I see a very well documented way, if a user is *not* enabled to decrypt the boot volume, to enable that user.

I have the converse problem: I have a user FileVault-enabled user, who should *NOT* be.

Is there a way to do this?