Since encrypting our Macs using FileVault we have been faced with a headache when a new user/Freelance user needs to log in to them. Historically on a Monday morning the user could log in using the traditional name/password login window but now with encryption you can only log in with a user account that has logged in previously.
Last week i was set with the task of doing something about it. I wanted to find a way that i could get a user account created from Self Service where a user could log in on a Friday afternoon run a policy that would create a user and enable the user in FileVault. Please see below the script i created to do the job, you must have CocoaDialog installed which does a brilliant job of requesting the username and password. Thanks to @stevewood for the FileVault plist part of the script.
# Joe Thurwood 17/09/2014
#
# Create new user script, used in Self service
# this script will create a new user based on
# the credentials supplied. It also enables
# the user in FileVault
# Set cocoaDialog location
CD="/private/etc/Ogilvy/Applications/CocoaDialog.app/Contents/MacOS/CocoaDialog"
# Dialog to enter the User name and the create $USERNAME variable
rv=($($CD standard-inputbox --title "Username" --no-newline --informative-text "Enter the name of the new user to add"))
USERNAME=${rv[1]}
if [ "$rv" == "1" ]; then
echo "User said OK"
elif [ "$rv" == "2" ]; then
echo "Cancelling"
exit
fi
# Dialog to enter the Password and the create $PASSWORD variable
rv=($($CD secure-standard-inputbox --title "Password" --no-newline --informative-text "Enter the password of the new user to add"))
PASSWORD=${rv[1]}
if [ "$rv" == "1" ]; then
echo "User said OK"
elif [ "$rv" == "2" ]; then
echo "Canceling"
exit
fi
#Create Mobile Account
sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n $USERNAME -p $PASSWORD > /dev/null 2>&1
# create the FileVault plist file:
echo '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Username</key>
<string>'$4'</string>
<key>Password</key>
<string>'$5'</string>
<key>AdditionalUsers</key>
<array>
<dict>
<key>Username</key>
<string>'$USERNAME'</string>
<key>Password</key>
<string>'$PASSWORD'</string>
</dict>
</array>
</dict>
</plist>' > /tmp/fvenable.plist
# now add user to FileVault
sudo fdesetup add -i < /tmp/fvenable.plist
# remove fvenable.plist
rm /tmp/fvenable.plist
