MacOS – How to force Disk Encryption password on boot for ALL users

apfsencryptionfilevaultmacospassword

I want my MBP to be unlocked with Disk Encryption Password before getting access to the login screen. (read : I want to have two passwords prompts before the MBP can be used)

Therefore, I made a clean (re)install of High Sierra and chose APFS Encryted. However the subsequent created admin account has a security token, which seems to be my issue.
Now on startup I have the choice between the admin account and the Disk Encryption Password for others accounts with a disabled Token.

I tried the following :

  1. Tried to remove myself (aka admin) from having the Secure Token with sysadminctl -secureTokenOff admin but I end up with the following error :
    Operation not permitted without a secure token unlock.

However I do well have a one (sysadminctl -secureTokenStatus admin shows ENABLED)

  1. Tried to remove myself from being able to unlock the disk with fdesetup remove -user admin but as I'm the only user, I got the following User could not be removed because it's the last OS user on the Volume

In short, how can I force the Disk Encryption Password prompt for ALL users, including admins ?

It makes echo to this post : Prompt for encrypted disk password on startup

Note :
On a buggy install of HighSierra, I ended up with an admin account without Security Token, and it worked as intended. I had to go through the Disk Encryption Password prompt before anything else.
However I re-installed MacOS because this situation made me unable to access the terminal from the MacOS Recovery (I had a error message saying that no admin with the correct statuts (read Token) with was found on the system)

Best Answer

Ok, so here is half an answer.

  • With a first admin account (e.g. admin) you create another one (admin_tmp) and you log into.
  • In the terminal you remove the first account from being able to unlock the disk with fdesetup remove -user admin. Meanwhile its SecureToken switch to Off.
  • You logout and log into 'admin'. Then from the Users accounts Preferences you remove the admin_tmp from the system.
  • Then you have an admin account with no SecureToken which seems to be the only way to force a Disk Encryption Password prompt on boot. Next accounts will inherently have no SecureToken, hence no allowance to decrypt the disk with their own password.

That's not ideal as this may break some stuff (See my Note in the initial post)

Related Question