Skip to main content
Question

FileVault 2 Deferred Enablement - El Capitan

  • October 7, 2015
  • 34 replies
  • 149 views
U
Forum|alt.badge.img+12

Have any of you guys had issues with FileVault 2's deferred enablement feature since upgrading to El Capitan?

Here's the scenario I'm running into so far: Mac had FileVault 2 successfully deployed and encrypted via Casper using deferred enablement while running 10.10.x. Mac is then upgraded to 10.11.0. Filevault 2 is disabled via System Preferences and is allowed to fully decrypt. Running "fdesetup status" shows the following.

FileVault is Off. FileVault master keychain appears to be installed. Deferred enablement appears to be active for user 'username'.

And "fdesetup showdeferralinfo" shows this.

{ AskAtUserLoginMaxBypassValue = 0; CertPath = stdin; Certificate = <CERTIFICATEINFOGOESHERE>; Defer = 1; DontAskAtUserLogout = 1; OutputPath = "/Library/Application Support/JAMF/run/file_vault_2_recovery_key.xml"; Usernames = ( "username" ); }

Which these results should imply that when this username logs back in it should prompt them to enable FileVault 2, which it does not...

I've ran "fdesetup disable" and have confirmed that the status and showdeferralinfo commands show that FileVault is off and no deferral is set. I've then run the same FileVault 2 policy that we currently use with Yosemite and the deferred user continues to log in without a prompt after multiple reboots.

So far I've replicated this behavior on two Macs. I will be testing initial deferred FileVault 2 deployment to a freshly imaged 10.11 machine once I have an image prepared.

Has anyone else seen something like this with El Cap yet?

    34 replies

    A
    Forum|alt.badge.img+18
    • alexjdale
    • Contributor
    • October 7, 2015

    Same here, I posted this a couple minutes earlier: https://jamfnation.jamfsoftware.com/discussion.html?id=17283

    I saw this issue with a new image this morning, so it was not caused by an upgrade. It may be an OS defect.

    A
    Forum|alt.badge.img+18
    • alexjdale
    • Contributor
    • October 7, 2015

    It appears that deferred "at login" mode works for local accounts, but does not trigger at login for Active Directory accounts. This must be an OS defect.

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • October 7, 2015

    An OS defect around Active Directory accounts?? Inconceivable! Can't be, when has Apple ever done that!?

    </sarcasm>

      A
      Forum|alt.badge.img+18
      • alexjdale
      • Contributor
      • October 19, 2015

      Bumping this in case anyone has gotten it to work with AD/mobile accounts, I am surprised this isn't being talked about much. It's very nearly a showstopper issue for us if we can't force FV to be enabled.

      U
      Forum|alt.badge.img+12
      • UESCDurandal
      • Author
      • Valued Contributor
      • October 19, 2015

      This certainly seems like an OS X bug. I wouldn't be surprised if this doesn't work correctly until 10.11.1 is released.

      Has anyone tried this with the latest developer/beta builds of 10.11.1? I'm in no hurry to test it out myself.

      A
      Forum|alt.badge.img+18
      • alexjdale
      • Contributor
      • October 19, 2015

      I have, and it is still not working on the latest beta.

      I just submitted a bug with Apple as well as opened a case with JAMF.

      G
      Forum|alt.badge.img+16
      • gachowski
      • Honored Contributor
      • October 20, 2015

      Sorry I missed this .....

      Yes it's an Apple bug... it stopped working on the 2nd to last El Capitan beta... I filled with Apple day one of GMC beta...not fixed in X.11.1 either...(yet)

      C

      Jamf has a defect # too : )

      K
      Forum|alt.badge.img+8
      • kirkmshaffer
      • Contributor
      • October 21, 2015

      We're kind of seeing this here with El Cap. The user gets the prompts as they're exiting: logging out, shutting down, shutting down to restart. But they are not getting the forced enrollment at login like they do in Yosemite.

      The Disk Encryption Configuration shows up in the inventory, but the institutional key is not present, the individual key is unknown, and the state is unencrypted (as expected).

      Tested to most recent developer preview.

