Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When you enable FileVault's full-disk encryption, it asks for the password of each account on the system to allow every user to decrypt the disk. You can simply choose not to have a user enter their password, and they will not be able to decrypt the disk. However, if you create an account after enabling disk encryption, the user is automatically allowed to decrypt the disk. How do I disallow a user from decrypting the startup disk?

share|improve this question
up vote 2 down vote accepted

To remove a user from FileVault enabled accounts, type the following at the terminal prompt:

sudo fdesetup remove -user username

Where "username" is the name of the user you wish to remove. If the command's successful, no further output will be offered. (You'll know if it's worked because that user will no longer be able to log in to the machine when you reboot; you will have to log in first, then go the 'switch user' screen/password prompt for them to log in.)

To find out about the other commands available, type fdesetup help.

share|improve this answer
You forgot to mention the manual page: man fdesetup ;) – Blacklight Shining Sep 9 '12 at 0:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.