1

When you enable FileVault's full-disk encryption, it asks for the password of each account on the system to allow every user to decrypt the disk. You can simply choose not to have a user enter their password, and they will not be able to decrypt the disk. However, if you create an account after enabling disk encryption, the user is automatically allowed to decrypt the disk. How do I disallow a user from decrypting the startup disk?

Improve this question

1 Answer 1

Reset to default
2

To remove a user from FileVault enabled accounts, type the following at the terminal prompt:

sudo fdesetup remove -user username

Where "username" is the name of the user you wish to remove. If the command's successful, no further output will be offered. (You'll know if it's worked because that user will no longer be able to log in to the machine when you reboot; you will have to log in first, then go the 'switch user' screen/password prompt for them to log in.)

To find out about the other commands available, type fdesetup help.

Improve this answer
1
  • You forgot to mention the manual page: man fdesetup ;)
    – Blacklight Shining
    Sep 9, 2012 at 0:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .