Disable (turn off) FileVault Via Policy/Script

• feature request already logged to make this a policy option
  https://jamfnation.jamfsoftware.com/featureRequest.html?id=4041

@milesleacy if these Macs have a common Admin account that is a FV User and you know the password, it can be scripted.

#!/bin/sh

echo '<?xml version="1.0" encoding="UTF-8"?>

  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

  <plist version="1.0">

  <dict>

  <key>Password</key>

  <string>AdminPassword</string>

  </dict>

  </plist>' > /Users/Shared/filevault.plist 

  fdesetup disable -inputplist < /Users/Shared/filevault.plist

  rm /Users/Shared/filevault.plist

If you do not have access to a FV enabled User's password or the Recovery Key, it would be difficult to script w/o user interaction.

Great! Thanks @bkramps . That script is exactly what I was hoping to avoid building from scratch.

Delivering this feature request would make it easier...
Add ability to report on FV2 Recovery Keys (and/or access them via API)
Although, it's really just a halfway point to delivering my feature request above.

@milesleacy Hey Miles,

Want to also point out @rtrouton work with fdesetup. https://derflounder.wordpress.com/2015/02/02/managing-yosemites-filevault-2-with-fdesetup/

It talks about disabling and enabling fdesetup in detail.

Thanks @JasonkMiller ! I'm well familiar with @rtrouton 's fine FileVault write-ups and enthusiastically recommend them to anyone who needs to know how Apple's encryption system works.

Funnily enough, I had a request during my CCA class from one of my classmates for a script which disabled encryption via Self Service. I wrote this post and associated expect script in response:

https://derflounder.wordpress.com/2014/03/22/disabling-filevault-2-with-fdesetup-on-mountain-lion-and-mavericks/

@rtrouton Nifty, but the goal is to have the JSS provide the recovery key, since it's already stored there. User interaction is a show stopper.

modifying @bkramps solution to feed the xml with an API call would be nice, but that comes back to the other, as-yet undelivered, feature request.

It seems that with currently-available tools, disabling FileVault without user interaction is not an option.

Well, at least not in a supportable workflow...

Curious of there has been any progress made on this front...

I made som minor changes to the plist.
This works for me

#!/bin/bash

echo '<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

        <dict>

                <key>Username</key>

                <string>AdminUser</string>

                <key>Password</key>

                <string>AdminPassword</string>

        </dict>

</plist>' > /tmp/filevault.plist

fdesetup disable -inputplist < /tmp/filevault.plist

rm /tmp/filevault.plist