Unable to enable FileVault, no user has a secure token

Question

Level 1

4 points

Unable to enable FileVault, no user has a secure token

Running a MacBook Pro (15-inch, 2017) on High Sierra 10.13.6 (17G65) and I'm trying to enable FileVault but nothing happens when I press the 'Turn on FileVault...' No pop-up, the button just goes from blue to grey.

When examining this further no user on my MBP has secure token enabled, not even the first admin user that was created at start:

$ sysadminctl -secureTokenStatus admin

2018-08-29 14:20:10.297 sysadminctl[2364:532265] Secure token is DISABLED for user Admin

Hence when trying to activate secure token on my AD-connected user, I get the following error:

$ sudo sysadminctl -adminUser admin -adminPassword xxxxxxx -secureTokenOn jangu -password xxxxx

2018-08-29 14:11:46.457 sysadminctl[2313:508279] ### Error:-14090 File:/BuildRoot/Library/Caches/com.apple.xbs/Sources/Admin_sysadminctl/Admin-67 9/addremoveuser/main.m Line:366

2018-08-29 14:11:46.457 sysadminctl[2313:508279] Operation is not permitted without secure token unlock.

It like the chicken and egg problem.

Is the only way to solve this a complete re-installation? Can I in that case use time machine to copy my account and all files/settings to at least save some time? I really need to be able to enable FileVault.

BR,

/Janne

MacBook Pro (15-inch, 2017), macOS High Sierra (10.13.6)

Posted on Aug 29, 2018 5:30 AM

Reply

Answer 1

apfelpom

Level 1

4 points

Oct 15, 2018 12:07 AM in response to jannegpriv

I had the same problem with a user migrated with migration assistant and who's password was automatically reseted, after then tried to be changed with passwd. Finally I logged in as an admin user, mv /Users/od-user to /Users/od-user-bak, got to System Preferences > User > Deleted the OD user, mv /Users/od-user back and logged in again as the OD user. I was prompted with a windows giving me the option to enter admin credentials to create a secret token for this OD account. I then make a mobile account and was able to activate FileVault2.

Reply

Answer 2

Aug 29, 2018 11:25 AM in response to jannegpriv

Out of curiosity post the output from the terminal.app, copy and paste:

diskutil list

In the new APFS you need a PreBoot volume— I am not saying this is your issue, but it would be nice to know in an effort to proceed forward.

Reply

Answer 3

Barney-15E

Level 10

122,186 points

Aug 31, 2018 5:50 AM in response to jannegpriv

Short of reinstalling, you could try deleting the .AppleSetupDone file and have it create a new admin user. I don't know if it will work. Other threads/internet search seems to indicate having users connected to AD prevents creation of the token.

http://www.theinstructional.com/guides/how-to-re-run-the-os-x-setup-assistant

Reply

Answer 4

jannegpriv Author

Level 1

4 points

Aug 29, 2018 11:15 PM in response to leroydouglas

$ diskutil list

/dev/disk0 (internal):

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme 251.0 GB
disk0

1: EFI EFI 314.6 MB
disk0s1

2: Apple_APFS Container disk1 250.7 GB
disk0s2

/dev/disk1 (synthesized):

#: TYPE NAME SIZE IDENTIFIER

0: APFS Container Scheme - +250.7 GB
disk1

Physical Store disk0s2

1: APFS Volume Macintosh HD 109.2 GB
disk1s1

2: APFS Volume Preboot 22.0 MB disk1s2

3: APFS Volume Recovery 519.0 MB
disk1s3

4: APFS Volume VM 2.1 GB disk1s4

Reply

Answer 5

Aug 31, 2018 12:22 AM in response to jannegpriv

Hi there, btw what do you mean by "AD-connected user" and how was it created? Anyway having first Admin account (which was initially created bye macOS) DISABLED is strange and not quite sure how that could happed.

Reply

Answer 6

Aug 31, 2018 7:28 AM in response to jannegpriv

jannegpriv wrote:

Any more hints or tips on how to proceed investigating this?

AD= Active Directory

diskutil apfs listUsers /

Interesting post:

(including the trailing comments)

Secure Token and FileVault on Apple File System | Der Flounder

bassam on Twitter: "yes. "sudo fdsetup status" says its on.… "

Directory Utility: Active Directory integration

Reply

Answer 7

jannegpriv Author

Level 1

4 points

Aug 31, 2018 7:33 AM in response to Manolis_from_Prague

Sorry, AD = Active Directory connected user.

Via System Preferences/Users & Groups pressing 'Join' on the Network Account Server and adding info on your desired AD host.

Then logging in with the newly created domain user and via System Preferences/Users & Groups mark the user and click “Allow user to administer this computer” then click “Create” on Mobile account.

After that answer OK and Create on next question regarding Home folder and sync, then login/logout domain user again.

BR,

/Janne

Reply

Answer 8

jannegpriv Author

Level 1

4 points

Aug 31, 2018 7:37 AM in response to Barney-15E

Thanks for the tip, I created a new SuperAdmin1234 user using this metod, however it did, not for some reason, get a secure token :-(:

$ sysadminctl -secureTokenStatus superadmin1234

2018-08-31 16:36:41.340 sysadminctl[10616:2766508] Secure token is DISABLED for user SuperAdmin1234

Something is really strange with this MBP.

BR,

/Janne

Reply

Answer 9

jannegpriv Author

Level 1

4 points

Aug 31, 2018 7:48 AM in response to leroydouglas

$ fdesetup status

FileVault is Off.

$ diskutil apfs listUsers /

Cryptographic user for disk1s1 (1 found)

|

+-- 3123197B-F635-4B4A-909D-40FACC1EAFB3

Type: Local Open Directory User

Does this say anything to you?

Interesting to read that he got problems using Migration Assistant, which I also had when trying to auto-migrate data from my old MBP. The migration never succeeded, tested twice as I can recall, but got some error that I don't remember. I ended up using scp to copy all needed files and applications.

Also interesting to read that manually changing password for a user using passwd in terminal, can lead to that the secure token for that user is disabled.

BR,

/Janne

Reply

Answer 10

Aug 30, 2018 6:52 AM in response to jannegpriv

The formatting looks normal.

Reply

Answer 11

jannegpriv Author

Level 1

4 points

Aug 30, 2018 11:53 PM in response to leroydouglas

Any more hints or tips on how to proceed investigating this?

Reply

Unable to enable FileVault, no user has a secure token

Similar questions