Addigy's FileVault-Manager Utility

filevault-manager is a compiled command-line utility installed with the Addigy agent at /Library/Addigy/filevault-manager on every managed Mac. It is the utility Addigy calls behind the scenes when you enable FileVault from a device's GoLive page, and you can call it directly yourself to build custom encryption and key-escrow workflows.

Overview

FileVault disk encryption, the built-in encryption of macOS, is a beast to manage. Enabling FileVault can be painstaking and risky. Losing both a device's password and recovery key will result in data loss. For this reason (and others), treat FileVault deployment carefully and verify recovery keys are escrowed before relying on encryption at scale.

Prior to macOS 10.13 High Sierra, FileVault supported a Master Recovery Key—a recovery key that could be passed to the fdesetup command during setup that would act as a universal decryption key. However, Apple deprecated this method in High Sierra. Institutional and Master keys are no longer supported.

This is where Addigy's filevault-manager utility comes into play.

• What it does: Enables FileVault, defers enablement until the next login, adds users to FileVault, reports FileVault status, and escrows pending Personal Recovery Keys (PRKs) to your Addigy account.
• Who it's for: Administrators who need FileVault behavior beyond what the standard GoLive or MDM workflows provide, and who are comfortable running scripts against their fleet.
• Key benefit: Because the utility ships with the Addigy agent, you can call it from Smart Software or a saved script and build conditional, fleet-wide encryption logic without installing anything extra.

Note: For most deployments, use the MDM FileVault payload instead. See Enforcing FileVault with Addigy MDM for prerequisites, deferred enablement behavior, and how to retrieve escrowed recovery keys.

Prerequisites

• A macOS device with the Addigy agent installed. The utility is installed at /Library/Addigy/filevault-manager as part of the agent.
• A way to run commands on the device: Smart Software, a saved script, or the device's GoLive page. See Creating and Running Scripts on Your Devices (Saved Scripts).

Complete Usage of FileVault-Manager

To see every option the utility supports, run /Library/Addigy/filevault-manager with no arguments.

/Library/Addigy/filevault-manager
Need to provide an option.
Usage: /Library/Addigy/filevault-manager [OPTIONS]
  -add
      Adds a user to FileVault for this device. This option requires -existing-user and -existing-password flags.
  -defer
      Will defer enabling FileVault until the device is restarted. This option will obtain the password at login.
  -dismantle
      Will dismantle the automatic escrow mechanism if it is enabled. Must be used along with the -escrow flag.
  -enable
      Enabled FileVault for this device. If the defer call is not provided, the password flag must be provided.
  -escrow
      Escrows any pending FileVault key to Addigy. Will only escrow standard plist keys inside /Library/Addigy/fv-escrows.
  -password string
      The password of the user specified by -user. If the -user flag is not provided, the password for the currently logged in user must be provided.
  -prompt-restart
      Will prompt the user restart the machine after FileVault is enabled. Must be used along with the -enable flag.
  -status
      Prints the status of FileVault for this device.
  -user string
      The username of the user to enable FileVault for. If no username is provided, the currently logged in username will be used.
  -v  Prints the current version of FileVault Manager.

The most important option here is the -escrow flag, which pushes any FileVault keys still held by the Addigy agent on the device up to your organization's Addigy account.

How to Build a Custom FileVault Workflow

Because the utility is installed alongside the rest of the Addigy agent, you can reference it in Smart Software or in a saved script and run it across many devices at once.

The example below is a Smart Software that checks FileVault status and, if FileVault is disabled, enables FileVault deferment and notifies the user to restart.

Condition script (Install on Success should be on):

fvStatus=$(/Library/Addigy/filevault-manager -status)

if [ "$fvStatus" = "enabled" ]; then
    echo "FileVault is enabled. Skipping..."
    exit 1
elif [ "$fvStatus" = "disabled" ]; then
    echo "Enabling FileVault deferment."
    exit 0
else
    echo "Error reading FileVault status."
    exit 1
fi

Installation script:

/Library/Addigy/filevault-manager -enable -defer

/Library/Addigy/macmanage/MacManage.app/Contents/MacOS/MacManage action=notify title="FileVault Enabled" description="Your administrator has enabled FileVault. Please restart to complete the process." closeLabel="Close"

Note: This Smart Software can be safely pushed out to a large group of machines as long as the devices are being used by a single, primary user.

How to Escrow Pending FileVault Keys

Personal Recovery Keys (PRKs) generated by the filevault-manager utility should automatically escrow up to your Addigy account. If the escrow fails for some reason, such as a network connectivity issue, the key is left pending on the device.

Run the script below to check for pending keys and complete the escrow process.

if [ -e '/Library/Addigy/fv-escrows' ]; then
    /Library/Addigy/filevault-manager -escrow
fi

Once the escrow succeeds, the recovery key is available in Addigy. See Enforcing FileVault with Addigy MDM for where to find escrowed Personal Recovery Keys.

Related Articles

• Enforcing FileVault with Addigy MDM
• Enabling FileVault On An Individual Device
• Importing Known FileVault Keys into Addigy (Import Script)