I'm having a lot of trouble with some machines with File Vault 2 config profile and policy applied to enforce the enablement, however for like 5-6 machines for a total of about 30, File Vault 2 results disabled and the policy log says "FileVault is Off.
Deferred enablement appears to be active for user ' '. "
Checked a couple links here but no one didn't ever found a solution as I can see. Jamf Cloud instance is almost new and I'm enrolling machines for the first time, not AD bound.
We run into this in our environment far too often... and when we provision these user accounts we verify that the user account is ENABLED; then something happens between that point and actually activating FileVault. @mschroder 's link above is a nice reference... but here's the quick and dirty commands you'll need to use to resolve this:
sysadminctl -secureTokenStatus USERNAME
If the user shows as unknown, you may have a network account that needs to be converted to a Mobile account... that's beyond the scope of this answer! If it just shows as DISABLED; in terminal login your administrator account and run the following command - note the separate hyphens (scroll all the way to the right!) after the password switches so that you can enter the passwords interactively without being seen; YOU WILL NEED TO KNOW THE USER'S PASSWORD!
sysadminctl -secureTokenOn USERNAME -password - -adminUser ADMINNAME -adminPassword -
Hopefully it will report successful; if you get an about "secure unlock" you maybe need to run the command from an instance of a user who has Secure Token enabled already (e.g. the first user on the Mac in most circumstances, who can then transfer it to other users.)