Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have FileVault enabled with two users:

  • AdminGuy
  • OtherGuy.

I want AdminGuy to:

  • have the ability to unlock the HD, and therefore only he can enter a u/n + p/w at boot to start boot up
  • have the ability to log in
  • not be logged in automatically.

In other words: can AdminGuy just unlock the drive, but then have a login screen popup so OtherGuy could choose to login instead?

10.8.

Per @DeepanshuUtkarsh's link, this is the behavior I want to change:

The user account that unlocked the drive will be logged into their own account after start up completes, without needing to log in again.

If you want to make the Mac available to a user that does not have unlock capabilities, log in, then when you see your own desktop, choose "Log Out (user name)" from the Apple () menu. Also, you can unlock the disk, then choose the other user's name from the Fast User Switch (appears as the currently-logged in user's name) menubar item in the upper-right part of the screen.

share|improve this question
add comment

4 Answers 4

up vote 7 down vote accepted

Encrypt the startup volume with Core Storage without FileVault

Two days after I added this answer, Apple published a technical white paper: Best Practices for Deploying FileVault 2 – Deploying OS X Full Disk Encryption Technology (PDF). At a glance, some of what I describe below seems to be described by Apple as:

  • Disk Password—based DEK.

Preparation

  1. Backup
  2. start Recovery OS
  3. use Disk Utility to erase the startup volume – Mac OS Extended (Journaled, Encrypted)
  4. restore
  5. give the passphrase for the volume to AdminGuy.

Hint

At step 4 above, use a method that preserves the Apple_Boot slice (sometimes named Boot OS X, sometimes named Recovery HD) whilst restoring the JHFS+ startup volume.

To validate this answer, I used Disk Utility for that step. (I'm less familiar with restoration capabilities of Time Machine.)

The resulting EfiLoginUI:

Disk Password option at EfiLoginUI

As Disk Password has an avatar/icon, it's clear that Apple considers scenarios such as this.

Normal use thereafter

  1. Alongside named users, EfiLoginUI presents Disk Password
  2. AdminGuy can select Disk Password
  3. AdminGuy can enter the passphrase to unlock the CoreStorage-protected startup volume
  4. when loginwindow appears, select the required user.

Users may change their login passwords. The phrase for Disk Password will remain unchanged.

You need not use the FileVault areas of System Preferences but if you do, most things work as expected.

The machine pictured above is perfectly clean, restored from a Mountain Lion template that I created following installation of the OS (at the Welcome screen I shut down, then used Disk Utility to image all partitions/slices of the disk). I proceeded to create a user, then enabled that user for FileVault:

Screenshot: some users are not able to unlock the disk. Screenshot: the OS presents a tick against the one and only user Screenshot: after clicking 'Done', all users are able to unlock the disk

The resulting EfiLoginUI – one named user alongside the Disk Password option:

A named user and the Disk Password option at EfiLoginUI

Appearance bug

System Preferences in Build 12A269 of OS X 10.8 may state that FileVault is enabled, with a recovery key set, when the key is no longer applicable. (Assume that an erased volume, with a possibly different passphrase, will not accept a recovery key that was set before erasure. A more definite opinion may be drawn from Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption (2012).) I have reported bugs to Apple.


Photographs above are of the USB flash drive that I used to validate this answer.

Photographs below are of the internal drive that I use every day.

EfiLoginUI – two named users enabled for FileVault, the Disk Password option, and the Guest User:

my everyday EfiLoginUI

loginwindow – all named users:

my everyday loginwindow

share|improve this answer
    
I don't want to prevent AdminGuy from logging in. I want to prevent him from automatically being logged in after unlocking the machine. –  Philip Aug 15 '12 at 13:01
    
This seems clever, but seems like it could be unstable / not robust to updates. Do you know of a more standard, mainstream, higher-guarantee-of-compatibility solution? –  Philip Aug 15 '12 at 19:48
1  
It's stable – a normal result of encrypting a volume before installing (or restoring) the OS to that volume. I've been doing this for a while. OS and other updates are no problem. –  Graham Perrin Aug 15 '12 at 20:05
    
This seems reasonable. I'll give it a shot next time I'm by an external HD. –  Philip Aug 18 '12 at 22:28
    
I haven't had a chance to try this yet, and now my needs have changed, but I'm persuaded by the detail in the solution. –  Philip Oct 18 '12 at 21:27
add comment

When you turn on FileVault, you can select which accounts have the right to unlock the drive. From there you can choose the AdminGuy account as the only authorised account. As for auto-login, after you turn on FileVault, automatic login is turned off.

So you just have to enable FileVault normally and you will get your answers through the process.

share|improve this answer
    
I've already chosen only AdminGuy as authorized, but after he authenticates at bootup, it logs him in as well. –  Philip Aug 7 '12 at 14:15
1  
Have you tried explicitly disabling automatic login? –  duci9y Aug 7 '12 at 14:22
    
Automatic Login is (and has been) off. –  Philip Aug 7 '12 at 21:10
1  
This works for me, I don’t know why it doesn’t work for you. Refer to this article for more help: support.apple.com/kb/HT4790?viewlocale=en_US&locale=en_US –  duci9y Aug 8 '12 at 8:45
    
This is a good link, but it specifically describes as intended the behavior I'm trying to modify (see edit in Q) –  Philip Aug 10 '12 at 13:12
show 2 more comments

Before you re-install the OS, use Diskutility to create the partition you want to install the OS on, make sure you create the partition encrypted and that the passphrase is the desired one. After that:

  1. Install OS on the encrypted partition.

  2. Create the first account "the administrator account".

  3. Add normal or admin users.

  4. Use terminal to remove the admin user and the other users enabled with the account. (Should look like this): sudo fdesetup remove -user "username"

  5. Restart to make sure only the DEK Disk Password login is available at boot up.

share|improve this answer
add comment

System Preferences > Users & Groups > Login Options > Automatic login: Off

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.