      G
      Forum|alt.badge.img+16
      • gachowski
      • Honored Contributor
      • October 21, 2015

      @Shaffer

      Yep deferred next log in doesn't work and deferred next log out only half works : )

      If you have a Apple support please open a ticket so we can drive the number of effected machines up, so it get fixed faster : )

      C

      A
      Forum|alt.badge.img+18
      • alexjdale
      • Contributor
      • October 21, 2015

      Edit: how do I delete a post?

      K
      Forum|alt.badge.img+8
      • kirkmshaffer
      • Contributor
      • October 21, 2015

      Just opened a ticket with Apple, so I'm on the bandwagon :)

      G
      Forum|alt.badge.img+16
      • gachowski
      • Honored Contributor
      • October 21, 2015

      Thanks @Shaffer !!!

      C

      K
      Forum|alt.badge.img+16
      • Kaltsas
      • Valued Contributor
      • October 27, 2015

      I also have opened a support ticket with Apple.

      K
      Forum|alt.badge.img+8
      • kirkmshaffer
      • Contributor
      • October 28, 2015

      Sorry about the vague response but... Anyone else have a developer account? Anyone else feeling better about this after yesterday?

      A
      Forum|alt.badge.img+18
      • alexjdale
      • Contributor
      • November 2, 2015

      I am feeling better about this now, yes.

      G
      Forum|alt.badge.img+16
      • gachowski
      • Honored Contributor
      • November 2, 2015

      : ) me too.. still have a few thing to keep testing : )

      G
      Forum|alt.badge.img+10
      • ghsimon
      • Contributor
      • November 3, 2015

      re: Schaffer Anyone else feeling better about this after yesterday?

      What occurred on 10/27 that might have made anyone feel better about this problem? I don't see any updates from Apple on that day.

      I am still running into this problem and would like to get clued in as to what might help fix it.

      G
      Forum|alt.badge.img+16
      • gachowski
      • Honored Contributor
      • November 3, 2015

      X.11.2 public beta

      G
      Forum|alt.badge.img+10
      • ghsimon
      • Contributor
      • November 4, 2015

      Thanks, I will have to try it...

      T
      Forum|alt.badge.img+14
      • tthurman
      • Valued Contributor
      • November 5, 2015

      Not sure if you guys are aware or not, but I figured I'd let you all know, JAMF has a RADAR open with apple about this issue.

      RADAR #22839220

      Apple said this in response to my request of the info for that RADAR.

      The radar you provided is regarding FileVault 2 deferred enablement does not work on LDAP users, the users did not receive any prompts. 'fdesetup status' will report that FileVault is in "deferred enablement" but logging in will not trigger the FV2 credentials prompt.

      Regards,
      TJ

      V
      Forum|alt.badge.img+5
      • Vitamin-Z
      • Contributor
      • December 3, 2015

      Just ran into this issue as well. Glad to see I'm not the only one suffering :P

      K
      Forum|alt.badge.img+16
      • Kaltsas
      • Valued Contributor
      • December 3, 2015

      This does appear to be resolved in the latest 10.11.2 beta. It has been triggering successfully in all my tests.

      V
      Forum|alt.badge.img+5
      • Vitamin-Z
      • Contributor
      • December 3, 2015

      Great! I hope that the general release is a week or two away.

      B
      Forum|alt.badge.img+15
      • bmarks
      • Contributor
      • December 3, 2015

      What setting do you have selected in the Disk Encryption section of your policy? There's another thread, but this all does work if you have "at next logout" selected. Just to be clear, this is separate from the policy trigger. In our testing with Apple and JAMF, only "recurring check-in" and "custom" triggers work to trigger our FileVault policy.

      This has been working for us the entire time since El Capitan was released (and before, to be honest.) However, it took us an embarrassingly long time to figure out that simply toggling that setting in the Disk Encryption section was the fix.

      B
      Forum|alt.badge.img+15
      • bmarks
      • Contributor
      • December 3, 2015

      Also, we had to add an additional inventory collection policy to occur at next boot so that all of the fields would populate in the JSS. For our purposes, we did this as an additional policy so that it'd only apply to a subset of our Macs and not cause too many Recons. It appears that adding inventory collection to the policy itself when it's configured this way causes inventory collection to get interrupted so the keys, etc. don't get uploaded until the next inventory collection interval. And, depending on your environment, if that next Recon waits too long, they key info actually disappears and can't be uploaded. The other thread isn't sure how long that window is, however.

      Terms & ConditionsCookie settingsAccessibility statement