A previous employee encrypted the hard drive on an old Macbook Air and no one has the password and no one can get it from the previous employee. Is there a way to reset the password? If not, if I restore to factory defaults, will that remove the encryption?
Earlier displays & monitors
Assuming this is FileVault (Apple's disk encryption) and you do not have the user's password (cannot get past the FileVault login), then your path to recovering the machine is to erase it and reinstall the OS. This will remove the encryption. Please note, all data will be lost. However, if you don't know the user's password, you will not be able to decrypt the drive and thus will not be able to get any data.
Next, if the user signed in to the device with a personal Apple ID and enabled Find My, then the device is activation locked to the ex-employee's Apple ID. If you have proof of purchase, you can open a request with Apple to remove the activation lock on the device by reviewing this KBase article.
Hope this helps. Please note, if you had an MDM and your enforced disk encryption through the MDM, you would have the recovery key and you would be able to access the device and the data. If you do not have an MDM, you likely should enable encryption and record the decrypt key manually. Note, without an MDM, as skilled user could disabled FileVault, discarding your known key, and then reenabled it which generates a new key. This would lock you out.
Hope this is helpful
Assuming this is FileVault (Apple's disk encryption) and you do not have the user's password (cannot get past the FileVault login), then your path to recovering the machine is to erase it and reinstall the OS. This will remove the encryption. Please note, all data will be lost. However, if you don't know the user's password, you will not be able to decrypt the drive and thus will not be able to get any data.
Next, if the user signed in to the device with a personal Apple ID and enabled Find My, then the device is activation locked to the ex-employee's Apple ID. If you have proof of purchase, you can open a request with Apple to remove the activation lock on the device by reviewing this KBase article.
Hope this helps. Please note, if you had an MDM and your enforced disk encryption through the MDM, you would have the recovery key and you would be able to access the device and the data. If you do not have an MDM, you likely should enable encryption and record the decrypt key manually. Note, without an MDM, as skilled user could disabled FileVault, discarding your known key, and then reenabled it which generates a new key. This would lock you out.
Hope this is helpful
@Strontium90 explained things very well, but I would like to add if this is an older Mac with Filevault enabled (2016 or earlier), then you will need to erase the whole physical drive. Within Disk Utility you may need to click "View" and select "Show All Devices" before the physical drive appears on the left pane of Disk Utility. You will want to use the GUID partition and either MacOS Extended (Journaled) or APFS (top option) file system (file system choice depends on the version of macOS being installed).
If a 2018+ Mac with the T2 security chip (Intel Mac) or M-series Mac, then you will need to perform a DFU firmware Restore to reset the secure enclave chip.
Thank you so much for the detailed response - this is very helpful. The laptop is not connected to the old employee's apple id so we won't have an issue there but I like the idea of erasing everything and reinstalling.
The password that encrypted the hard drive is unknown - is there a way to reset it?
