SecureToken Admins are created when enabling FileVault itself, and these tokens are stored locally and attached to the account enabling FileVault. The green check-mark indicates a SecureToken Enabled User What the hell is a SecureToken admin anyways? User “Classicll” confirmed that only “SecureToken” admins can adjust FileVault settings and that a simple command “sudo fdesetup list -extended” lists the enabled SecureToken admins. Some Google searching revealed I am not the only one with this question. Barring the ability to do this, can another administrator login adjust File Vault features? Our IT team has an admin login of course, but I could not recall if that account allowed for turning off FileVault. As far as I could tell in this situation, the only way to get this access back would be getting that original username/password combo. This can get confusing in a “perfect storm” situation wherein the recovery key was not uploaded to JAMF or otherwise saved, a general user enabled FileVault, and that user forgot their password. As far as we could tell, the only way to adjust FileVault settings after it has been enabled is to use the recovery key to unlock the drive, or to use the username and password combination for the user that initially enabled the feature.

This extension to the entire volume is important as it drives the question I am aiming to answer tonight and the question Oz and I were wondering - Does encryption using modern FileVault attach the “key” and control of FileVault to a specific user, or can the encryption status be overridden using another admin, or potentially an MDM-stored encryption recovery key?Ĭomplex, but illustrates the functions used to create a 128-bit keyĬonfusion started to mount for Oz and I when we looked at how to manage the File Vault setting locally on the machine. Subsequent versions took this large snapshot and extended it to include chunks of 8MB each instead of 1 large file (presumably allowing for smaller sizes, faster backup, quicker recovery…) as well as extending to the entire storage volume and not just a single home folder. Developed by Apple in 2003, FileVault provides encryption of storage volumes in real-time for Mac computers although initially, FileVault only took large snapshots of the entire “Home” folder of a given user. So this topic comes from a conversation I had with a co-worker (Oz) when we were attempting to enable an encryption feature called FileVault for a Macbook we were working on.

Mac recovery key filevault