Trigger a new macOS FileVault Recovery Key for Escrow

Starting with macOS 10.13 you can now escrow the FileVault recovery key with an MDM. This is useful if you are running a fleet of macOS devices and want to automatically store the recovery key. The problem is that once the key is generated, it is lost forever if you don't store it somehow. It also means that if you implement an escrow policy on a machine with FileVault already enabled, you cannot escrow the key. The trick is to re-generate a key which will allow it to be escrowed. The command is:

sudo fdesetup changerecovery -personal

After entering the command you will be asked for the password for the logged in user (you won't see the password as you type it) then hit return.

Then it will ask for a user that has access to the FileVault key - which is typically the same user and then again enter the password. The interaction looks something like this:


Test-MacBook-Pro:~ testadmin$ sudo fdesetup changerecovery -personal
Password: [enter the password]
Enter the user name: testadmin
Enter the password for user 'testadmin': [enter the password]
New personal recover key = '32BT-LEXH-59KL-VUVV-73HU-V92Q'
Test-MacBook-Pro:~ testadmin$

Trigger DEP on a MacOS machine after installation

Ever wondered how to trigger a Mac to pull a DEP profile without rebuilding the whole machine? This is something I thought was totally impossible despite lots of searching. Then one day, I ran across this thread in Reddit and it's possible!

Someone just casually mentioned that you can do this with the following command:

sudo profiles renew -type enrollment

Sure enough it works perfectly? How was I not able to find this all this time? Jees... you'd think there would be a good way to search the internet or something.

While I'm at it, here is another neat trick to re-trigger a Mac to act as if it's been newly started up without having to fully wipe it first.

sudo rm /var/db/.AppleSetupDone 
sudo rm -rf /var/db/ConfigurationProfiles/ 
sudo rm /Library/Keychains/apsd.keychain

Reboot the machine and re-enroll. You may find that you are not allowed to run the 2nd or 3rd command due to permissions, but just doing the first one should be good enough.

Apple Serial Number Decoding spreadsheet

Apple has been using the same serial number format since 2010 on virtually all (if not all?) their devices. The serial number encodes a bunch of things such as the manufacturing location, the production week in a given year, the model number as well as a unique ID. There are many use cases for being able to decode the serial number and there are a few web sites out there that let you enter a serial number and get the result. But, who knows what those sites do with the information you give them? I thought it would be much better to do it on a spreadsheet where you can decode your own serial numbers.

My source for much of this information is here: https://www.macrumors.com/2010/04/16/apple-tweaks-serial-number-format-with-new-macbook-pro/

Click on the link below to go to the spreadsheet:

Decoding Spreadsheet   <==========

Just click on the link, see how it works and copy it to your computer. Or if you just want to quickly decode a serial number you can do it live in the spreadsheet.

One thing that I was curious about was what would happen in 2020. Their numbering system has a single character to denote the Year and Half starting with C and going to Z. The 2nd half of 2019 was Z and I was curious if they were going to go from Z to 1, if they were going to create a new numbering schema or circle back to A.

We now know the answer at least for now... I just bought a machine built in Week 1 of 2020 and it looks like they have circled back to C (which used to be 2010, First Half).

What this means is that any machine built after December 31, 2019 will need to use a different formula in the spreadsheet. I've called this the "New Epoch" section in the spreadsheet.

So long as Apple don't reuse Model IDs (the last 4 digits) there is no risk of creating colliding serial numbers, so it's really not a huge problem.

Also, there are rumors that Apple will be moving to completely random serial numbers in which case none of this will work anymore. Read about it here: https://www.macrumors.com/2020/01/06/apple-randomized-serial-numbers-late-2020/

Recursively MD5 multiple files in OS X

I have an archive of very large files that I would like to preserve into the future. I wanted to produce an MD5 hash of all the files so that as the years pass, I can be certain that the files are exactly the same as they started (i.e. not corrupted by aging storage media). As a Mac user, I knew about the md5 command, but unfortunately this command only works on one file at a time and will not recursively hash a directory full of files. I also knew about the md5deep project which specifically adds this functionality, but alas there wasn't an OS X binary available anywhere that I could find. Upon Googling for such a program, there were a bunch of nice GUI-based programs for Windows, but nothing for OS X.

This morning when I went into work I explained my problem to Brad who suggested that I investigate if the find command would be of any use. Indeed, this was great advice and probably explains why there isn't a ready app in OS X to do it - essentially this functionality is built in!

find * -iname '*.dv' -exec md5 '{}' \; >output.txt

The above command will find all files that match "*.dv" (i.e. any file with an extension of dv) in the current directory and below, and then produce an MD5 hash of that file. It will then output the list of all the md5s to a file called output.txt.

So, basically if you are ever looking for a program where you can drop a folder into it to check and include subfolders to do a particular activity (and you're not afraid to use the command line), you can adapt the technique above by changing the md5 command to any other command.

Epilogue: I originally wrote this post when I was using OSX Leopard, but it also works in Snow Leopard, Lion and Mountain Lion and indeed should work with any flavour of OSX.