Help

Zero Touch and No User Interaction regarding FileVault

jmancuso
New Contributor III

Posted on ‎04-13-2022 05:16 AM

Hey Y'all! 

We wanted to remove the user option to hit enable or cancel when imaging a Jamf Connect / Zero Touch machine. On the onboarding, our goal was to move to a user onboarding and a computer that can come straight from the factory or vendor with an imaging ready to load. Allowing the user to decide if the machine was going to be encrypted or not was not something we wanted. Below is how we remove that option and encrypt our machines. 

Getting Started:

You need:

The flat Package method: https://github.com/sean-rabbitt/JamfConnectMetaPackageSample/blob/main/JamfConnectMetaPackage.pkg (this is not totally needed, but we are wrapping the jamf connect pkg and assets in the above wrapper) 

Jamf Connect Configurator (This is where we apply FV settings - no escrow) 

Starts with the Zero Touch Presatge: 

In that prestage you'll select the encryption, but we dont escrow the key. This is in the Pkg Settings we configure in Jamf Connect Configurator. 

Create a Configuration profile to only escrow the key. Scope to a Smartgroup of these machines. 

 

In your Imaging for Zero Touch, Apply a policy at the end that restarts the machine and run recon to checkin.  

The Configuration profile hits first and says hey when we get a key we'll escrow it. Then the FV gets turned on by prestage (in our pkg) and the restart and checkin is what gets rid of the need of an end user having to go to system preferences and turn on FV. 

Tested with Jamf and myself. It removes the user interaction and encrypts our machines. 

 

 

1 REPLY 1

DaneAbernathy
New Contributor III

Posted on ‎04-20-2022 06:50 AM

I'm just starting to get really familiar with Jamf Connect Login, but I am pretty sure the Jamf connect login can handle all this in the configuration profile with no restart needed and no prompts for the user. You can turn on FV and store the key local within the config profile for Jamf connect login. Then you can ensure it is escrowed with another profile with FV key escrow settings so that it automatically generates the cert needed to pass the key up to Jamf. 

Someone can correct me if I am wrong, but I have had success with this in my testing. 

 

Here are the keys/values for Jamf COnnect Login:

 

    <key>EnableFDE</key>
    <true/>
    <key>EnableFDERecoveryKey</key>
    <true/>
    <key>EnableFDERecoveryKeyPath</key>
    <string>/usr/local/filevault</string>

 

0 Kudos