The Encryption Imperative
If an employee leaves their corporate MacBook in the back of a taxi cab, the physical loss of the laptop is a minor financial inconvenience. The true catastrophe is the data. If the hard drive is unencrypted, the thief can simply unscrew the bottom of the laptop, pull the physical drive out, plug it into their own computer, and instantly copy every single confidential corporate email, password, and spreadsheet.
To prevent this, Apple provides “FileVault,” a military-grade, full-disk encryption system. When FileVault is active, the entire hard drive is mathematically scrambled. Without the user’s password (or a master recovery key), the data is completely inaccessible. While standard users can turn this on by clicking a button in System Settings, a systems administrator deploying fifty laptops to a new department cannot use a mouse. To forcefully manage, audit, and mandate FileVault encryption directly from the command line, you must use the fdesetup (Full Disk Encryption Setup) command.
Step 1: Open the Terminal
Because you are manipulating the foundational cryptographic keys that lock and unlock the entire hard drive, almost every single fdesetup command requires absolute root administrator privileges.
- Press Command + Space to open Spotlight Search.
- Type
Terminaland press Enter.
Step 2: Auditing the Encryption Status
If you connect to an employee’s Mac remotely, your first priority is to mathematically verify whether or not they have secretly disabled their encryption.
You use the status argument:
fdesetup status
The terminal will instantly output one of two things: “FileVault is On” or “FileVault is Off.” If you are deploying an automated security audit script across your entire corporate network, this single command allows you to instantly flag any machine that is currently unprotected.
Step 3: Forcefully Enabling FileVault
If the status returns as “Off,” you must fix the security breach immediately. You can force the encryption process to begin using the enable argument.
sudo fdesetup enable
The terminal will prompt you to enter the username and password of the specific user account that will be authorized to unlock the drive. Once you provide the credentials, macOS will instantly generate a massive, mathematically complex Personal Recovery Key (e.g., XXXX-XXXX-XXXX-XXXX-XXXX-XXXX).
Crucial Warning: You must copy this Recovery Key immediately and store it in a secure corporate password vault. If the employee forgets their password, and you lose this key, the data on the MacBook is permanently destroyed. There is no backdoor.
Step 4: Managing Authorized Users
If a MacBook is shared by three different employees in a retail store, all three employees must have explicit mathematical permission to unlock the FileVault encryption when the computer turns on.
To see exactly which user accounts are currently authorized to decrypt the hard drive, use the list argument.
sudo fdesetup list
The terminal will output a list of usernames and their unique cryptographic IDs. If you hire a new employee named “Sarah,” and you need to grant her access to unlock the machine, you use the add argument.
sudo fdesetup add -usertoadd sarah
The terminal will prompt you for an existing administrator password to authorize the change, and then it will mathematically inject Sarah’s credentials into the FileVault decryption engine. By mastering the fdesetup command, you ensure that your corporate data remains completely impenetrable, no matter where the physical hardware ends up.