Switched network (optional, though highly recommended if deploying over the network).

Client Mac computer(s) with macOS Yosemite or later installed.

Administrative Mac computer or server with macOS Yosemite or later installed.

Note: This article is included in the free PDF download Apple FileVault 2: Tips for IT pros. Learn three ways to automate a FileVault deployment, including slight tweaks to better suit the needs of your organization. A caveat: All of this rests on one single user with typically no centralized management of users allowed to unlock the disk IT may or may not have access to the device for management and worse, no method of accounting for recovery keys generated for each device in the organization.įortunately, Apple has included a command line-based way to essentially have your cake and eat it too by allowing for management of recovery keys, user account configurations to unlock the disks, and the ability to manage the devices in an ongoing manner that does not compromise user data or its confidentiality.

The primary user will also receive the personal recovery key if access to the account is lost, that person can unlock the disk to restore access to the data. This implementation gives the primary user (i.e., the user that enables FileVault initially) greater control, permitting that person to unlock the disk, decrypt data, and even remove FileVault altogether. ICloud Usage Policy (TechRepublic Premium) Save more than $1,000 off a refurbished MacBook Air How to change Touch ID settings on a MacBook Pro

By design, FileVault grants this authorization only to the account that enables this feature others can be added to the enabled list later. Apple’s FileVault 2 encrypts the entire disk so all data contained therein (despite the number of users it’s shared with) is essentially scrambled to everyone except people that have the credentials to unlock the disk, decrypting the data.

Automator mac for configurator