Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I recently performed a clean install of Lion on one of my Macs. The installation process created one administrative user account. After installation, I enabled FileVault for the entire disk. Then, I created an additional administrative user. Both users are able to decrypt the drive during login.

How would I revoke decryption rights to one of the users without deleting the user or temporarily disabling FileVault? I have tried revoking one user's administrative privilege, making them a regular user, but they are still able to decrypt the drive during boot.

share|improve this question
    
Since that user's home folder is stored on an encrypted disk (as well as all of the Applications) you might as well suspend that user account if the disk will remain encrypted. Perhaps I'm missing something - but it seems literally impossible to do. –  bmike Jul 23 '11 at 21:48
    
This is not an answer, just some background information to help us find an answer. I just don't have the rep to comment yet. This should actually be possible, provided that we can find the place to change the permissions. In Apple's July 22, 2011 support article ["OS X Lion: About FileVault 2"][a], they state the following: > Users not enabled for FileVault unlock will only be able to log in to that Mac after an unlock-enabled user has started or unlocked the drive. Once unlocked, the drive remains unlocked and available to all users, until the computer sleeps, hibernates, or is shut down. H –  Herb Mann Jul 24 '11 at 1:20
    
If the computer already has multiple user accounts when you enable FileVault2, then it will ask you which users you would like to allow to decrypt the drive during boot. So, it is possible for only some user accounts to have access. If you have users Amy and Barry, and only give access to Amy, she would have to log in during boot before Barry can switch to his account. You may be right that it may be impossible to do given my restrictions, but I'm not giving up yet. :-) –  kccricket Jul 24 '11 at 11:05
    
Wow - it looks like I need to study up more before saying impossible :-) I could see how this would be accomplished by storing a key (rather than the password) in those user's keychain. Have you looked there to see if it's as simple as that? –  bmike Jul 24 '11 at 13:42
    
I found one article that claims the decryption key is stored in the user's keychain. I can't find any evidence of that in either the login or System keychains. In any case, that wouldn't make sense, since the keychains are stored on the encrypted partition. There'd be no way to get to them without first decrypting the drive. I read one article (can't find it now) that claimed the encryption key is stored on the recovery partition, but I've looked through that and couldn't find anything noteworthy. It's quite a conundrum. –  kccricket Jul 24 '11 at 15:22

4 Answers 4

up vote 11 down vote accepted

Use fdesetup:

sudo fdesetup remove -user username

See: http://derflounder.wordpress.com/2012/07/25/using-fdesetup-with-mountain-lions-filevault-2/

share|improve this answer
    
This is correct for Mountain Lion, although I am not sure 1) that it works for Lion or 2) was available in Lion when the question was originally asked. –  TJ Luoma Jul 22 '13 at 17:06
    
This works on Mavericks as well –  Devon_C_Miller Apr 3 at 0:59

It is not impossible. (Although if you have deleted user you may have made this more complicated!)

I wrote the article 'jaydisc' linked to and just tested that it still works in 10.7.4:

Assume that you have an admin user 'charlie' that you want to be able to use, but not unlock, the computer:

sudo su - charlie  
$ passwd 
Changing password for charlie.
Old Password:**[enter old password here]**
New Password:**[press enter]**
Retype New Password:**[press enter]**
$ 

Note that you cannot do this:

sudo passwd charlie
Changing password for charlie.
New password:

because if you press enter when you get the 'new password prompt' it will come back and say:

Password unchanged.
share|improve this answer

It looks like temporarily removing the users' passwords removes them from the EFI boot menu:

http://www.tuaw.com/2011/12/12/prevent-certain-accounts-from-unlocking-filevault-2/

Unfortunately, in my case, some of the users are Open Directory Mobile users, and I am unable to find out a way to set their password to empty.

share|improve this answer

FileVault 2 and Recovery HD

Recovery HD not to be confused with the Recovery OS (one is greater than the other).

When you enable FileVault 2 for a user: the non-encrypted hidden Apple_Boot Recovery HD partition, separate from but critical to the encrypted startup volume, is temporarily mounted for writes to EFI-related and other files. If you wish to view this file system activity, whilst enabling a user for unlock purposes:

  • before clicking Done, use a command such as fs_usage or an application such as fseventer.

A glance at the activity suggests that edits to the non-encrypted volume — in relation to the user account on the encrypted volume — are nontrivial.

If a user is given inappropriate authority to unlock

Maybe an update to Lion (something greater than Build 11A511) will provide a way to remove, from the EFI loginwindow, a user who should no longer be able to unlock the startup volume.

In the meantime I can think of only two methods that may be used.

Method A: disable then enable FileVault

  1. disable FileVault 2

  2. allow backward conversion to complete

  3. restart the operating system

  4. enable FileVault 2, but not for that user.

Method B: remove the user but not the home directory, et cetera

I have not tested this method, I imagine that the following might work:

  1. backup

  2. remove the user but not the user's home directory

  3. restart the operating system

  4. create a new user with the same RecordName as the original

  5. set a UniqueID number that differs from the original

  6. associate the previous home directory with the new user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.