This section describes how to issue a code (offline recovery code) that temporarily allows a user to log in to a device using only a password, without an authenticator.
An offline recovery code is a 20-character code that temporarily permits a login with only a password, without an authenticator, for the target account. The administrator issues it on the Web management site and the user enters it on the login screen.
Codes are issued in the format RC-XXXX-XXXX-XXXX-XXXX-XXXX.
Because verifying the code requires no communication with the server, a login can be permitted even while the device is offline. It is a way to keep users from being locked out of their device when a security key is forgotten, lost, or broken.
Emergency logon is another way to permit a login with only a password, but it works by delivering the configured setting from the server to the device, so the target device must be online.
On the macOS login and lock screens it is often not possible to change network settings, so a device that stays offline cannot receive the emergency logon setting.
An offline recovery code requires no setting to be delivered, so it can be used in that situation.
An offline recovery code is tied to the combination of the device and the account specified when it is issued. It cannot be used on another device or for another account.
Offline recovery codes are supported only by the macOS client. The Windows client does not support them at present.
Also, to issue an offline recovery code, the target device must already share an offline recovery key with the server. The key is generated and shared automatically when the device synchronizes its settings, so no administrator operation is required.
For accounts on a device that has not shared a key, “-” (unavailable) is displayed in the “Offline Recovery” column of the account list and no code can be issued.
Select Authentication Services > Account from the menu.
For local accounts
Select “Local” for the account type.
For domain accounts
Select “Domain” for the account type.
Click the offline recovery icon in the target account line to open the “Offline Recovery Code” modal.
Click “Expiration Date” in the “Issue” area and select the expiration date and time in the calendar.
You can specify a date and time later than the current time and within 3 days of it. It defaults to 24 hours from now.
For a domain account, click the “Select” button for “Target Machine” and select the device on which the code will be used in the “Select Target Machine” modal.
Only devices that already share an offline recovery key are listed.
For a local account, the target device is determined automatically as the device the account is registered on, so this step is not required (the “Target Machine” field is not displayed).
Click the “Issue” button.
The code is displayed in the “Offline Recovery Code Issued” modal. Copy it and give it to the user by a secure method.
Once you close the issue-completed modal, the full code cannot be displayed again. Be sure to copy it or write it down before closing.
If you lose your copy, issue a new code.
There is no operation for revoking an individual offline recovery code that has already been issued. It remains usable until its expiration date passes, so set the expiration date to the shortest period you need.
The “History” area at the top of the “Offline Recovery Code” modal lists the codes issued for that account.
| Item | Description |
|---|---|
| Issued Date/Time | The date and time the code was issued |
| Expiration Date | The expiration date specified when the code was issued |
| Issuer | The administrator who issued the code. “(Deleted)” is appended for a deleted administrator |
| Target Machine | The device the code applies to. Displayed for domain accounts only. “(Deleted)” is appended for a deleted device |
| Code | Only part of the code is shown, in the form RC-first 4 characters-...-last 4 characters |
Rows whose expiration date has passed are greyed out.
For an account that has at least one unexpired code, an icon indicating “Enabled” is displayed in the “Offline Recovery” column of the account list.
The result of a user’s login attempt with an offline recovery code is recorded in the log list. Part of the entered recovery code is recorded in the log details.
For the steps a user follows to use an issued code, see Log in with an offline recovery code in the User’s Manual (macOS).
If a user fails to enter the code five times in a row, offline recovery code entry is refused for three minutes. This count and duration are fixed and cannot be changed in a group policy.
This is a different mechanism from the PC lockout caused by the Authentication Failure Lockout setting. A mistyped code is not added to the failed authentication count and does not put the device into the PC lockout state.
However, if the password entry after the code has been authenticated is mistyped, that is added to the failed authentication count.