A while back, I wrote a script which uses Jamf Pro’s Classic and Jamf Pro API to retrieve FileVault recovery keys. As part of assisting with a recent issue, I decided to develop a similar one for retrieving Recovery Lock passwords (these are alternatively referred to in Apple’s documentation as recoveryOS passwords.) The resulting script uses the Jamf Pro API to take a list of Jamf Pro computer IDs from a plaintext file, retrieve the associated Macs’ Recovery Lock passwords (if one is set) and generate a report in .tsv format.

For more details, please see below the jump.

Pre-requisites:

If setting up an API client for this purpose with limited rights, here are the required API Role privileges for the API client on the Jamf Pro server:

• Read Computers
• View Recovery Lock

For authentication, the script can accept manual input or values stored in a ~/Library/Preferences/com.github.jamfpro-info.plist file.

The plist file can be created by running the following commands and substituting your own values where appropriate:

To store the Jamf Pro URL in the plist file:

To store the API Client ID in the plist file:

To store the API Client Secret in the plist file:

This script imports a list of Jamf Pro computer ID numbers from a plaintext file and uses that information to generate a report about the Recovery Lock passwords associated with those computers. The plaintext file format should look like this:

Usage:

/path/to/generate_filevault_recovery_key_report_from_jamf_pro_id_numbers /path/to/jamf_pro_id_numbers.txt

Once the Jamf Pro computer ID numbers are read from in from the plaintext file, the script takes the following actions:

1. Uses the Jamf Pro API to download all information about the matching computer inventory record.
2. Pulls the following information out of the inventory entry:

• Jamf Pro ID
• Manufacturer
• Model
• Serial Number
• Hardware UDID

3. Runs a separate API call to retrieve the following:

• Recovery Lock Password

4. Create a report in tab-separated value (.tsv) format which contains the following information about the deleted Macs

• Jamf Pro ID
• Manufacturer
• Model
• Serial Number
• Hardware UDID
• Recovery Lock Password Available
• Recovery Lock Password (if no password is set, NA is reported for the Recovery Lock Password column.)
• Jamf Pro URL for the computer inventory record

The script should display output similar to this:

The resulting report in .tsv format will contain information similar to what’s shown below:

This script is available from GitHub at the following location:

https://github.com/rtrouton/rtrouton_scripts/tree/main/rtrouton_scripts/Casper_Scripts/Generate_Recovery_Lock_Password_Report_From_Jamf_Pro_ID_Numbers

In addition to the script described above which use API client authentication, there is also a matching script which uses user accounts for authentication available on GitHub via the link above. If setting up a user account with limited rights, here are the required API privileges for the user account on the Jamf Pro server:

Jamf Pro Server Objects:

• Computers: Read

Jamf Pro Server Actions:

• View Recovery Lock