@JarvisUno
This is the FV section of my user Mobile Account first run script for 10.15.3.
It starts with an Erase+Install package that sets up ladmin to autologin and trigger DEP enrollment via Jamf Helper, which binds the machine+misc, never enabling FV for ladmin, but it has a secure token.
Config Profile escrows key, once FV is enabled and inventory update, CP gets updated to require FV.
Hopefully getting to test bootstrap in the next couple months.
#!/bin/sh
##variables
#logged in user
USER=$(/usr/bin/python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "
");')
#jamf helper location
JAMFHELPER="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper"
FIRSTMSG="Welcome to Mac@Company!\n\nYou will now be asked to input you password to encrypt the system with FileVault."
FIRSTMSGFORMATTED=$( echo $FIRSTMSG )
MSG="FileVault has been successfully configured.\n\nPress OK to continue setup.\n\nWhen the Self Service app loads the user interactive portion of enrollment is complete."
FINALMSG=$( echo "$MSG" )
#FileVault Status
FVSTATUS="$(/usr/bin/fdesetup status)"
#FileVault Status Check
if [ "$FVSTATUS" != "FileVault is On." ]; then
#branded jamfhelper window to inform end user about FileVault process
"$JAMFHELPER" -windowType utility -title "Mac@Comapny" -description "$FIRSTMSGFORMATTED" -button1 "Okay" -icon /path/to/brandingimage.png
#get passwords
PASSWORD="$(/usr/bin/osascript -e 'Tell current application to display dialog "Please enter your password:" default answer "" with title "FileVault Setup" with text buttons {"Ok"} default button 1 with hidden answer' -e 'text returned of result')"
PASSCHECK=`dscl /Local/Default authonly $USER $PASSWORD; echo $?`
#autheticate password
while [[ "$PASSCHECK" != "0" ]]; do
echo "asking again"
PASSWORD2="$(/usr/bin/osascript -e 'Tell current application to display dialog "Incorrect password, please try again:" default answer "" with title "FileVault Setup" with text buttons {"Ok"} default button 1 with hidden answer' -e 'text returned of result')"
PASSWORD=$PASSWORD2
PASSCHECK=`dscl /Local/Default authonly $USER $PASSWORD2; echo $?`
done
#grant secure token
sysadminctl -adminUser ladmin -adminPassword ladminpw -secureTokenOn $USER -password "${PASSWORD}"
#enable FileVault
/usr/bin/fdesetup enable -inputplist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Username</key>
<string>$USER</string>
<key>Password</key>
<string>$PASSWORD</string>
</dict>
</plist>
EOF
#branded jamfhelper window to inform end user about process completion
"$JAMFHELPER" -windowType utility -title "FileVault Setup Complete" -description "$FINALMSG" -button1 "OK" -icon /path/to/brandingimage.png
#remove secure token from ladmin
sysadminctl -secureTokenOff ladmin -password ladminpw -adminUser $USER -adminPassword "${PASSWORD}"
#remove ladmin from filevault login screen
diskutil apfs updatePreboot /
fi
