Frequently asked question
- What is the problem?
- What is an encryption recovery key and why is it important?
- Who is affected by the missing recovery key problem?
- Will device compliance be affected by this problem?
- What should I do to correct this problem?
- How can I tell if a device's recovery key is in MyDevices?
- Will affected users be notified?
- What is key escrow?
- What happens if I use VLRE and choose not to escrow a key?
- What if I need help?
Answers to frequently asked questions
What is the problem?
Some encryption recovery keys for macOS and Windows computers that were backed up using the Stanford Device Registration application are not available for retrieval in MyDevices, although they should be. Correcting the problem will in many cases require action on the part of affected users.
What is an encryption recovery key and why is it important?
If you're ever locked out of an encrypted macOS or Windows computer, e.g., because you've forgotten the necessary password, you will need an encryption recovery key to unlock it. In most cases, Stanford users should have their keys securely backed up by University IT (also known as "key escrow"), so that they can be retrieved in MyDevices.
Note that VLRE users, during installation of the VLRE software, can choose not to escrow their recovery keys, although it's strongly recommended that they do so.
Who is affected by the missing recovery key problem?
Anyone who encrypted a macOS or Windows computer using Stanford-provided software (i.e., SDR or VLRE) could find that the encryption recovery key for that computer isn't retrievable in MyDevices. Mobile devices are not affected.
Will device compliance be affected by this problem?
No. It is not required that a device's encryption recovery key be backed up in MyDevices for the device to be compliant.
What should I do to correct this problem?
You can first check to see if any device belonging to you does not have a key available for retrieval in MyDevices. If you find a device for which a key should be available but is not, you can fix the problem by following the steps in Back Up Your Encryption Recovery Key (Windows) or Back Up Your Encryption Recovery Key (Mac). The steps must be followed for each device missing a key.
How can I tell if a device's recovery key is in MyDevices?
You can tell whether a particular device has a recovery key available for retrieval by looking in MyDevices. For each device, check the Device Details page by clicking the Model name. The Encryption Status line will state "Encryption key not available for the device" if there's no key in escrow, and otherwise you'll see a link to retrieve the key.
Users who have one or more devices with missing recovery keys will also see an announcement on their MyDevices main page listing the names of the affected devices. Clicking on a device name will bring up its Details page.
Will affected users be notified?
Yes. An announcement will be displayed on the MyDevices main page for affected users, which will list each device for which a key is missing.
What is key escrow?
Key escrow is secure storage by Stanford University IT of encryption recovery keys for specific devices, so that they may be retrieved from MyDevices when needed. Only the person whose device's key is in escrow can retrieve the key, absent extraordinary circumstances. Recovery keys are stored in encrypted form.
What happens if I use VLRE and choose not to escrow a key?
You will need to save your encryption recovery key by some other means, such as writing it down on a piece of paper that's stored in a secure location that's reliably accessible to you. You can also escrow keys with other services, such as that provided by Apple for macOS devices.
What if I need help?
If you need further assistance, please contact your local IT support, submit a Help ticket, or call 725-HELP (5-4357).
