Who can unlock a FileVault Encrypted Drive

Boot from the Recovery Partition or an external drive and you can unlock it with an Admin password through Disk Utility.

You can also change admin password thru the terminal when booted from the recovery partition. So this could be a security risk.

@rderewianko][/url
Thank you.
RE: "A end user, if they're savvy enough can disable filevault diskutil, but typically disabling access through a config profile to security & privacy(i'd also disable access to profiles) will lock the average user out from disabling FileVault."

If I create a configuration profile that locks users out of "Profiles", they also get locked out of several other Preference Panes that we install, such as Symantec and Flash. I can enable everything that ships in the OS, plus MySQL and Java, but I see no way to selectively prevent Profiles, while allowing Pref Panes that may not be in the list.

In order to unlock or decrypt a FileVault 2-encrypted disk, you need one of the following:

1. A password for a FileVault 2-enabled account
2. A Personal Recovery Key
3. An Institutional Recovery Key

When the machine is booted, Apple blocks standard users from decrypting the encrypted boot drive:

http://derflounder.wordpress.com/2013/06/07/standard-user-accounts-in-os-x-10-8-4-now-blocked-from-decrypting-filevault-2-encrypted-macs/

Because you run as the root user when booted from the Recovery HD partition, that block will not apply.

If you want to block folks from disabling FileVault via System Preferences, Greg Neagle has created a profile that disables the Turn off FileVault button in System Preferences' FileVault preference pane.

http://managingosx.wordpress.com/2014/05/21/preventing-users-from-disabling-filevault-2/

That said, ultimately FileVault 2's focus on keeping unauthorized users out, not on keeping authorized users in. If someone who can log in to a FileVault 2 encrypted machine is determined to be decrypted and if they have access to Google along with admin rights and/or the ability to boot to Recovery HD, they will figure out a way to decrypt their machine.

My advice for this situation is:

1. Set up monitoring for un-encrypted machines
2. Set up a procedure for reporting un-encrypted machines to the appropriate management
3. Make the consequences of decrypting be their problem (via HR policy) rather than your problem.

Kevin wrote:

If I create a configuration profile that locks users out of "Profiles", they also get locked out of several other Preference Panes that we install, such as Symantec and Flash. I can enable everything that ships in the OS, plus MySQL and Java, but I see no way to selectively prevent Profiles, while allowing Pref Panes that may not be in the list.

This can be resolved by following the instructions here: https://jamfnation.jamfsoftware.com/article.html?id=204

I had to do this for a Wacom pref pane. Works as expected.

I suspect you are asking how to prevent user to unlock their filvevault2.
You can use configuration profile->restriction->Restrict items in System Preferences, choose security and privacy.