you can run "sudo fdesetup sync" and that removes the UUID with (null) as the username. I too have recently changed domains after a company bought us. Let me ask you this... are you just having an encryption policy run again to add the new AD account added to the filevault users? the encryption policy i have is set to run once per user per computer. Since its the same username in the new domain, the policy doesn't run again.

Hi ddcdennisb,

Thanks for your response, that worked like a charm!

We are not re-deploying the encryption policy, we are just enabling the user in System Preferences > Security & Privacy > FileVault > 'Enable Users' after our migration scripts have completed.

We are also moving to a new casper environment also so our process is as follows:
1) Remove Management and Delete Object in old environment.
2) Recon onto new.
3) Run migration scripts via self service.
4) Login an check all is fine.
5) Re-enable user for FileVault (as mentioned above).
6) Run the FileVault Reissue script from Jamf. - to generate new recovery key.

Not sure if this is the best way but works well for us.

Funny we are doing the same exact thing. New Domain and new jamf server. We aren't doing both at the same time, and our domain change is all scripted/automated. Since we are doing over 1000 users. Was hoping there was an easy way to add in the "new" ad account since I now have 600ish computers that are encrypted but the FV password is out of sync with their login password.

@ddcdennisb We have reset the newAD users passwords to random passwords, uploaded them to Jamf as an extention attribute and scripped it to add the user to FV

#!/bin/sh



## This "expect" block will populate answers for the fdesetup prompts that normally occur while hiding them from output

    expect -c "

    log_user 0

    spawn fdesetup add -usertoadd $NEW_AD_USERNAME

    expect "Enter a password*"

    send ${adminPass}

    expect "Enter the password*"

    send ${NEW_AD_USER_PASSWORD}

    log_user 1

    expect eof

    "

@Yaneev Thanks. I started looking at using expect this morning and have put together a process that can be run through self service. I was over thinking things earlier. Thanks again