Kandji FileVault Recovery Key Not Escrowed

- Device is encrypted but recovery key is missing in Kandji console. - Compliance checks fail for encryption escrow control. - Security operations cannot confirm recoverability posture.

- Escrow workflow failed during initial encryption or post-rotation. - Endpoint lost policy/apply state during key rotation window. - Device/user workflow completed encryption outside managed policy sequence.

Document whether the issue affects one user, multiple users, or multiple devices. Confirm exact error messages, recent changes (password reset, update, network change), and whether the same issue reproduces in web vs desktop workflows where applicable.

Confirm the user is signed in with the correct corporate account, system time is accurate, network/VPN connectivity is stable, and the application is not running in offline or limited mode.

Use the command snippets below to collect non-destructive diagnostics. Capture output in the ticket when escalation may be required. Avoid deleting profiles, cached credentials, or managed app data unless the runbook or admin approval explicitly allows it.

- Confirm current FileVault state and user ownership context on endpoint. - Validate escrow policy deployment state and key-rotation requirements. - Use approved key rotation/escrow remediation path via MDM policy. - Document completion evidence in ticket for auditability.