Can a non-admin user be added to APFS FileVault?

Question

Can a non-admin user be added to APFS FileVault?

Mac OS 10.14.6. System is joined to Active Directory. I cannot get a non-admin user added to the FileVault unlock screen. diskutil apfs UpdatePreboot / produces the following error for the user:

UpdatePreboot: Considering APFS Crypto User XXX
UpdatePreboot: Defaulting and requiring that this be an Open Directory User
UpdatePreboot: Treating this APFS Crypto User to be, and requiring to match, an Open Directory User
UpdatePreboot: Correlated APFS Volume Crypto User with Open Directory User XXX aka "USERNAME"
UpdatePreboot: Error for this processed user was -69567

Admin Active Directory users are added. Both types have SecureTokens assigned to them. We would really prefer our users login without admin accounts.

Mac mini 2018 or later

Posted on Sep 13, 2019 3:08 PM

Reply

Answer 1

Best reply

Orion Poplawski Author

Level 1

13 points

Sep 19, 2019 10:01 AM in response to Orion Poplawski

Looks like a couple things may not have been done properly when this account was created. I manage to resolve by adding a "Full Name" to the account (which was missing). Then manually removing and re-adding the user to filevault with fdesetup.

Reply

Answer 2

HWTech

Level 9

56,030 points

Sep 13, 2019 8:36 PM in response to Orion Poplawski

If Filevault is enabled after the users were created then you need to manually configure each user to unlock Filevault. Users created after Filevault has been enabled are automatically enabled. See this Apple article about giving users permission to unlock Filevault.

https://support.apple.com/en-us/HT204837

Reply

Answer 3

Sep 19, 2019 9:14 AM in response to Orion Poplawski

Thanks for confirming it is a mobile account.

For your information it has historically been possible to convert a standard mobile account in to a mobile account with local admin privileges. This may or may not be acceptable to your IT department but to do this you do the following.

Ensure the mobile account has been created (which you have), it will normally at this point be a normal user level account
Login as a local admin account
Using the local admin account go to System Preferences -> Users & Groups
Modify the mobile account to give it local admin privileges

It will still be a mobile account and will still sync its credentials to the directory server. In theory this should not be necessary and I can certainly confirm local non-admin accounts can be used with FileVault2.

Reply

Answer 4

Sep 17, 2019 3:10 PM in response to HWTech

As mentioned, everything seems fine for this user. It has a SecureToken, it appears to be already listed in the users that can access Filevault (at least I cannot add it). On another machine a non-admin user was able to be added to Filevault, so there seems to be some particular issue with this user.

Reply

Answer 5

Sep 19, 2019 3:50 AM in response to Orion Poplawski

I cannot tell from your post if this will apply but it is worth checking.

Only users that have an account on the Mac can be added to the list. This is because at the point you see the FileVault2 login window the computer is not actually running the full macOS operating system it is running a stripped down 'preboot' environment and this means not only does it not know how to connect to your directory server i.e. Active Directory it is not even connected to your network.

What you can do is use a 'mobile account' which is a local account automatically created and synced to an active directory account. Otherwise you have to use a locally created user account.

It should be noted that quite sometime ago Apple officially discontinued support for 'portable home directory' user accounts, has made network login accounts effectively unusable due to numerous issues and even mobile accounts are becoming more and more of a problem. A solution that gives you most of the benefits of mobile accounts with relatively non of the pain is to use Nomad to 'sync' a local account to active directory. See - https://nomad.menu/

Reply

Answer 6

Sep 19, 2019 8:59 AM in response to John Lockwood

Thanks for the reply. The user has a local "mobile" account. That's why UpdatePreboot is event trying to add it, but it is getting an error for some reason. I think I just have to bring this to apple support at this point.

Reply

Can a non-admin user be added to APFS FileVault?

Similar questions