Relution Signet Customer Hub

FileVault

With the FileVault configuration for macOS devices, full-disk encryption is enabled centrally on managed Macs. The configuration can be added once per policy and is only available for devices with device enrollment, not for devices with User Enrollment →.

Time of activation

With the default settings, the following applies:

  • Defers enabling FileVault until the designated user logs out. is enabled.
  • Do not request enabling FileVault when user logs out is disabled.
  • The maximum number of times users can bypass enabling FileVault is 0.

The user is then asked to enable FileVault at the next logout. At the latest, enabling is required at the next login.

A value greater than 0 (at most 9999) allows the corresponding number of bypasses. With -1, enabling is not enforced at login. If Do not request enabling FileVault when user logs out is enabled, the request at logout is omitted. Both sub-options are only available while deferring is enabled. If deferring is disabled, the user name and password of a user must be specified in the profile.

Settings

The General section provides the following settings:

  • FileVault status: On enables FileVault, Off disables it (required, default On).
  • Recovery key type: institutional and personal recovery key, institutional recovery key only, or personal recovery key only. An institutional key requires a Certificate.
  • Recovery key path: location for the recovery key and the computer information, e.g. /Library/Keychains/recovery.plist.
  • Allow displaying the personal recovery key after enabling FileVault on the device: defines whether the personal key is shown to the user after activation.
  • FileVault Open Directory user and Password: user to be added to FileVault. Alternatively, Enable to prompt for missing user name or password has the device prompt for missing information.
  • Options for deferring the activation (see above).

In the Personal recovery key handling section, Allow that Relution can access the personal recovery key defines whether Relution stores the personal recovery key (default: enabled). The key can then be retrieved in the device details in the Security card under FDE personal recovery key. This is only possible if the option was already enabled before FileVault was activated; if FileVault is already enabled on the Mac, the option has no effect.

The Additional options section provides Prohibit the deactivation of FileVault, Prohibit the activation of FileVault and Delete FileVault key on standby.

Deployment via Automated Device Enrollment (ADE)

The FileVault configuration can be deployed via Automated Device Enrollment (ADE, DEP in the portal) before or during Setup Assistant, so it is already present when the device starts up for the first time. Since deriving the encryption key requires a user account and its login password, actual encryption cannot begin until after a user account has been created and that user has logged in for the first time.

If Relution is to store the personal recovery key, the configuration with Allow that Relution can access the personal recovery key enabled must be on the device before FileVault is activated. In the DEP profile, the FileVault step of Setup Assistant can be skipped. Relution does not support forcing FileVault activation in Setup Assistant.