I require to fetch below few details on FileVault enabled users. 1)Private recovery key set or not 2)Institutional recovery key set or not 3)Authorized on every logon - supported or not. Which commands will help us to fetch these details for File-Vault enabled users. I want to get these details as a part data collection.

  • This looks a lot like " do my work for me" - questions like this generally get down votes and closed as too broad. Perhaps show your research so this looks more like a coherent single question as opposed to requirements for a software script. – bmike May 11 at 12:50
  • Sorry,new to this MAC os and doent have any guidance,I tried to Google as well but couldn't understood.Hence posted here – Manjunatha R May 12 at 9:29
  • 1
    I should have said Welcome to Ask Different as well. You are on the correct track. Rather than editing your question to show "I searched google" and couldn't understand, maybe an edit showing the search term you searched, and why the first hit or three were not understandable. Now we know a lot about what level of detail didn't work and what resources didn't work. In this case, someone had one answer that covered all three items. Don't worry if a couple down votes arrive, but you can edit things to reverse them or avoid that impression next question. Does that help at all? – bmike May 12 at 12:59
  • Also, apple has excellent documentation online. If you are scripting this, which MDM are you using. Most of the good ones have detailed guides on administrating and scripting this in a fleet. jamf.com/resources/technical-papers/… – bmike May 12 at 16:13
  • Sure I will ,Thank you – Manjunatha R May 13 at 5:37

From man fdesetup :

haspersonalrecoverykey [-device] [-verbose]
    Returns the string "true" if FileVault contains a personal recovery key.

hasinstitutionalrecoverykey [-device] [-verbose]
    By default, this will return the string "true" if FileVault contains an
    institutional recovery key. On CoreStorage volumes specified using the
    --device option, this will return the hex representation of the public key
    hash instead of "true". The hash option is not supported for APFS volumes.
    This will return "false" if there is no institutional recovery key installed.

usingrecoverykey [-verbose]
    Returns the string "true" if FileVault is currently unlocked using the
    personal recovery key.

    Returns the string "true" if the system supports the authenticated restart
    option. Note that even if true is returned, this does not necessarily 
    mean that authrestart will work since it requires that FileVault be enabled.
  • Thank you. I would have read Man page of fdesetup. – Manjunatha R May 12 at 9:30
  • One more doubt here ,whether these settings are applicable for all the Filevault enabled users ??Or we can customize like for one one user have different settings.Kindly guide on this. – Manjunatha R May 12 at 9:31
  • @ManjunathaR I'm not sure I understand what you are asking here. If you have additional Filevault questions please ask a new question and describe the problem you want to solve in more detail. Maybe lookup the available documentation on apple.com and other places first as well. – nohillside May 12 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .