Whenever I'm logged in as a certain user and trigger a shutdown or restart, I get prompted to enable filevault. I have searched everywhere to find the hook that causes this prompt, but I can't find it.

I've searched all the LaunchDaemon and LaunchAgent directories I can find.

I've reviewed the output of launchctl find.

I've done other things in the past as well but I don't remember them all.

I have upgraded my computer and transfered my user account multiple times since this started happening. It seems to stick to my user account.

I believe this might have come from Symantec Endpoint Encryption that installed from my employer many years ago. But I've also tried all the uninstaller techniques I can find for that.

It appears after all the desktop stuff has gone away.

Any ideas for where else I can look for a hook that might trigger this?

Update: FileVault is not currently enabled on the disk and I do not want to enable it.

The popup window

  • Presumably this is not the user you actually unlock the volume with? Oct 9, 2021 at 19:09
  • Yes. This is the primary user of the compiler and the user credential that I use to unlock the computer. I am highly confident that the window is not coming from any part of MacOS. Oct 10, 2021 at 21:57
  • On the other hand, the window has the file vault icon on it, so I think that means the content is being vectored through filevault for display, if not natively generated in fail vault. Dec 10, 2021 at 15:43
  • Did you ever figure this out? I have the exact came issue. I also previously had Semantic Endpoint installed.
    – Dave G
    Oct 9, 2022 at 15:51
  • It is still plaguing me. I just got a new computer and now I am making one more attempt to clean this out before I give up on transferring my account and recreate everything from scratch just to get rid of this annoying thing. Oct 11, 2022 at 3:38

3 Answers 3


One possible solution I can think of, but it's proctalgia.  First:

cd /
ls | grep -v dev > /tmp/tmp1
sudo find $(cat /tmp/tmp1) -type d -print | grep -i symantec > /tmp/tmp2

Look through /tmp/tmp2 and delete anything you're sure you don't need.  Repeat without the -type d (doing whole directories first saves having to wade through lots of filenames with [S|s]ymantec in the path).

If the problem is still there:

  1. Save any changes, close all apps, and launch Migration Assistant.
  2. Choose "from Time Machine backup"
  3. Turn off everything, including "Settings," except for the account with the problem.
  4. When it asks give the account a new name and password (but you can use the same password if you wish).
  5. After the migration, use the new account. Unfortunately, you'll have to re-do any account-specific settings/preferences that differed from defaults, and login again to your Apple ID stuff, and re-download all your mail, etc. (I said it was proctalgia, right?)
  6. When satisfied with the new account, delete the old one.

If that proctalgia didn't work, Apple will tell you to wipe the disk, re-install, and don't migrate anything. (Worse proctalgia)

  • I’ve tried similar techniques of gripping file names, but I’m not sure if the file would be easy to spot. I also tried using ps to look at what was running after my apps are closed and when the dialog is up. But I didn’t see anything unusual. Oct 14, 2022 at 3:54

At one point I had a weird issue that occurred with the login screen. It only happened on my user account. It was apparently caused by old software and plist settings left over from multiple migration of my account across machines and OS updates. I spent a lot of time trying to resolve it. Based on my experience, you COULD go digging through your profile settings trying to resolve your issue, but at some point it isn't worth your time - it will be more effective and much faster to simply recreate your profile.


This is typically enforced via a profile in system settings. You will have to get the MDM manager to revoke that request for your device or remove the management profile for the MDM.

On your Mac:

  1. navigate to System Preferences > Profiles > MDM Profile
  2. Click Remove, then click Remove again to confirm.

The MDM profile is now removed from your Mac. It might be possible the Mac is still being asked to encrypt as part of an MDM push command so your erase / install might get you to an even more challenging enrollment lock if the device is seen by Apple as owned as a managed device.

Also, some MDM commands won't show up as profiles.

  • I have no profiles installed and it still happens. It only happens for one user, are the profiles per-user? Oct 11, 2022 at 3:38
  • That is a great question - I do not know if our past MDM sent a MDM command outside profiles, but we always would see the profile - perhaps that MDM command is pending until you "accept" the request and it gets documented once the key escrow command is accepted. I'll edit if I can dig up more details @ChrisQuenelle
    – bmike
    Oct 11, 2022 at 14:26
  • Where can I learn more about MDM commands? Oct 14, 2022 at 3:52
  • I've added it to the bottom of my answer @ChrisQuenelle . Hopefully it will help you and others.
    – bmike
    Oct 14, 2022 at 13:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .