Managing FileVault from the command line: status, recovery keys, secure token and bootstrap token

Goal

Check whether a Mac's startup disk is encrypted, understand who can unlock it, and see whether a management system can recover it if a password is lost.

Prerequisites

Terminal; admin rights to change FileVault state. fdesetup status and sysadminctl -secureTokenStatus work unprivileged; fdesetup list and profiles status -type bootstraptoken need sudo.

Steps

1. Check current state: fdesetup status reports FileVault is On or Off, and whether an encryption or decryption is still in progress.
2. List which users can unlock the disk at boot: sudo fdesetup list.
3. Turn FileVault on interactively, which by default shows a personal recovery key once on screen: sudo fdesetup enable. For unattended enablement tied to an institutional key, or one issued through device management, drive the flow from an MDM profile so the key is escrowed automatically rather than displayed on screen.
4. Whichever way the key was generated, store it somewhere other than the disk it protects — a password manager, or escrowed to the organization's device management service. It is the only way in if the volume owner's password is lost.
5. Check whether a specific local account has a secure token, which controls whether it can unlock or enable FileVault at all: sysadminctl -secureTokenStatus <username>.
6. Check whether a bootstrap token — the mechanism that lets device management grant secure tokens to new accounts without an administrator re-authenticating each time — has been escrowed: sudo profiles status -type bootstraptoken.

Expected result

fdesetup status reports On; fdesetup list includes every account that should be able to unlock the disk; profiles status -type bootstraptoken reports an escrowed token on a managed Mac that relies on device-management-driven account provisioning.

Limits and test basis

FileVault's purpose, and the roles of a secure token and a bootstrap token in a managed deployment, are documented in Apple's platform security and deployment guides; fdesetup and sysadminctl flag syntax follow widely documented practice and a command reference, since Apple does not publish these tools' flags as a web page. Never disable FileVault as a troubleshooting step on a device holding organizational data without first confirming a current recovery path exists.