Hey all,
Not a big blogpost for now, but just a very short message to share the minor update I did on 2 of my FileVault related scripts.
They still need some clean up and and cosmetic tweaking, but they do work on Monterey now. Yes, late to the party to tweak them but with Ventura around the corner about time.
Only changed the logic to grab the logged in user in both scripts as those were still using Python which has been removed from macOS.
Replaced the logic by:
scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }'This on both scripts:
- Manage Secure Token: GitHub: Travelling Tech Guy – Manage Secure Token
- Advanced reporting of the overall FileVault situation for troubleshooting or sharing with support: Github: Travelling Tech Guy – Report FileVault
That’s it for now! Bit busy lately. (Things will get better end of September after the move to a new house 🙂 ).
As always, if you liked the post, hit the like button, tell your friends about it and leave a comment down below!
Brgds,
TTG
Apple ecosystem enthusiast, geek, tech gadget freak, Belgian living in the Netherlands
Manager Technical Support | Jamf
Hey TTG! Congrats on the new home, wishing you the best of luck. Also, please forgive the novel I am about to type.
It’s almost like divine intervention here, but I’ve been trying to resolve this Secure Token conundrum for the past few days, to no avail. Very new to all of this, and so I’ve spent hours reviewing old posts between here, JamfNation, and everywhere in between.
The problem was a hidden Standard user being added in PreStage, and it received the token. I’ve been successful in upgrading the account from Standard to Admin, but essentially, I’m getting the “Operation is not permitted without secure token unlock” error when trying to transfer tokens to the end user.
Bootstrap for some reason is also not enabled on these machines, and doing it manually does not work for the same reasons as above.
Really trying to avoid telling folks they need to do an E&I…. Thoughts on next steps?
Hey! Welcome to the world of FileVault 🙂 First thing I’m wondering is what you mean with ‘a hidden Standard user being added in PreStage’. Are you referring to the user creation, limited to Standard account in the accounts payload of the prestage? So someone created that standard account during setup assistant? Or some package you added to the prestage created an account? Or a policy which ran as enrollment (not part of the prestage) created that account?
What OS version is this? https://travellingtechguy.blog/filevault-securetoken-and-bootstrap-in-macos-11-0-1-big-sur/ As per Big Sur and later Bootstrap gets disabled when you are skipping account creation… an can be enabled/escrowed later by logging in with a secure token holder or run a profiles command.
Now, for the “Operation is not permitted” error, have you ran the script in this post to get a full report on FileVault on that system? Sure you are looking at the right accounts which have and have no Secure Token?
Hello TG,
thank you very much for the valuable information. I am very new to this and have limited experience. We are deploying our MacBook with PreStage Deployment and skip creating a local admin account. We force FV2 to be enabled with the configuration profile and enable it with the policy at the next login. Our MacBook are Domain Joined and The Users login with MobileAccount. Some of our users do not have SecureToken and therefore cannot sync FV2 password and install updates.
How can we get SecureToken for MobileAccount with FV2 enabled?
I very appriciate your Help
Hey! That profile is also set to enable FV at login? I would avoid conflicts with the policy. Or even forget about the policy and only do profile at login for best results.
As for Mobile accounts and secure token… that will bring us to bootstrap enabled or not? And which account does have the first secure token then?
So many possible scenarios which could have impacted it. If you are using Jamf I would open a support ticket to discuss further.