DEP-2025 · Question #71
What should be escrowed in MDM to enable resetting the password on a user's FileVault- encrypted Mac?
The correct answer is A. Personal recovery key. The personal recovery key, generated when FileVault is enabled, must be escrowed in MDM to allow password resets on an encrypted Mac. The macOS Security Overview states, "For MDM- managed devices, the personal recovery key can be escrowed to enable password resets or disk…
Question
What should be escrowed in MDM to enable resetting the password on a user's FileVault- encrypted Mac?
Options
- APersonal recovery key
- BInstitutional recovery key
- CSecure token
- DBootstrap token
How the community answered
(56 responses)- A75% (42)
- B4% (2)
- C7% (4)
- D14% (8)
Explanation
The personal recovery key, generated when FileVault is enabled, must be escrowed in MDM to allow password resets on an encrypted Mac. The macOS Security Overview states, "For MDM- managed devices, the personal recovery key can be escrowed to enable password resets or disk unlocking by an administrator."
Topics
Community Discussion
No community discussion yet for this question.