How to Use the ‘fdesetup’ Command to Manage FileVault Encryption via Terminal

The Mandate for Hard Drive Encryption

If an employee leaves a corporate MacBook on a train, and the hard drive is unencrypted, a thief can simply remove the SSD (or boot into Target Disk Mode) and instantly read every single confidential file, bypassing the macOS login screen entirely.

To prevent this, Apple provides FileVault 2 (full-disk encryption). While users can turn this on graphically in System Settings, enterprise IT departments cannot rely on employees to click buttons. They must force encryption programmatically across hundreds of machines during deployment.

To accomplish this via scripts, Apple provides the fdesetup (Full Disk Encryption Setup) command. It allows administrators to enable FileVault, capture the critical Recovery Keys, and audit encryption status directly from the terminal.

1. Auditing Encryption Status

If you are writing a compliance script to check if a Mac is currently secure, you use the status command.

fdesetup status

The command will output a simple, easily parsable string, such as FileVault is On. or FileVault is Off. If the Mac is currently in the middle of encrypting a massive 1TB drive, it will tell you the exact percentage of completion.

2. Enabling FileVault Silently

Turning on FileVault via the terminal is complex because it requires a user’s password to generate the cryptographic keys, and it generates a Personal Recovery Key (PRK) that must be captured and stored securely.

You cannot simply type a password in plain text into a terminal script. You must pass the credentials securely using an XML file (a .plist), or by piping them directly into the command.

To enable encryption for the current user and output the new Recovery Key to the terminal (so your MDM software can intercept it and save it to the corporate database):

sudo fdesetup enable -user jsmith

The terminal will securely prompt you for jsmith‘s password. Once provided, it instantly engages the encryption engine and displays the Recovery Key (e.g., A1B2-C3D4-E5F6-G7H8-I9J0-K1L2).

3. Adding Additional Users to FileVault

When FileVault is enabled, the Mac’s hard drive is locked before the operating system even boots. The login screen you see on a FileVault Mac isn’t the real macOS; it’s a pre-boot EFI environment.

Only users who have been explicitly granted “SecureTokens” can unlock the drive and boot the computer.

If you create a new user account (e.g., itadmin) on a Mac that is already encrypted, that user will not be able to turn the computer on. You must use fdesetup to explicitly add them to the authorized unlock list.

sudo fdesetup add -usertoadd itadmin

The command will prompt you for the password of an already authorized user to prove you have the right to modify the encryption, and then it will ask for the password of the new user to generate their cryptographic token.

4. Checking Authorized Users

To verify exactly which user accounts currently possess the cryptographic keys required to unlock the hard drive, use the list command.

sudo fdesetup list

This will output a clean list of authorized usernames and their corresponding UUIDs. Any user not on this list cannot boot the machine.

Conclusion

The fdesetup command is the cornerstone of macOS data security. By allowing MDM administrators to programmatically enforce FileVault, securely capture Recovery Keys without user interaction, and manage pre-boot authorization lists, it ensures corporate data remains impenetrable if the physical hardware is ever compromised.