Filevault 2 deployment

I gave a session on FileVault 2 and Casper at JNUC 2013, where I discussed how Casper's FileVault 2 management works. The video is linked here if you're interested:

“Understand FileVault 2 and Manage Disk Encryption with the Casper Suite” session video from JNUC 2013 now available

Casper uses Apple's fdesetup tool for its FileVault 2 management, so it helps to understand the capabilities of fdesetup when looking at Casper's FileVault 2 management. I have posts on using fdesetup for both Mavericks and Yosemite available from the links below:

Managing Yosemite’s FileVault 2 with fdesetup

Managing Mavericks’ FileVault 2 with fdesetup

I'd also recommend checking out Casper's FileVault 2 management documentation:

http://www.jamfsoftware.com/resources/administering-filevault-2-with-the-casper-suite/

Hi Rich,

I've read both guides and also read the JAMF documentation on it. I'll check out the video though.

Im thinking of deploying with via self service as the management account initially enabled. Then an authenticated restart command to by pass the FV2 login window. At this point the user can then log back in, receive a password prompt box , populate a temporary plist and import with fdesetup.

I then may add the local admin account as an enabled user, and remove the management account. I'm thinking of removing the management account as I don't want this username displayed at the FV2 login screen on startup. I don't really like the idea of users knowing the username for the casper management account.

I think maybe accounts aren't being automatically enabled is because I am testing on a Mavericks machine rather than Yosemite.

Mobile accounts won't be enabled automatically by the OS. Once the Mac is encrypted, new local accounts created through System Preferences are automatically enabled for FileVault 2 by the OS.

Really? I spoke directly with JAMF and they told me if I used the management account in the encryption then new local accounts or new mobile accounts would be automatically enabled.

Makes sense though as this is not working with mobile accounts in my testing.

I have set up FV2 distribution using both individual/institution key option and set to enable FV2 at logoff with the option to cancel if one is not yet ready (Enabled FileVault 2 User set to "Current or Next User"). This allows us to push to the machine but the user can decide exactly when to pull the trigger and begin the encryption process. This does only enable one user to use the machine. (My scenario is a bit more simple than yours it seems)

Require FileVault 2
Require users to enable FileVault 2 based on one of the following events.
Logon/Logout/2 logins

Im a bit unclear what this option means - is this referring to the adding of new users to the list of enabled file vault 2 users?

I didn't realise you the user could cancel out of it - what I am seeing is when the policy is delivered successfully it seems to flag the machine to be ready for encryption. Then on the next logout the file vault 2 password box for the user prompts which begins the encryption process.

For the "Logon/Logout/2 logins" part, assuming this is on a Yosemite system, this is leveraging fdesetup's deferred enablement options. I have a post explaining how deferred enablement works on Yosemite available from here:

FileVault 2 deferred enablement in Yosemite

Thanks @rtrouton