Enforce FileVault via Command Line in macOS 13

Enforcing FileVault disk encryption entirely through the command line on macOS 13 Ventura is not possible without local user interaction or pre-supplied administrative credentials. Modern macOS security architectures, including Secure Tokens, Ownership, and the Secure Enclave on Apple silicon and T2 Macs, prevent scripts running as root from silently encrypting drives. While the native command-line utility fdesetup can initiate encryption if supplied with interactive user credentials, mandatory enforcement must be deployed using a Mobile Device Management (MDM) configuration profile.

Using the Command Line: fdesetup

macOS includes the fdesetup binary for managing FileVault state from the Terminal. While you cannot silently force encryption across unknown accounts, you can enable it interactively or by piping valid credentials.

To check the current encryption status:

fdesetup status

To enable FileVault interactively for the current user:

sudo fdesetup enable

The system will prompt for the administrative username and password of an account holding a valid Secure Token. Once verified, the utility displays a recovery key and begins the encryption process.

To automate enablement within a script, credentials can theoretically be passed via a plist configuration using stdin:

sudo fdesetup enable -inputplist < /path/to/credentials.plist

The plist must contain the username and password of a Secure Token holder. Storing plain-text credentials in scripts poses a severe security risk and is not recommended for production environments.

Limitations of CLI Enforcement on macOS 13

Direct command-line enforcement fails in enterprise or automated deployments due to three core macOS 13 security controls:

  • Secure Tokens and Volume Ownership: A volume cannot be encrypted unless the action is authenticated by a user who possesses a cryptographic Secure Token. The local root user does not automatically possess this capability.
  • Deprecation of Silent Key Generation: Apple restricts the ability of automated command-line scripts to bypass physical authentication when binding keys to the Secure Enclave.
  • Apple Silicon Constraints: On M1, M2, and later Macs, FileVault interacts directly with local node ownership, requiring cryptographic authentication from a local authorized administrator.

The Standard Method: Enforcing via MDM

To strictly enforce FileVault without collecting user passwords, administrators must use an MDM server deploying the com.apple.MCX.FileVault2 profile payload.

When applied to macOS 13:

  1. The profile pushes an instruction to enforce FileVault.
  2. The user is prompted to authenticate and enable FileVault at next login or logout.
  3. The personal recovery key is automatically escrowed to the MDM server using a Bootstrap Token.
  4. Encryption proceeds without administrative exposure to cleartext passwords.