I want to enable FileVault encryption but in the dialog I encounter this message:

A recovery key has been set by your company, school, or institution.

I don't have my laptop set up by a company, school or institution because this is my private laptop.

This dialog may be related to some profile-files I have recently installed for university in order to get the VPN to work. How can I reset this so that I can use my own recovery key?

I am using macOS 10.13.

4 Answers 4


This Apple discussion says:

After a couple of exchanges with our engineering team they have recommended two things you may try.

The first solution is as follows:

  • Disable FileVault
  • In the system directory, go to /Library/Keychains
  • Move the files FileVaultMaster.keychain and FileVaultMaster.cer to the Trash. Deleting the files should then allow you to enable FileVault on the system and provide a recovery key. Refer to article http://support.apple.com/kb/HT5077 if you have questions regarding the location of the files.

Second solution:

Performing an erase and reinstall of the computer system will reset the master password and allow you to encrypt the drive again.


The message disappeared after moving the files /Library/Keychains/FileVaultMaster.cer and /Library/Keychains/FileVaultMaster.keychain to a different directory.

  • Can I just delete them though? Commented Apr 26, 2021 at 19:18
  • I only moved them so that I could restore them if needed. I would not delete master keys. Commented Apr 27, 2021 at 9:19
  • Ok. I did actually delete them and then I regenerated the key, and wrote it down, so I actually now KNOW the keys. I'm pretty sure this is the right way to use them, but, I'm not 100 percent sure, admittedly. Commented Apr 27, 2021 at 18:02
  1. Open Terminal application
  2. Enter and press return:

    sudo fdesetup removerecovery -institutional
  3. Enter the administrator password

  4. Enter and press return:

    sudo fdesetup changerecovery -personal
  5. Enter the administrator password

  6. A recovery key is generated.

This message appears when enabling FileVault after transferring a disk image of a FileVault-encrypted machine to a new machine.

In this case, accepting the message seems to preserve the old machine's recovery key.

  • 1
    I did not do that. I had the volume encrypted some while ago, but disabled it after having problems with the login screen. Commented Jan 15, 2018 at 16:52
  • Ah, so possibly the key was still there from that encryption pass. Commented Jan 23, 2018 at 0:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .