After a macOS update/upgrade, Escrow Buddy is no longer in the authorization database.

[F1Feng]

Fleet version: v4.55

---

💥  Actual behavior

After a macOS update/upgrade, Escrow Buddy is no longer in the authorization database.

🧑‍💻 Steps to reproduce

• MDM enroll
• Mac OS Update to new version(eg: 14.5 to 15.0)
• MDM unenroll -> MDM enroll
• then Disk encryption function not work.(the file: /var/db/FileVaultPRK.dat will not found.)

🕯️ More info

Some macOS updates and upgrades reset the authorization database to its default state, which will deactivate Escrow Buddy and prevent FileVault key generation upon next login.

Although this behavior adds friction to administering Escrow Buddy on your Macs, it's actually a great opportunity to test new macOS versions and ensure Escrow Buddy (or any authorization plugin) works as expected before reflexively re-enabling.

Once you've tested and are confident that Escrow Buddy works with the versions of macOS your company Macs are running, you can run this command (in root context) to re-enable Escrow Buddy in the authorization database:

/Library/Security/SecurityAgentPlugins/Escrow\ Buddy.bundle/Contents/Resources/AuthDBSetup.sh

Tips for configuring this on various MDMs can be found in the Examples wiki page.

Also see this related blog post: Managing login mechanisms in the macOS authorization database

[georgekarrv]

Thanks for sharing and thanks for the PR. We'll take a look at this today or tomorrow!

[fleet-release]

OS update resets,
Buddy's key, once lost, now found.
Secure, smooth sail set.

[PezHub]

QA Notes:

1. enrolled a previously encrypted mac running 14.4.1 to Fleet
2. confirmed the FV key was rotated and escrowed in Fleet
3. confirmed the presence of the escrow buddy plug-in /Library/Security/SecurityAgentPlugins and /var/db/FileVaultPRK.dat on the host
4. Upgraded the host to macOS 15
5. unenrolled and confirmed /var/db/FileVaultPRK.dat was no longer present
6. re-enrolled host and can confirm presence of file and FV was rotated and escrowed in Fleet

[F1Feng]

QA Notes:

1. enrolled a previously encrypted mac running 14.4.1 to Fleet
2. confirmed the FV key was rotated and escrowed in Fleet
3. confirmed the presence of the escrow buddy plug-in /Library/Security/SecurityAgentPlugins and /var/db/FileVaultPRK.dat on the host
4. Upgraded the host to macOS 15
5. unenrolled and confirmed /var/db/FileVaultPRK.dat was no longer present
6. re-enrolled host and can confirm presence of file and FV was rotated and escrowed in Fleet
   

Hi @PezHub , Thank you for your reply.

Perhaps auth db reset doesn't always happen，I think you can try resetting auth db use below command (simulating auth db reset after Mac OS update)

sudo security authorizationdb reset

Next step

• unenrolled MDM
• re-enrolled MDM and confirm
  
  I think the disk encryption will not work.

[fleet-release]

With each Mac update,
Buddy fades, then shines anew,
Keys secure, trust innate.