When someone forgets the password for Drive Encryption, you can go to the PGP server and display the Whole Disk Recovery Token to boot the system.
When going to find the WDRT for a particular device, it may be grayed out. This is a condition that could occur after upgrading to version 10.5 MP2.
PGP Server 10.5 MP2
This condition will resolve itself as soon as the PGP clients update policy and check in with the PGP server.
If there are systems that have not checked in to the server, and the WDRT is grayed out, please contact Symantec Encryption Support for further assistance.