I need to do remote checks to verify OSX has filevault enabled. When you enable filevault, does it create / change something on the HDD that I can check for on VPN login using my posture assessment tools?
Can you run a command line tool, such as
$ sudo fdesetup status FileVault is On.
fdesetup also accepts the verb
isactive, which returns 0 if FileVault is enabled (checking a return value is arguably more reliable than reading the text):
$ sudo fdesetup isactive $ echo $? 0
fdesetup does require root access, which might be a problem.
You could also run
diskutil cs list and check for the encryption status. The exact wording you're looking for is a bit complicated because of all the different possible combinations, this script might be a good start.
fdesetup seems only avaliable on Mountain Lion.
The basic idea is:
diskutil cs list
The rtrouton script mentioned previously seems needlessly complicated (I ended up there first, but after reading half of it came here). I'm probably going to start with the below and wrap a little more logic around it.
diskutil cs list | grep "Fully Secure"