I have an iMac 2017 with a FusionDrive on which FileVault cannot not be enabled. The situation is summed up in this reddit post. The problem boils down to: I have no admin user who has a secure token and it seems like I cannot get one. This can be confirmed by running:
sysadminctl interactive -secureTokenStatus USER_NAME
for every user. It always comes back with
Secure token is DISABLED for user USER_NAME
The first setup from factory settings did not result in a user with a Secure Token, and I tried to:
/var/db/.AppleSetupDoneto setup a new admin account. Result: A new admin account that slo does not have a token.
- Reinstall MacOS High Sierra: First created admin user does not have secure token.
It seems that this is either intentional (because of the Fusion Drive?) or a bug in High Sierra. With exactly the same procedure on a Macbook Pro 2017 I get an admin user with a Secure Token and that user can manage FileVault and give secure tokens to other users.
Since I want to use FileVault, I also tried to reformat the main disk with an encrypted file system, reinstalling MacOS and restoring from time machine backup. This worked, FileVault is enabled, but now I have to enter the disk password every time the computer boots (before the login screen). I don't want this, I want to unlock the disk with a user password.
What can I do to get an admin user with a secure token?