3

I have a scenario where I have connected all of our Mac machines to Active Directory (which is pain itself). However, after enabling FileVault from an Administrator account, I saw that network users can't log in even after enabling: Display login window as Name and password. First I have to login with an admin account and then logout allows an only network user to login which is not an ideal solution. There is some solution but what if I don't know the user and would like to make Mac machine open where random AD user can log in in that machine (FileVault enabled). Any suggestion or solution will be highly appreciated.

5
  • Define "login." Are you enabling screen sharing so that they can use the Mac as if they were sitting in front of it or are you just giving them access to some shared folders on that Mac? Aug 20, 2019 at 20:00
  • I think my question may be misleading. I joined our Mac machines in AD and then now after enabling File Vault from Admin account, whenever I restart the machine, it comes with Admin icon and field to provide the password. However, it should come with Login window showing empty for Name and Password. I saw in some forum that once you enable File Vault, you have to login on that machine with Admin account only. What if there are different network users who want to login
    – Udhy
    Aug 20, 2019 at 20:32
  • Sorry, so experience with AD and Macs but it sounds like you need people to physically log in to a Mac with their own AD username/password combo, who are not administrators on that Mac, but that Mac requires all users to be Administrators because of Filevault? Aug 20, 2019 at 20:36
  • Exactly. Filevault is enabled and now it allows me to login with Administrative account only. I need a way where AD user can login on FileVault enabled Mac machine. McAfee have provided some solution kc.mcafee.com/corporate/index?page=content&id=KB79648 but it is for one user.
    – Udhy
    Aug 20, 2019 at 20:47
  • Any suggestion?
    – Udhy
    Aug 26, 2019 at 16:23

1 Answer 1

4

I will explain this process very technically in details.

When you have an encrypted disk with FileVault, the system needs to ask for an authorised user to login just after EFI boot.

This is necessary because the system has to mount the disk. And it can't mount it without an admin password input.

You then see a screen with local admin-level users avatars.

That screen shows some users avatar because that user's avatar were inserted on the EFI boot image/nvram. At this point of the boot sequence, there is no Operating System loaded yet, it's just a simple boot screen to ask the user password [which simulates the login screen appearance of the GUI], but it just a static image containing the user avatars! (almost like a kind of bootloader statical image, except it asks for user/pass combination)

After you insert the password, the disk is mounted, and the boot process begins.

After the loading bar reaches about 80% that screen changes to another almost identical, it sometimes blinks at this point. This is the GUI interface being loaded, process called WindowServer.

At this point the network interface is UP, other network subsystems are just started, including open directory services [which you need]. If the disk were NOT encrypted, this is the EXACT point where you would see the REAL login screen asking for username/password. But since the disk is encrypted and you have provided the user/pass to decrypt it earlier [before mounting the disk] it skips the real multiuser-mode login screen that should appear here and auto-logs the username you inserted before.

So in practice, it is just a mimic theatrical simulation of a real login since the boot, but it is fake, until when GUI is ready and then the MacOS does an auto-login once in multiuser mode, to make you think all was kind of "magical". But there is no magic at all.

So what you need/want is impossible on that initial screen, because no network authentication protocol is up at that point. Even the disk isn't ready, which only becomes mounted and readable after inserting the user/pass combination.


You can take a better understanding of what I have written and how all this happens by booting it a little different:

Use the -v nvram boot argument, to boot it verbosely.

If you boot it using the "-v" nvram argument you can get a better view of what is happening "behind" the scene, and also can see the GUI loading moment, and the auto-login happening.


What has to be done:

To achieve what you need, we have to prevent the auto-login mechanism on the real GUI [windowServer] to happen.

This way you will have a local user just to mount the system-disk on Boot-time, then after GUI gets-up it must stay on the un-logged state, and showing the real login screen with the real avatars or fields to input user/password (depending on how you prefer to log users [by avatars or by text input name/pass]).

  • This will force 2 logins:

    • one for Filevault [on Boot] and
    • one for the OS
  • On the second login you can either login the same local user used on boot, or you can login any other user.

  • This will also let you login [on the second login] any AD user as you need to.

(Remember that the first login is not a real login, it just an authentication to mount the disk, so nobody is technically logged-in on the UNIX/BSD [system portion] after mounting the disk. The Real/true login only happens on the second one [on the GUI portion])


How to do it:

To force 2 (two) logins there is a secret key to be added to MacOS configuration:

sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES

After executing it, reboot, and it is done!

Please post your results, I just tested it now on Encrypted El Capitan and it works!, and it should work up to Mojave (but I don't have any encrypted Mojave here now to test it now. I will test and validate it also on Catalina tomorrow. If you can, please validate it for your macOS version, post the results, and we can build a mini-table here listing all known working versions later.

Executing the above command is completely safe, nothing to worry about it.

5
  • Wow, thank you so much for such a clear overview. After digging out for 3 weeks, I also understand the principle of Apple on macOS. I totally agree with you. However, do you think I can go with third party encryption? In my scenario, I have to encrypt Apple Hardware and need to put in AD also. Will McAfee encryption work or they also just push to enable FileVault?
    – Udhy
    Aug 29, 2019 at 15:45
  • @Udhy I just managed how to disable the second login!! I edited my post to reflect the new knowledge, please read again the last part of it, and be ready to apply the configuration on your machine! I am waiting for your feedback.
    – Prado
    Aug 29, 2019 at 17:14
  • Thank you so much for giving your time on this. I gave an attempt for this and it seems to be working partially only. 1. First, it appears with the local admin account. After I provide the credentials, it gave me the login screen where I can put the network username and password. 2. Previously, it was not possible to get login screen until I login with local admin and logout.I was trying this also: FileVault2.
    – Udhy
    Aug 30, 2019 at 13:54
  • I am implementing this. Thanks a million for this awesome idea. I am making Generic standard account for one for Filevault [on Boot] and on second login, network users are able to login. Generic standard account has a very standard password which I am able to distribute among user. Only major difference is that, they use 2 login (one for computer and one for Network). Mojave works perfectly.
    – Udhy
    Sep 2, 2019 at 11:39
  • I tested this in Catalina too and it is working perfectly. Thank you so much and it took a bit time to convince my network team about this idea but they also agreed as there is no other choice to get this.
    – Udhy
    Sep 23, 2019 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .