Issue Description
The intended user account which should enable FileVault has a Secure Token, but FileVault is not enabling at logout or login (depending profile or policy used). When checking the FileVault status we see the following:
fdesetup status
FileVault is Off. Deferred enablement appears to be active for user 'unknown'
FileVault enforcement must have been triggered prior to the user creation (for instance when 'skipping user account creation' in the PreStage for deployments with Jamf Connect login).
Troubleshooting Steps
Fortunately, the fix is easy and straight forward, but all steps need to be performed:
Confirm if the user who trying to enable FileVault has a secure token:
sudo fdesetup list -extendedIf they do not, fix that first.
Temporarily exclude the computer from the FileVault configuration profile/policy in Jamf Pro.
Run the following command and confirm there is NO mention of any deferral in the output:
sudo fdesetup disable. This should now return (no deferral active):FileVault is Off.Note: Please record the output from the above commands, they will help identify FileVault enabled users if this workflow does not immediately resolve the issue.
REBOOT the computer (mandatory for the deferral cancelation to work).
Add the computer back to the scope on your FileVault configuration profile/policy.
Log in with the correct user to try and enable FileVault again.