Contents
Is there an issue with FileVault on Mac?
We’ve noticed an issue with a setting when configuring FileVault settings for macOS devices within Device Configuration. This may cause FileVault profiles to not deploy as intended depending on how the settings are configured. We’re sharing a workaround here until this is fixed in a future release.
Are there any known issues with FileVault configuration profiles?
Another issue is, as I commented on the other blog post, that when enabling FileVault the recovery key is shown to the user and they are instructed to “keep it in a safe place.” I do not want the user to store the recovery key anywhere, especially given some users will store it with the laptop.
Why do I get error messages with FileVault?
Aug 08 2019 11:08 AM @Miguel Sanabia Thank you for your feedback! If this configuration worked for your devices, then I recommend leaving it as is. The error messages in the state details are most likely attributed to this configuration and the device giving Intune back an unknown error.
Do you need a password to enable FileVault?
Note: Using Security & Privacy > FileVault to enable FileVault succeeds because another (private) API is used here and the users are assigned a Secure Token. However, in this workflow an Administrator’s username and password is required. Using the following command you can verify whether a user has a Secure Token or not.
How to change the password for File Vault?
Settings > Users & Groups > Change Password you will be prompted twice, once for the File Vault original password and again for the new account password. However if you change the password via Settings > Security & Privacy > Change Password
What happens if I Lose my FileVault recovery key?
If you lose both your account password and your FileVault recovery key, you won’t be able to log in to your Mac or access the data on your startup disk. Encryption occurs in the background as you use your Mac, and only while your Mac is awake and plugged in to AC power.
What causes FileVault to not deploy as intended?
This may cause FileVault profiles to not deploy as intended depending on how the settings are configured. We’re sharing a workaround here until this is fixed in a future release. When Disable prompt at sign out is Not configured, the Number of times allowed to bypass can be set to any value.
Where do I find the recovery key in FileVault?
If the key is needed it should be retrieved from Intune. My ask is that the ShowRecoveryKey FileVault2 payload option be made available in the Intune FileVault configuration profile so that it can be set to False, so that the recovery key will not be displayed to the user. Here is the relevant part from Apple’s reference:
Who is the PM of Intune macOS FileVault?
Aug 06 2019 10:19 AM Our PM Anya Novicheva had responded back to your comment in the Intune macOS FileVault Announcement blog that the current architecture allows various ways for the end user to access their recovery key including from the Intune web Company Portal. We value your feedback!