Mavericks FileVault 2

"can I get Casper to re-mediate this by either enabling the admin account" : in our company, we use a script with a GUI that nags the user for his domain password, then pass temporary the info to a plist file, used as argument for fdesetup binary. This add our administrative account to list of existing FV users (we do not use the built-in Jamf FV feature to add users or stuff like this).

This way, it supports both scenarios : FV enabled by users themselves, and FV enabled by Casper.

Apple removed in 10.9.x the ability for a script running under root, to be able to add/remove list of FV users. So now, you can maintain this list only if you know the recovery key, or the password of one of the users being already in FV user list :-(.

Our IT technicians have access to a home-made web interface (access limited by AD group obviously), where they can generate unique-per-computer passwords for this administrative account, to unlock disks without having user's password, and to avoid to have a generic admin password that may be used on all of our Macs.

Adding technicians directly to list of FV users on each machine, is not feasible.

Thanks Olivier, looks like as long as Casper initiates the encryption (which will be the case in 99.9% of scenarios) I can create and update a local admin user which is FV2 enabled via Casper. The difficult bit is going to be managing that local admin password!

Any chance you could share that script Olivier? Sounds very similar to what we're trying to do.

I will answer as much I can:
1:It depends, if you have recovery key in JSS, it is possible. Otherwise it is not possible to enable the admin account unless you know the current user password, which is also impossible. You might want to check fdesetup command in Osx. Capturing recovery key is only can be captured once the machine start to encrypt. Not possible to get it afterwards
2: First you need to create a configuration profile which will redirect recovery key automatically to JSS. Then you can use policy to add a local admin user, remember to add it to FV2 and allow it to administrator the computer.
3: If you want to prevent user to unlock FV2,You can use configuration profile->restriction->Restrict items in System Preferences, choose security and privacy. 4:definitely decrypt first is the best solution I know of.
Let me know if you have any more questions.