List All FileVault Enabled Users
The List All FileVault Enabled Users tool identifies and displays all user accounts on a macOS device that have FileVault enabled. Designed primarily for use within a Jamf extension attribute, this tool simplifies automated reporting and compliance monitoring.
To integrate this tool into a Jamf extension attribute, use the script below:
#!/bin/zsh
# Run the Rocketman tool
result=$(rocketman ListAllFileVaultEnabledUsers)
fileVaultEnabledUsers=$(echo "$result" | tail -n2 | head -n1)
# Check for errors or empty output
if [[ $? -ne 0 || -z "$fileVaultEnabledUsers" ]]; then
result="Rocketman tool failed or returned no output"
fi
echo "<result>$fileVaultEnabledUsers</result>"This tool can also be executed directly from the command line without any parameters:
rocketman ListAllFileVaultEnabledUsersNone. This tool operates without requiring additional parameters or arguments.
Specifies the domain for setting options in local or managed plists.
- Type: string
-
Default:
tech.rocketman.listallfilevaultenabledusers -
Example:
--domain "tech.rocketman.customdomain"
This tool is ideal for:
- Compliance Monitoring: Ensuring all managed devices adhere to FileVault encryption policies.
- Security Audits: Identifying users with active encryption privileges to verify compliance during security reviews.
In an environment that requires full-disk encryption for compliance, this tool can be integrated into Jamf Pro as an extension attribute. The resulting data can be used to create dynamic groups of non-compliant users, streamlining remediation efforts.
- Jamf Integration Recommended: While usable from the CLI, the tool is optimized for use within Jamf Pro extension attributes for reporting and automation.
- A Mac with FileVault off produces an empty result. There are no FileVault-enabled users to list, so the tool prints an empty line rather than reporting an error. An Extension Attribute built on it reports an empty value for those Macs, which is the correct answer rather than a failure.