Topic: mdm
-
Managing FileVault from the command line: status, recovery keys, secure token and bootstrap token
fdesetup reports and changes FileVault state and recovery-key handling; sysadminctl and profiles report which accounts can unlock the disk and whether a bootstrap token is escrowed with a device management service, which matters before relying on MDM-driven account provisioning.
-
Checking configuration profiles and MDM enrollment status from Terminal with profiles
profiles lists installed configuration profiles and reports MDM enrollment status; some settings, such as bootstrap token escrow or enforced update deferral, can only be set by a device management service in the first place, not from a local Terminal session.
-
Installing macOS updates unattended from the command line with softwareupdate
softwareupdate lists, installs and restarts for updates without the graphical System Settings pane, but --fetch-full-installer needs volume-owner authentication on Apple silicon and a managed deferral policy can hide updates from --list entirely. This methodology covers both.
Machine-readable: JSON