Turn OFF FileVault2

Hi @Brad_G

I don't believe you can pass the password directly to the fdesetup command, not even using a plist to input it. The only way I can think that you might be able to do would be to use Expect script to pass the password. This is totally off the cuff, so I would test this A LOT before using in production:

#!/bin/sh

expect <<- DONE
  set timeout -1
  spawn fdesetup disable

  # Look for  prompt
  expect "*?or the recovery key:"
  send ${4}

  expect EOF
DONE

I'm not great with Expect, so again, test, test, test.

https://jamfnation.jamfsoftware.com/discussion.html?id=12143#respond

An expect script will work, but I'm not certain exactly how reliable they are. I would personally do this through diskutil cs. Here's an example...

#!/bin/sh

password="$4"

if [ -z "$password" ]; then
    echo "No password passed to $4"
    exit 1
fi

FV2Stat=$(fdesetup status)

if [[ "$FV2Stat" =~ "FileVault is On" ]] && [[ ! "$FV2Stat" =~ "Encryption in progress" ]]; then
    echo "FileVault 2 is currently on. Disabling..."
    lvUUID=$(diskutil cs list | awk '/Logical Volume/{f=$NF} END{print f}')
    echo "Found lvUUID: $lvUUID"
    diskutil cs decryptLV ${lvUUID} -passphrase "$password"
    exit 0
else
    echo "FileVault 2 is off or doing a CoreStorage operation. Exiting..."
    exit 0
fi

Basically, pull the Logical Volume UUID, then use that in a diskutil cs decryptLV command along with the LVUUID, and pass the password to it, which itself can be passed to the script in $4 to make it a little more secure. Of course, something like this would only work if you have one account that is enabled for encryption on all your Macs, like the Casper service account. Otherwise, you'd have to get the user password into it somehow, like with an Applescript or cocoaDialog window.

The only thing about doing it this way is it actually doesn't start a decryption until the Mac is rebooted. Basically, it schedules it, but since FDE is an at rest type of encryption, its effectively off as soon as the Mac is powered off or restarted. The Mac will boot back up without the usual FV2 login screen.

Note that I haven't really tested the above script. Its just an example, so you'd have to do some testing with your setup to make sure it works.