Enable Other Accounts in FileVault

Information

This Article describes the current working process to add other accounts to to the list of users allowed to encrypt and decrypt the drive with Filevault 2 in macOS Sonoma

• This process is typically necessary when a user becomes unable to log in to the device.
  • This can either happen randomly, when the user changes their password off campus, or the device has been off the campus network for awhile.
  • The following process has many seemingly unnecessary steps, but it has been tested to be the only current working process for macOS Sonoma.
  • When trying to perform this process on an older version of macOS(Monterey/Ventura) it does not work and neither does the old process.
    • We have had to update the device to the latest version to get the targeted user permanently added to the list of filevaulted users.

Environment

• MacOS
• FileVault 2

Process

MacOS Ventura and below

1. Open System Preferences, then select Security & Privacy.
2. Click the FileVault tab.
3. If the padlock icon at the lower left is locked, click it and enter admin credentials.
4. Click Enable Users.
5. In the list of users, for each user you are enabling, click Enable User, then enter the user's password and click OK. You will then see a confirmation checkmark for each user enabled.
6. Click Done.

MacOS Sonoma and above

1. Log into macOS with the local Administrator account
2. Open terminal
3. Input sudo fdesetup list into terminal to show a list of users enabled with Filevault
   • The output usually lists the administrator account and the targeted user account (even though the targeted user is listed in the output does not mean the user is actually able to decrypt the drive).
     • If there is only the administrator account, then the following process will still work, but step 4 and 5 can be skipped most likely.
4. Input sudo fdesetup remove -user %usernametoremove%
5. Restart the device
6. Once on login screen log into the local administrator and then log out
7. Log into the targeted user account
8. In the top left toolbar expand the Apple symbol and select Lock Screen
9. Hover the mouse over the profile’s picture to switch to another user
10. Log back into Administrator
11. Open System Settings
12. In the left pane select Privacy & Security
13. Scroll to the bottom and select Filevault
14. Select Enable Users, if this option is not available redo steps 1-4.
15. In the list of users, for each user you are enabling, click Enable User, then enter the user’s password and click OK. Administrator credentials will be required here.
16. If successful there will be a green confirmation check-mark to right of the user(s) enables.
17. Select Done.
18. Restart the device and attempt to login to the targeted user to test for success.