the person to log out and log in with their password.

The line says "Can’t re-key: update the agent" or "Can’t re-key: deploy a FileVault profile to this Mac first"

Do what it says: update the Zonitix agent on that Mac, or push a profile that turns on FileVault to it. Then ask for the new key again.

The line says "Last attempt failed"

The rest of the line gives the cause. Zonitix tries again at a login after 24 hours while the request is open.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Manage a device day to day
• Push a compliance profile
• Enroll a Mac in Apple MDM
• See who did what (the audit log)