Client status shows that FileVault isn't managed

Technical Articles ID: KB89825
Last Modified: 2022-10-10 06:07:57 Etc/GMT

Environment

Management of Native Encryption (MNE) 5.x, 4.x

For details of MNE-supported environments, see KB79375 - Supported platforms for Management of Native Encryption.

Problem

FileVault can't be managed after you successfully install MNE and enable the following policy options:

Turn on (Enable) FileVault
Prompt user to create a recovery key on already enabled systems

The status of FileVault reported at the ePolicy Orchestrator (ePO) console remains disabled.

This problem is seen on systems where the FileVault password and the Mac User Logon password are different.

Authentication fails when the user is prompted to enter the MNE FileVault password. Authentication also fails after the user tries to enter the User Logon password.

NOTES:

The user expects to enter the FileVault password when the following policy options are enabled:

Prompt user to create a recovery key on already enabled systems
The above policy option is described as follows in the FileVault Product Settings table in the MNE Product Guides:

If FileVault is already enabled when the MNE policy is enforced, the client system prompts the user to authenticate using their FileVault password. Once authenticated, the recovery key of the client system can be queried from FileVault and is escrowed to the ePO database.
If users ignore this request, recovery of their system can't be achieved, as no recovery key can be escrowed to ePO; FileVault only releases the current recovery key if authentication is provided.

Cause

The above behavior is as expected.

MNE doesn't accept the FileVault password in the following scenarios:

When trying to manage and take over FileVault
When the Mac User Logon password is not the same as the FileVault password

Solution

Make sure that the FileVault and User account password are in sync. Use the solution appropriate for your system setup:

High Sierra (without Apple File System [APFS]) and earlier:

Open System Preferences from the Apple menu.
Click Security & Privacy, General, Change Password.
Enter the existing user account password and a new password.
Restart the system.

After a system restart, both FileVault and User Account passwords are now in sync. When logging on, the user only has to enter their password once.

High Sierra (with Apple File System [APFS]) and later:

NOTE: To sync the FileVault and User Account password on High Sierra with APFS, the user must have sudo permissions:

Open a terminal session and type the following command and press Enter:

sudo fdesetup list
Enter the sudo password.
Make a note of the user's Universally Unique Identifier (UUID)

NOTE: The identifier is a 36-character alphanumeric string of the form: 95CC956D-4201-494A-A981-9B6FBBD6BE5F.
In the terminal window, type the following command and press Enter:

diskutil list

Make a note of the identifier for the APFS volume with the name of the boot volume.

For example, if the boot volume is called Macintosh HD, the Identifier for the following output would be as shown below:

↵

disk1s1 /dev/disk0 (internal, physical):
#:	TYPE NAME	SIZE	IDENTIFIER
0:	GUID_partition_scheme	*42.9 GB	disk0
1:	EFI	209.7 MB	disk0s1
2:	Apple_APFS Container disk1	42.7 GB	disk0s2

/dev/disk1 (synthesized):
#:	TYPE NAME	SIZE	IDENTIFIER
0:	APFS Container Scheme - Physical Store disk0s2	+42.7 GB	disk1
1:	APFS Volume Macintosh HD	13.4 GB	disk1s1
2:	APFS Volume Preboot	19.8 MB	disk1s2
3:	APFS Volume Recovery	519.7 MB	disk1s3
4:	APFS Volume VM	20.5 KB	disk1s4

In the terminal window, type the following command and press Enter:

diskutil apfs changePassphrase -user

NOTE: In the above example, the Identifier is disk1s1 and UUID is 95CC956D-4201-494A-A981-9B6FBBD6BE5F.
Enter the old FileVault password.
Enter the current User Account password as the new password.

After a system restart, both FileVault and User Account passwords are now in sync. When logging on, the user only has to enter their password once.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Client status shows that FileVault isn't managed

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Client status shows that FileVault isn't managed

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title