I’m setting up new Macs through Automated Device Enrollment and want FileVault to be enabled automatically as part of enrollment.
Does Hexnode also save the personal recovery key somewhere in the portal? I’m mainly looking for the right macOS policy/ADE setup. Also, what happens if FileVault is already turned on manually on a Mac before the Hexnode policy is applied?
30 Views
Yes. You can configure FileVault during macOS enrollment and escrow the personal recovery key in Hexnode.
Use the following setup:
1. Go to Policies and create or edit a macOS policy.
2. Navigate to macOS > Security > FileVault.
3. Enable FileVault.
4. Configure personal recovery key escrow so that the FileVault recovery key is saved to Hexnode.
5. If prompted, use the Hexnode MDM FileVault certificate for the FileVault configuration.
6. Save the policy.
7. Associate this policy with the required Automated Device Enrollment profile from Admin > Apple Business/School > Automated Device Enrollment.
8. In the ADE profile, go to Setup Assistant > macOS and make sure the FileVault setup pane is not skipped. This allows the FileVault prompt to appear during initial setup.
After enrollment, the recovery key can be checked from Manage > select the device > Device Info > Security Info.
For reporting, you can also go to Reports > Built-in Reports > Enrolled Devices and add columns such as Encryption Status and FileVault Personal Recovery Key.
Regards,
Mary Romero
Don't have an account? Sign up
What's new 
