FileVault Enabled User is Null

[GhostBuster]

I have some users whose devices are known to Casper but the record for these devices (Inventory >> Disk Encyption) has this:

FileVault 2 Enabled Users: (null)

The user's name and userid is present under Inventory >> User and Location.

Does anyone know how to fix this? (The problem this is causing is that Casper is refusing to escrow a valid FileVault Recovery Key because it thinks the device has no fileVault2 enabled users.)

Thanks.

[DBrowning]

What OS Version? What JSS Version?

In 10.13 (null) is the actual Recovery key. I also saw this when migrating domains and the original AD user account was deleted.

[emily]

Hey @GhostBuster, that (null) is a byproduct of the changes made to FileVault Key/Redirection stuff in 10.13. I assume you're seeing this on a 10.13 machine? Redirection should still happen as long as the new FileVault payloads are in place in a configuration profile scoped to those machines with 10.13 installed.

In terms of seeing (null) at all, I believe there is a RADAR open with Apple to resolve it, though I don't have the RADAR at the moment.

[GhostBuster]

Actually, both machines that I'm having this issue with are running 10.12.6. Our server is running JSS v9.96.

[bbot]

Subscribed. Also seeing this in my environment.

[acaveny]

Also seeing this.

[daniel_ross]

Ditto and wanted to see if anyone has tried 10.13.1 yet to see if that helps?

[The_Lapin]

Just noticed this in my environment as well with our handful of 10.13+ Macs. Doesn't seem to be matter if it's 10.13.0 or 10.13.1. However, my MBPro running 10.13.2 (Beta 17C76a) is reporting just the actual names. Hopefully 10.13.2 fixes it. JSS 9.101.0.

Seems to be messing with my ability to build accurate smart groups to report based on:
- like MacOS 10.13
- FileVault 2 Partition Encryption State IS Encrypted or Encrypting
- FileVault 2 Individual Key Validation IS Valid
- FileVault 2 User DOES NOT HAVE local admin and/or casper management account

I'm guessing the (null) value is throwing it off. With 10.11 & 10.12 I was able to use similar smart groups to scope to policies that would add the management account to FileVault, then use the management account to add the local admin account, then randomize the management account credentials and remove it from FileVault.