Hey all,
I'm wondering if anyone else is seeing this. I apologize in advance for the wall of text. I'll try to keep it brief.
We're doing a 1-1 deployment and our workflow requires the setting up of 2 accounts (one for "personal" use and another for "work" use). We've been told to try to keep our interference down to a minimum, since the end users are leasing the computers. We're trying to treat it almost like a pseudo-byod style deployment.
Our workflow is that the computer is enrolled via DEP, we walk the user through the setup assistant and they create the initial local admin account.
We have 2 profiles scoped to these computers:
A configuration profile that has a "directory" payload which binds the computer to our AD domain and a "mobility" payload that creates a mobile account on login. We've disabled syncing completely, but we want the users to be able to access the account even when offsite.
Then we have another profile that has the "security & privacy" payload that enforces Filevault and a "FileVault Recovery Key Redirection" payload that is set to "automatically redirect recovery keys to the JSS".
The users will finish the setup assistant, get to the desktop and then we get them to log out. The profile kicks in and prompts for their password (as expected), pops up the recovery key (as expected) and reboots. We prompt the user to take a picture of their recovery key. After they login again, we verify in the JSS that the recovery key is there. So far so good.
Then we prompt them to logout and sign in with their AD credentials. This creates the mobile account. We then have a policy which runs and installs some basic documentation into their documents folder, etc. It also runs a script which assigns the device to the AD user in the JSS and also elevates the AD user to an administrator.
Here's where things start to get weird. I've noticed that on approx. 50% of these computers, if I check the FileVault status in the JSS, it's now flipped back to "not configured" and we've lost the recovery key!!
Since we're supposed to be mostly "hands off" on these computers, we don't enable the management account for FileVault passthrough, since we want to keep it hidden from the login window. I believe this means that we can't use the built in FileVault features in the JSS.
Our current method of dealing with this is to then run an "fdesetup changerecovery -personal", which then requires us to tell the client that they need to delete their old picture and take another picture, etc.
It works, but it doesn't inspire much confidence in the users and it also causes me to question whether the keys will randomly disappear from the JSS again at any given time.
Any advice would be appreciated.
