FV2 with Shared MBP

[VitorCostaUK]

I'm trying to set up 32 2019 MBP's, deployment etc all configured but the last issue I have is managing file vault 2 and multiple users.

Currently, the first logged in user is prompted to enter their password to initiate the FV2 encryption, but then when restarting only that first user and guest is shown, these MBPs will be used by multiple users.

What I want :

I would love to have FV2 enabled on the local drive and automatically allow all AD users to authenticate when the user turns on the MBP it just goes to the login window that prompts for username and password.

is this possible?

[sdagley]

@VitorCostaUK There is no way to allow AD logins from the FileVault unlock screen. The Mac is not on the network at that point in the boot process.

[VitorCostaUK]

@sdagley

so whats the best method to allow for shared MBP useage with FV2 enabled ?

[sdagley · Accepted solution]

@VitorCostaUK For shared Macs FileVault doesn't really make sense. You'd have to create an account for every user that would need to be able to log in to the machine and enable it to unlock FileVault. That means anyone who has an account could potentially access the info from all the other accounts on the Mac. That's not really a secure situation.

[VitorCostaUK]

@sdagley thats what i was afraid of , being a school we need to ensure that all students could have accessed the MBP.

Thanks for the confirmation

[sdagley]

@VitorCostaUK As a school you should probably look at setting a Firmware/EFI password so that students can't boot into Recovery Mode and try to modify accounts

[VitorCostaUK]

@sdagley yep already do that in the deployment stage, we just wanted to ensure that student devices were also encrypted for GDPR purposes .