I enabled FileVault and Find My Mac and Guest Account is now disabled (i only see safari only guest mode).
Is there a way to re-enable normal guest account again?
I am on Macbook Pro 10.11.1
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
There is no way to do this. I have searched high and low for this solution and I've come to the conclusion that it isn't possible due to the way Apple designed it.
Instead of securing the recovery key in a hardware TPM chip as Microsoft's BitLocker does, FileVault stores it in a keychain file on the unencrypted recovery volume. Any FileVault-enabled user account can unlock this keychain and read it. Therefore, it is required that every account have a password in order to protect the recovery key. Apple then uses a "pass the hash" mechanism to log you into the OS (so you don't have to type your password in twice).
Ironically, even though Apple does not use hardware to secure FileVault, OS X WILL save the recovery key in PRAM if the machine goes into hibernation mode. They don't advertise this as a feature, but page 36 of this Apple training guide has instructions for turning it off. Remember that hibernate differs from sleep in that the contents of RAM are saved to the hard disk and the computer is powered off rather than simply going to low power mode. Since the hibernation file is on the encrypted volume, the firmware needs to be able to unlock that volume in order to read it.
The solution you could use (although it isn't very practical) is to just always hibernate your Mac instead of shutting down. You can configure this behavior by opening up a Terminal typing the following command:
sudo pmset -a hibernatemode 25
To use it just log off (instead of shutting down) and then close the lid. The system will power off instead of sleeping, and it will not require a FileVault logon the next time you power it up. The drawback is that if a guest logs on and then reboots or shuts down, they'll need a password to use the computer again.
I have been trying to find a way to permanently store the recovery key in PRAM so it gets used all the time, but so far I haven't had any luck. If anybody knows a way to do that I'm all ears. The firmware on a Mac isn't as secure as the TPM on a PC, but it would accomplish the goal of making it work more like Bitlocker (wherein BitLocker can be configured without a PIN so that the system is totally transparent so long as the hard drive is not removed and the boot order is not tampered with).