1

I want my MBP to be unlocked with Disk Encryption Password before getting access to the login screen. (read : I want to have two passwords prompts before the MBP can be used)

Therefore, I made a clean (re)install of High Sierra and chose APFS Encryted. However the subsequent created admin account has a security token, which seems to be my issue. Now on startup I have the choice between the admin account and the Disk Encryption Password for others accounts with a disabled Token.

I tried the following :

  1. Tried to remove myself (aka admin) from having the Secure Token with sysadminctl -secureTokenOff admin but I end up with the following error : Operation not permitted without a secure token unlock.

However I do well have a one (sysadminctl -secureTokenStatus admin shows ENABLED)

  1. Tried to remove myself from being able to unlock the disk with fdesetup remove -user admin but as I'm the only user, I got the following User could not be removed because it's the last OS user on the Volume

In short, how can I force the Disk Encryption Password prompt for ALL users, including admins ?

It makes echo to this post : Prompt for encrypted disk password on startup

Note : On a buggy install of HighSierra, I ended up with an admin account without Security Token, and it worked as intended. I had to go through the Disk Encryption Password prompt before anything else. However I re-installed MacOS because this situation made me unable to access the terminal from the MacOS Recovery (I had a error message saying that no admin with the correct statuts (read Token) with was found on the system)

Improve this question
4
  • Are you asking how to turn on FileVault or modify how FileVault works?
    – bmike ♦
    Apr 30, 2019 at 11:20
  • I'm asking how to turn on FileVault with no users being able to decrypt the disk unless they enter the Disk Encryption Password (supposing we choose one or a decryption key, meaning a different one than the defaut Icloud password). Turning on Filevault by itself does not force the admin to go through such password as their own password decrypts the disk.
    – Orion34
    Apr 30, 2019 at 15:20
  • 1
    Why a downvote ? If something is not well explained I will edit my question.
    – Orion34
    Apr 30, 2019 at 15:21
  • Cool - so this is how to change the defaults. By default, everyone that’s enabled gets to decrypt the volume. I’ll propose a hack / workaround, but the proper answer might be - you can’t do what you want out of the box. You might be able to accomplish this with a custom PAM module, but again - I don’t know that for sure but that’s where I would start if I had to change the log in process.
    – bmike ♦
    Apr 30, 2019 at 17:28

1 Answer 1

Reset to default
2

Ok, so here is half an answer.

  • With a first admin account (e.g. admin) you create another one (admin_tmp) and you log into.
  • In the terminal you remove the first account from being able to unlock the disk with fdesetup remove -user admin. Meanwhile its SecureToken switch to Off.
  • You logout and log into 'admin'. Then from the Users accounts Preferences you remove the admin_tmp from the system.
  • Then you have an admin account with no SecureToken which seems to be the only way to force a Disk Encryption Password prompt on boot. Next accounts will inherently have no SecureToken, hence no allowance to decrypt the disk with their own password.

That's not ideal as this may break some stuff (See my Note in the initial post)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .