Cannot switch off File Vault using admin account - "Account cannot be used to manage encryption"

I have been trying to switch off File Vault, however, I get getting "Account “(account name)” cannot be used to manage encryption on this Mac. Click the lock to prevent further changes, then select another administrator account, and try again.

The account I am using is the initial and only admin account. I have tried with another admin account (which I managed to successfully create) however, I am still getting the same error.

Posted on Dec 14, 2017 12:44 AM

Top-ranking reply

Livingroom

Level 1

4 points

Posted on Dec 15, 2017 9:42 PM

I had this same, incredibly frustrating problem. Thankfully the solution that worked for me is very simple.

first, create a new user, make sure it's an admin user. give it a password. log out of your old user, log into your new user, and then reset the password of your old user. make sure you pick a different password than you have now.

be aware that keychain will still use your old password, so don't forget it just yet.

Log out of your new user, log into your old user. voila, that user now has the securetokenon flag set. you can now disable Filevault.

be aware than when you lock back into your old user, iCloud, keychain, and all your email accounts will require you to log back in. this is a security measure to prevent unwanted access to your secure iCloud contents. you will have to enter your iCloud/apple account password several times. this is normal behavior.

when keychain asks for your password, it will be the password your old user had before you reset it.

View in context

16 replies

Feb 12, 2018 7:54 PM in response to jdmcmurtry

Good news! I think I found a solution:

(1) Boot the Mac from any volume containing an APFS-aware version of macOS (that is, Sierra or High Sierra) other than the subject volume (the one you're trying to remove the encryption from). It doesn't matter whether or not the volume you boot from is itself formatted in APFS.

(2) Log in if necessary, and make your way to the Terminal. (If you've booted using a Recovery volume or a macOS installer volume, you can find Terminal in the "Utilities" menu.)

(3) In Terminal, enter the following command: diskutil apfs list

(4) In the displayed results, look for the name of the subject volume, and make note of its disk identifier string, which should be in the format disk#s# (where "#" represents a numeral).

(5) In Terminal, enter the following command: diskutil apfs unlockVolume disk#s# (substituting the disk identifier string for the subject volume). When prompted, type in the volume's "Disk Password" (encryption key).

(6) In Terminal, enter the following command: diskutil apfs decryptVolume disk#s# (substituting the disk identifier string for the subject volume). When prompted, type in the volume's "Disk Password" (encryption key).

If all is well, you will see a message indicating that decryption of the subject volume has begun. If so, it's just a matter of waiting for the process to complete, which may take several hours. If you wish, you can immediately restart the Mac and boot up the subject volume. You will be asked once more to provide the Disk Password before you can log in. After logging in, open System Preferences > Security & Privacy > FileVault. You should see the label "Decrypting..." next to a progress bar with an estimated time remaining to complete the decryption task. Once it's completed, you should be able to re-enable FileVault from the same prefpane, and *this* time your admin-privileged account will be able to administrate FileVault properly, including the ability to log in at startup without separately providing the Disk Password first.

Give this a try and let me know how it goes for you!

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Cannot switch off File Vault using admin account - "Account cannot be used to manage encryption"