Home > fdesetup, FileVault 2, Mac administration, Mac OS X > Disabling FileVault 2 with fdesetup on Mountain Lion and Mavericks

Disabling FileVault 2 with fdesetup on Mountain Lion and Mavericks

Recently, I was asked how to disable FileVault 2 without needing to go into System Preferences. The general idea was that an organization may want to provide their users without admin rights a way to turn off FileVault 2 on an as-needed basis.

Most of the work I’ve done has been focused around turning on FileVault 2 and managing it, rather than providing a way for users to turn it off. That said, fdesetup on both Mountain Lion and Mavericks provides a way to disable FileVault 2 with proper authorization.

To disable FileVault 2 on the Mac you’re logged into, run the following command with root privileges:

fdesetup disable

You’ll be prompted for either the password of an enabled user or a personal recovery key.

Screen Shot 2014-03-22 at 5.39.08 PM  

Screen Shot 2014-03-22 at 5.47.15 PM

Note: If a personal recovery key was not set up on a particular Mac, you’ll only be prompted for the password of an enabled user.

Screen Shot 2014-03-22 at 6.14.48 PM

Once the password or personal recovery key has been entered, the Mac will begin to decrypt.

For those who want to automate this procedure, you can do this using an expect script or other means. As an example, I’ve written an expect script which automates running the fdesetup disable process described above.

log_user 0
set password s3kr1tp4ssw0rd_or_recovery_key
spawn fdesetup disable
expect ": "
send "$password\n"
expect EOF

view raw
hosted with ❤ by GitHub

  1. Mattias
    May 5, 2014 at 11:15 am

    If I want to automate the procedure is the a possibility to run this script through Remote Desktop using Send UNIX Command? I’ve tried to copy paste your script but this doesn’t work because its default shell is /bin/bash.
    If this is possible then I don’t have to copy the script (with password) locally to all machines.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: