FileVault 2 Full-Disk Encryption Alternative with LDAP Support

Question

Has anyone come across a full-disk encryption alternative to FileVault 2 for macOS with better LDAP user support? I've been trying to identify a solution for macOS Mojave that:

1. offers pre-boot, full-disk encryption just like FileVault 2 does
2. allows users to type in a username and password from the pre-boot login screen, authenticate over the network to a local LDAP server, and then decrypt+login to a macOS system without being manually added as users on that system beforehand.

I'm working in an environment with thousands of constantly changing users across thousands of machines at different sites, so pre-adding each LDAP user to each system (as I understand FileVault 2 requires) isn't workable for me.

A question about FileVault alternatives hasn't been asked in some time. My search for an alternative meeting my needs hasn't turned up much, which is why I'm hoping someone in the community can help. Most tools I've found such as VeraCrypt, TrueCrypt, and Trend Micro EE only seem to offer directory-level encryption rather than pre-boot. I'm starting to become convinced FileVault 2 is the only pre-boot FDE option for macOS... does anyone know of another?

Answer 1

Nope - there’s no getting around FileVault at the moment and with the T2 chips controlling this, you’ll need Apple to move to get the alternatives you mention off the ground let alone to production.

There are very good pre-log in screen options like the NoMad family and JAMF Connect that allow you to have LDAP/AD users checked at log in time, creating a local user if needed so you don’t have to pre-set up local users on macOS.

You’ll need an MDM to collect your FileVault keys (individual or institutional) if you need to be able to unlock a mac where a user isn’t already FileVault enabled. You’ll also need to keep track of secure tokens on newer OS.

Hit up the mac admin community on slack if you manage macOS professionally - most of the tooling needed is open source and the community blogs to get you up to speed are invaluable.

You’re right this isn’t manageable with tools like Apple Business Manager / DEP / MDM so you’ll need to bring some tools to manage 500+ Macs without a large staff and tons of repetitive work.