
What do you mean recording it here? When a user changes their password by loading into the administration account or otherwise, isn't it automatically stored on the device? How is it booting properly into the user account then? but we don't have a central sever at this point. The user may have encrypted the device on their own without recording it in which case your only real recourse is nuking the volume and starting over as there is no way to recover without a valid password or valid recovery key. The macos appears fine, and can boot correctly. if the device auto boots to recovery its usually because of the user messing with the OS and it cannot boot correctly, it'll come directly to the unlock/recovery screen. The prompt can happen in a few scenarios, user enters their password incorrectly and the system "offers" the recovery field or when you boot to recovery it will prompt you to unlock the drive to make changes. If you do not have a recovery key in an MDM or central server, the user may have encrypted the device on their own without recording it in which case your only real recourse is nuking the volume and starting over as there is no way to recover without a valid password or valid recovery key. If the user is off site, the FV password will be the previous password and then they will need to sign in again when it prompts with the new credentials. if the device auto boots to recovery its usually because of the user messing with the OS and it cannot boot correctly, it'll come directly to the unlock/recovery screen.Ĭhances are, if the device is AD bound and the user password was changed, they entered the password incorrectly as it will only sync the FileVault password if you're on network.


The recovery key is only used on an FileVault encrypted Mac. EFI firmware lock makes it so the device only boots from the internal drive and can only be changed using the cmd+r(recovery) combo, in which you need to enter the password, this is a low level lock. So it seems that people are confusing the EFI firmware password and the recovery key.
