29

I recently performed a clean install of Lion on one of my Macs. The installation process created one administrative user account. After installation, I enabled FileVault for the entire disk. Then, I created an additional administrative user. Both users are able to decrypt the drive during login.

How would I revoke decryption rights to one of the users without deleting the user or temporarily disabling FileVault? I have tried revoking one user's administrative privilege, making them a regular user, but they are still able to decrypt the drive during boot.

8
  • Since that user's home folder is stored on an encrypted disk (as well as all of the Applications) you might as well suspend that user account if the disk will remain encrypted. Perhaps I'm missing something - but it seems literally impossible to do.
    – bmike
    Jul 23, 2011 at 21:48
  • This is not an answer, just some background information to help us find an answer. I just don't have the rep to comment yet. This should actually be possible, provided that we can find the place to change the permissions. In Apple's July 22, 2011 support article ["OS X Lion: About FileVault 2"][a], they state the following: > Users not enabled for FileVault unlock will only be able to log in to that Mac after an unlock-enabled user has started or unlocked the drive. Once unlocked, the drive remains unlocked and available to all users, until the computer sleeps, hibernates, or is shut down. H
    – Herb Mann
    Jul 24, 2011 at 1:20
  • If the computer already has multiple user accounts when you enable FileVault2, then it will ask you which users you would like to allow to decrypt the drive during boot. So, it is possible for only some user accounts to have access. If you have users Amy and Barry, and only give access to Amy, she would have to log in during boot before Barry can switch to his account. You may be right that it may be impossible to do given my restrictions, but I'm not giving up yet. :-)
    – kccricket
    Jul 24, 2011 at 11:05
  • Wow - it looks like I need to study up more before saying impossible :-) I could see how this would be accomplished by storing a key (rather than the password) in those user's keychain. Have you looked there to see if it's as simple as that?
    – bmike
    Jul 24, 2011 at 13:42
  • I found one article that claims the decryption key is stored in the user's keychain. I can't find any evidence of that in either the login or System keychains. In any case, that wouldn't make sense, since the keychains are stored on the encrypted partition. There'd be no way to get to them without first decrypting the drive. I read one article (can't find it now) that claimed the encryption key is stored on the recovery partition, but I've looked through that and couldn't find anything noteworthy. It's quite a conundrum.
    – kccricket
    Jul 24, 2011 at 15:22

5 Answers 5

39

Use fdesetup:

sudo fdesetup remove -user username

See: http://derflounder.wordpress.com/2012/07/25/using-fdesetup-with-mountain-lions-filevault-2/

7
  • This is correct for Mountain Lion, although I am not sure 1) that it works for Lion or 2) was available in Lion when the question was originally asked.
    – TJ Luoma
    Jul 22, 2013 at 17:06
  • This works on Mavericks as well Apr 3, 2014 at 0:59
  • 3
    And it also works on OS X 10.10 Yosemite. Aug 2, 2014 at 16:20
  • 1
    sudo fdesetup remove -user username works on macOS 10.12 Sierra, too!
    – jaume
    Oct 2, 2016 at 11:36
  • 1
    sudo fdesetup remove -user username Works for macOS 10.13 High Sierra, too.
    – Kappa
    Oct 8, 2017 at 21:28
4

It is not impossible. (Although if you have deleted user you may have made this more complicated!)

I wrote the article 'jaydisc' linked to and just tested that it still works in 10.7.4:

Assume that you have an admin user 'charlie' that you want to be able to use, but not unlock, the computer:

sudo su - charlie  
$ passwd 
Changing password for charlie.
Old Password:**[enter old password here]**
New Password:**[press enter]**
Retype New Password:**[press enter]**
$ 

Note that you cannot do this:

sudo passwd charlie
Changing password for charlie.
New password:

because if you press enter when you get the 'new password prompt' it will come back and say:

Password unchanged.
3

It looks like temporarily removing the users' passwords removes them from the EFI boot menu:

http://www.tuaw.com/2011/12/12/prevent-certain-accounts-from-unlocking-filevault-2/

Unfortunately, in my case, some of the users are Open Directory Mobile users, and I am unable to find out a way to set their password to empty.

2

FileVault 2 and Recovery HD

Recovery HD not to be confused with the Recovery OS (one is greater than the other).

When you enable FileVault 2 for a user: the non-encrypted hidden Apple_Boot Recovery HD partition, separate from but critical to the encrypted startup volume, is temporarily mounted for writes to EFI-related and other files. If you wish to view this file system activity, whilst enabling a user for unlock purposes:

  • before clicking Done, use a command such as fs_usage or an application such as fseventer.

A glance at the activity suggests that edits to the non-encrypted volume — in relation to the user account on the encrypted volume — are nontrivial.

If a user is given inappropriate authority to unlock

Maybe an update to Lion (something greater than Build 11A511) will provide a way to remove, from the EFI loginwindow, a user who should no longer be able to unlock the startup volume.

In the meantime I can think of only two methods that may be used.

Method A: disable then enable FileVault

  1. disable FileVault 2

  2. allow backward conversion to complete

  3. restart the operating system

  4. enable FileVault 2, but not for that user.

Method B: remove the user but not the home directory, et cetera

I have not tested this method, I imagine that the following might work:

  1. backup

  2. remove the user but not the user's home directory

  3. restart the operating system

  4. create a new user with the same RecordName as the original

  5. set a UniqueID number that differs from the original

  6. associate the previous home directory with the new user.

0

Here is the very simple answer on how to disable a previously enabled user's access to a FileVault 2 encrypted drive:

In terminal, use:

sudo fdesetup remove -user Username

You will see thereafter the disabled user in the list of users that are available for enabling in System Preferences->Security & Privacy -> FileVault as verification that the disabling was successful

1
  • 3
    How does this differ from the accepted answer?
    – nohillside
    Feb 11, 2016 at 8:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .