Remove a User's Ability to Unlock FileVault 2 with their User Password

• Updated January 10, 2019


I have used FileVault 2 since OS X Lion without issue and it has worked as expected. With FileVault 2 enabled, before I can login with my user password, I have to first unlock the hard drive using the disk encryption password I previously set.

However, I have noticed if you add a new user, regardless if it is another Administrator or Standard account, that new user will be allowed to unlock the hard drive with their user password or the disk encryption password. I do not like that this is the default behavior, but I can understand why it is; the computer administrator probably does not want to give new users the disk encryption password, so, by default, new users simply need to know their own user password to unlock the hard drive. This is a feature that is purely for convenience instead of security. The disk encryption password is likely much more secure than the new user’s password.

If you open System Preferences, click Security & Privacy, and go to the FileVault tab there is a hidden button called Enable Users that will only appear if there are users who do not have the ability to unlock the hard drive with their user password. If this button is present, the computer administrator has the ability to enable those users to unlock the hard drive with their user password (those users must enter their user password to enable this feature). However, oddly enough, what you cannot do is revoke that ability from the GUI. Luckily, Apple provides the fdesetup command to do just this.

If you want to remove a user’s ability to unlock the hard drive with their user password and require them to first use the disk encryption password, open Terminal and run the following command:

sudo fdesetup remove -user $USER

If you have a bunch of users you want to remove this ability from, you will have to run the above command for every one of those users.

For much more detail into using the fdesetup command, check out Der Flounder’s post on Managing Mavericks’ FileVault 2 with fdesetup.

If you found this post useful, you can help support this site and get something for yourself by signing up for any of the services listed below through the provided links.

The following links are part of affiliate programs, and I will receive a referral payment from any of the services you sign-up for.

  • Get Faster Shipping: Perhaps you're about to order some stuff on Amazon but want to get more value out of the money you would normally pay for shipping. Sign-up for a free, 30-day trial of Amazon Prime to get free two-day shipping, access to thousands of movies and TV shows, and more.
  • Start Investing Now: Are you looking to start investing some of your disposable saved income? Get started by opening an account with Webull, where upon sign-up and opening a brokerage account with an initial deposit of at least $100 you will receive 1 stock valued (subject to change based on normal market movement) between $8 and $1600.

Thanks for reading and take care.