The kbase is correct and it works. The policy will run as the management account.
The Institutional key will replace the Individual key the user received when they encrypted the drive. The user will need IT assistance if they forget their password or if the user account is somehow corrupted where they cannot login at the FV2 login screen after shutdown or restart.

@chiguchi, but one of the requirements that needs to be met to follow the kbase article is either "The management account configured as the enabled FileVault 2 user" or "An existing, valid individual recovery key that matches the key stored in the JSS" and currently none of those conditions are met.

Is there a way for me to make the management account an enabled FileVault 2 user? Then I could follow the kbase article.

@ryoshioka, you'd have to know the FIlevault password of the account that's already enabled. You could then use the inputplist functionality of fdesetup to add the management account to FileVault. That's what we do in this situation.

For Example, I have a policy that runs the below script to add our management account to FV. You can extend this script with a little user interaction to prompt them for their current filevault credentials.

#!/bin/bash

set -o nounset                              # Treat unset variables as an error



if [[ $EUID -ne 0 ]]; then

    echo "This script must be run as root"

    exit 1

fi



PLIST_TEMP=`mktemp PL.XXXXXXX`



cat << EOF > $PLIST_TEMP

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Username</key>

<string>filevault_username</string>

<key>Password</key>

<string>filevault_password</string>

<key>AdditionalUsers</key>

<array>

    <dict>

        <key>Username</key>

        <string>management_account</string>

        <key>Password</key>

        <string>management_password</string>

    </dict>

</array>

</dict>

</plist>

EOF



/usr/bin/fdesetup add -inputplist < $PLIST_TEMP



srm -m $PLIST_TEMP

Just make sure to update the username and password keys for your environment.

If you need to later remove the management account you can do it with this script:

#!/bin/bash

set -o nounset                              # Treat unset variables as an error



if [[ $EUID -ne 0 ]]; then

    echo "This script must be run as root"

    exit 1

fi



PLIST_TEMP=`mktemp PL.XXXXXXX`



cat << EOF > $PLIST_TEMP

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Username</key>

<string>filevault_username</string>

<key>Password</key>

<string>filevault_password</string>

<key>AdditionalUsers</key>

</dict>

</plist>

EOF



/usr/bin/fdesetup remove -user management_account < $PLIST_TEMP

srm -m $PLIST_TEMP

@Berrier, gotcha. I'll have to test these out on a test device before rolling this out to our users.

Finally got a chance to test your script, worked like a charm! Thank you very much.

@ryoshioka, excellent! You're welcome!