I have a macOS 10.13.4 device that is encrypting with Filevault2 right now. It needs to be taken by a user for travel at the end of the day.

I had meant to set an institutional recovery key for this device. The master keychain is already generated and in use on other devices. I've just read instructions for deploying the master keychain which indicate that I should have done this before I enabled Filevault2.

Does Filevault2 need to be disabled (decrypting the disk), then the master keychain deployed, then Filevault2 re-enabled (encrypting the disk)? This would take more time than is available to me, but I understand if that's the only option for deploying it.

Thank you.


You will need to use fdesetup. If you have created FileVaultMaster.keychain with the institutional key and placed it in /Library/Keychains then fdesetup changerecovery -institutional -keychain will add an institutional key.

I recommend a close reading of the fdesetup man page.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.