Once you have exported the certificate, you can then upload it to the SEE Management Server:Ĭheck the box for “Use Institutional Recovery Key” and browse to the public portion you just exported with the. The keypair should be stored off the server and in a secure location and only the required folks should have access to this key. Important: he only key needed to import into the SEE Management Server is the “FileVault Recovery Key” certificate, which is only the public portion of the certificate/key. In order to export the keys, you’ll need to unlock the keychain with the unlock command above and then right-click each of the files and export, or export both at once:Įnter and confirm the passphrase of the FileVault Master Password keypair you wish to protect it with: You’ll also notice that there were two entries created:įileVault Master Password Key (Private key) Security unlock-keychain /Library/Keychains/SEEFileVaultMaster.keychain, which will show the padlock is now unlocked: To be able to export the keys needed, you’ll need to unlock the keychain with the following command: You’ll notice the keychain is locked by default. You may not see the keychain you just created, and if you do not, simply drag the SEEFileVaultMaster.keychain into the list of keychains in Keychain Access.
This will create a keychain called “SEEFileVaultMaster.keychain and will be located in /Library/Keychains Sudo security create-filevaultmaster-keychain /Library/Keychains/SEEFileVaultMaster.keychain To create the Institutional Recovery Key, run the following command, which will create a keychain as well as the certificates to run get the IRK:
See the following articles for additional information related to this topic:Ģ13002 - How to install and use the SEE FileVault client to enable encryption and manage Recovery Keys with the SEE Management ServerĢ13004 - Using a Personal Recovery Key to unlock a machine managed by the Symantec Endpoint Encryption FileVault ClientĢ13006 - Using the SEE Helpdesk Web Portal to obtain the Personal Recovery Key for SEE FileVault clients This article will cover how to configure the Institutional Recovery Key to be used in conjunction with Personal Recovery Keys. In addition to managing the Personal Recovery Key the SEE FileVault client can be configured to use an “Institutional Recovery Key”, so if the PRK or user password cannot unlock a system, the IRK can be used to do so. Symantec Endpoint Encryption includes the ability to easily manage the Personal Recovery Keys for these macOS systems encrypted with FileVault. If a user forgets this passphrase or is unable to unlock the system with the regular macOS password, a Personal Recovery Keys (PRKs) can be used to boot a system. Apple’s macOS has the ability to encrypt the hard drive of the system.
0 kommentar(er)
