> Source: [sk138352](https://support.checkpoint.com/results/sk/sk138352)

# sk138352 - How to update the Personal Recovery Key (PRK) for Native Encryption Management FileVault

| Property | Value |
|----------|-------|
| Solution ID | sk138352 |
| Date Created | 2018-10-22 |
| Last Modified | 2023-08-10 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | macOS |

## Solution

You may see that Native Encryption Remote Help Recovery Key for FileVault is not renewed after it has been used for FileVault login on a Mac computer.

The PRK is never automatically renewed by Endpoint Security. Due to a bug in macOS, confirmed by Apple, an automatic renewal of PRK will fail if the PRK was previously used to unlock an AD account. Here are the details:

After PRK is used in FileVault, the user is prompted to set a new macOS password in macOS login. The password reset button does not work for mobile account users. The only solution is to reset the user password on the authentication server (Active Directory), but in this case, after user enters the new password, macOS fails to synchronise the new password to FileVault preboot.

Now, when FileVault and macOS passwords are out of sync, it is no longer possible to safely renew the PRK using the FileVault CLI. If one attempt to do so, the PRK is deleted, but there is no new one generated, leaving the FileVault on the mac with no PRK at all.

This issues are related to the to Apple reported bugs; #35827868 and #36104913 (reported by Apple as a duplicate of #33521608)

Security best practice is to renew the PRK after it has been used. The solution for an Endpoint Security administrator is to either do a local, or a remote client login and then run the following command:

*/Library/Application Support/Checkpoint/Endpoint Security/nemControl change-and-upload-prk --username \<username\> --password \<password\>*

Note, the command will instruct Endpoint Security to perform PRK renewal and upload as soon it is connected to an Endpoint Server. *nemControl* does not wait for Endpoint Security to complete the command. The Endpoint Security Administrator can monitor the PRK renewal and upload process both from Endpoint Security Client UI, or from the SmartEndpoint UI.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content