FileVault not enabled on one macOS device – user locked out without recovery keySolved

Yeah, this usually means FileVault never actually kicked in on that device. 

Even if the policy shows as applied, macOS won’t enable FileVault unless everything lines up properly, especially on Apple Silicon Macs. A big one is the secure token thing. 

If the user account on that Mac didn’t get a secure token (can happen depending on how the device or user was set up), FileVault just won’t turn on. So, the policy kinda “sits there,” but nothing really happens. 

That would also explain why you’re not seeing any recovery key. 

Also, could just be bad timing tbh. 

Like if the device was offline, or it didn’t check in properly after the policy was pushed, or even if the user skipped something, FileVault might’ve never started. 

And yeah, sometimes macOS still expects the user to click through something to finish encryption. If that didn’t happen, it just stays off. 

Hi all! 

@sutton, this behavior can appear confusing at first, but it is primarily due to how macOS handles security at a system level. 

Exactly. The console reflects what was successfully reported back, but the actual on-device state can differ if the process never completed. 

At this point, the best way to confirm the real encryption status is from the device itself. 

You can try this: 

1. Boot the Mac into macOS Recovery (press and hold the power button) 

2. Open Terminal from the Utilities menu 

3. Run: ‍

This will tell you whether FileVault is actually enabled locally or not. 

You can also refer to Apple’s official guidance here: Apple FileVault Recovery Guide.  

Best Regards, 
Isabel Lora 
Hexnode UEM