FileVault disk encryption

FileVault is a macOS built-in security feature that encrypts all the data on the startup disk and prevents unauthorized access to your information. From the IBM® MaaS360® Portal, you can remotely configure FileVault and retrieve the recovery keys from the devices that are running macOS 10.13 or later.

Configuring the FileVault profile

You can use macOS MDM policies to configure (enable/disable) FileVault on macOS devices. For more information, see the macOS FileVault policy.

Note: When FileVault is enabled, disk encryption starts on the device, and the recovery key is generated. After encryption, FileVault requires that users log in with their account password every time the device starts up.

Retrieving a personal recovery key

If FileVault is enabled, users must log in with their login password or a recovery key to access their data. You can use device actions to retrieve and back up the recovery key. If users forget their Mac login password, they can use the recovery key to unlock the disk and reset their password.

Follow these steps to allow MaaS360 to retrieve and back up the FileVault recovery key.
  1. From the IBM MaaS360 Portal home page, go to Devices > Inventory.
  2. Open the macOS device that is enabled with FileVault encryption through the security policies.
  3. Click More > FileVault Recovery Key.

The recovery key is retrieved and displayed on the screen.

Retrieving personal recovery keys from previously encrypted devices and reenrolled devices

Administrators must regenerate the FileVault recover keys in the following scenarios.
Devices are already encrypted before enrollment
The FileVault recovery keys are unavailable if administrators enroll devices that are already encrypted. In this case, administrators must take over management of FileVault from the previously encrypted devices before retrieving the personal recovery keys.
Devices are wiped or reenrolled
When a macOS device is enrolled, the device generates a FileVault recovery key that is retrieved by MaaS360. However, if the macOS device is wiped or reenrolled, the existing FileVault recovery key is rendered invalid. Administrators can create a smart group of reenrolled devices with outdated recovery keys and then regenerate the recovery key for those devices.
Prerequisites
  • macOS Agent version 2.43.000 or later must be installed on the Mac device.
  • The FileVault disk encryption policies must be deployed to macOS devices.

Identifying previously encrypted devices

Administrators can use advanced search to filter and create a smart group with devices that meet the following conditions.

Follow these steps to create a smart device group.
  1. Go to Devices > Advanced Search.
  2. Use the following search criteria.
    Data Encryption Encryption Status Equal To Encryption Complete
    Data Encryption FileVault Recovery Key Present Equal To No
Identifying the reenrolled devices that have outdated recovery keys
  1. Go to Devices > Advanced Search.
  2. Use the following search criteria.
    Data Encryption Encryption Status Equal To Encryption Complete
    Data Encryption FileVault Recovery Key Present Equal To Yes
Retrieving personal recovery keys from multiple devices at once
  1. From the MaaS360 Portal home page, go to Devices > Groups.
  2. Hover over the More option below the device group and then select Escrow FileVault Recovery Key.
  3. On the Escrow FileVault Recovery Key window, click Continue.

    On the macOS device, the MaaS360 agent prompts the user to enter their password and then regenerates the personal recovery key.

Note: After escrowing the personal recovery key, administrators can use the device-level action FileVault Recovery Key to view the personal recovery key.
Retrieving the personal recovery key from an individual device
  1. From the IBM MaaS360 Portal home page, go to Devices > Inventory.
  2. Open the previously encrypted macOS device.
  3. Click More > Escrow FileVault Recovery Key.

    The MaaS360 agent prompts the user to enter their password and then regenerates the personal recovery key on the device.

    Note: After escrowing the personal recovery key, administrators can use the device-level action FileVault Recovery Key to view the personal recovery key.