How can I push the filevault prompt on an already enrolled device?

[landscaperose]

There is a user who has an unencrypted internal drive. His jamf profile should be requiring him to enable FileVault. However, we he restarts or logs out of his device, he is not prompted for FileVault to be enabled. He is already enrolled in jamf but the "Install Configuration Profile Disk Encryption" is stuck as pending. I've tried sending a blank push. 

Is there a way to push this policy so they are encrypted without having to unenroll and re-enroll their MacBook? They are on an Intel Mac.

[jamf-42]

Config profile for FileVault should be set to login, not log out. This forces it to be set. If the profile is stuck, remove the devices from scope, save, then add back. Don't restart. Get the user to log out and then log back in.

[landscaperose]

The profile is set to be activated on login. How can I remove it form scope for just this one device, save, then add it back? Thank you very much for your help.

[jamf-42 · Accepted solution]

add the device to exclusions... then save and select 'Distribute to Newly Assigned Devices Only' 

check logs / device history

then remove from exclusions... and save again as above.. 

[easyedc]

Another option if you're able to ask the user to manually do this action is to create a self service policy with a FileVault action.  As long as your FileVault settings are correct, it will redirect the key back to your JSS.

[easyedc]

It goes without saying that you could make this an automatic action by giving it a normal trigger vs self service.

[AJPinto]

Run fdesetup status on his device and see what state it is in. There is a chance its deferred waiting on another user (like your local admin account). I have an EA checking the FV state on devices, and if they are in an "errored" state it will swap configuration profiles to disable, and re-enable filevault which usually clears any "errored" states like deferred enrollment.

Also, with it being just one device, may be a good idea to just enable FileVault manually and move on.

[landscaperose]

If I manually enable FileVault, How can I get the escrow key back in Jamf?