---
title: "FileVault: Seamless Toggle On/Off and Key Rotation"
slug: "filevault-seamless-toggle-onoff-and-key-rotation"
updated: 2023-12-26T07:16:49Z
published: 2023-12-26T07:16:49Z
canonical: "help.scalefusion.com/filevault-seamless-toggle-onoff-and-key-rotation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FileVault: Seamless Toggle On/Off and Key Rotation

## Toggle On/Off the FileVault

The following Shell script helps IT Admins to toggle on/off the FileVault on the managed Mac devices.

1. Create a file on your desktop, for example, **ToggleFileVault.sh** and open it in a text editor like notepad++
2. Copy the contents below to the file or click [here](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/ToggleFileVault.sh) to download the file.

```bash
#!/usr/bin/env bash

# If should enable FileVault then set "yes" else "no"
SHOULD_ENABLE="yes"

# ====== DO NOT EDIT BELOW CODE ======

brandIcon="/Applications/Scalefusion-MDM Client.app/Contents/Resources/AppIcon.icns"
title="Scalefusion: Disable FileVault"
if [[ "$SHOULD_ENABLE" = "yes" ]]; then
title="Scalefusion: Enable FileVault"
fi

## Get the logged in user's name
userName=$(/usr/bin/stat -f%Su /dev/console)

## Grab the UUID of the User
userNameUUID=$(dscl . -read /Users/$userName/ GeneratedUID | awk '{print $2}')

## Get the OS build
BUILD=`/usr/bin/sw_vers -buildVersion | awk {'print substr ($0,0,2)'}`

## This first user check sees if the logged in account is already authorized with FileVault 2
userCheck=`fdesetup list | awk -v usrN="$userNameUUID" -F, 'match($0, usrN) {print $1}'`

if [ "${userCheck}" != "${userName}" ]; then
echo "This user is not a FileVault 2 enabled user."
exit 3
fi

## Check to see if the encryption process is complete
encryptCheck=`fdesetup status`
echo "${encryptCheck}"
statusCheck=$(echo "${encryptCheck}" | grep "FileVault is On.")
onStatus="FileVault is On."
if [ "${statusCheck}" == "${onStatus}" ]; then

    if [[ "$SHOULD_ENABLE" == "yes" ]]; then
    echo "FileVault is already enabled"
    exit 0
    fi

else

    if [[ "$SHOULD_ENABLE" != "yes" ]]; then
    echo "FileVault is already disabled"
    exit 0
    fi

fi

passwordPrompt () {
## Get the logged in user's password via a prompt
echo "Prompting ${userName} for their login password."
text="Admin has requested to disable FileVault"
if [[ "$SHOULD_ENABLE" = "yes" ]]; then
text="Admin has request to enable FileVault"
fi

userPass=$(/usr/bin/osascript <<EOF
on run
    set userInput to text returned of (display dialog "$text" & return & "Enter login password for '$userName'" default answer "" with title "$title" buttons {"Cancel", "Ok"} default button 2 with icon POSIX file "$brandIcon" with hidden answer)
    return userInput
end run
EOF
)

# Check if the user canceled the dialog
if [ "$?" == "1" ]; then
    echo "User Canceled"
    exit 0
fi

# Use the retrieved password
if [[ ! -z "$userPass" ]]; then
echo "User Password is not empty"
else 
echo "User password is empty"
exit 4;
fi

if [[ "$SHOULD_ENABLE" = "yes" ]]; then
echo "Attempting to enable FV with the entered credentials"
sudo fdesetup enable -user "$userName" -password "$userPass"
else
echo "Attempting to disable FV with the entered credentials"
sudo fdesetup disable -user "$userName" -password "$userPass"
fi
}

passwordPrompt

exit
```
  1. If **SHOULD_ENABLE="yes"** [Activates FV and starts encryption]
  2. If **SHOULD_ENABLE="no"** [deactivates FV and starts decryption]
3. Once the script is successfully executed you will be able to see the

## Rotate Filevault PRK

The following script will check if the Filevault is ON/OFF.

1. If it is **ON**, the script will re-generate a new PRK, and the same will get synced to Scalefusion dashboard.
2. If it is **OFF**, the script will turn **On** the Filevault and **start** encryption. The key will be generated and will also show in the output response in View Status report on the dashboard. It will also be available in the Full Device Information card at the next sync interval.

![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-B8OFLF5S.png)
3. Create a file on your desktop, for example, **rotateFV.sh** and open it in a text editor like notepad++
4. Copy the contents below to the file or click [here](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/rotate-fv-prk.sh) to download the file.

```bash
#!/usr/bin/env bash

# Resync the PRK key with MDM. If FV is not already ON then it'll be turned-on 
FORCE_SYNC_PRK_KEY="yes"

# ====== DO NOT EDIT BELOW CODE ======

brandIcon="/Applications/Scalefusion-MDM Client.app/Contents/Resources/AppIcon.icns"
title="Scalefusion: FileVault"

if [[ "$FORCE_SYNC_PRK_KEY" = "yes" ]]; then
  title="Scalefusion: Enable FileVault & Sync PRK"
fi

## Get the logged in user's name
userName=$(/usr/bin/stat -f%Su /dev/console)

## Grab the UUID of the User
userNameUUID=$(dscl . -read /Users/$userName/ GeneratedUID | awk '{print $2}')

## Get the OS build
BUILD=`/usr/bin/sw_vers -buildVersion | awk {'print substr ($0,0,2)'}`

## This first user check sees if the logged in account is already authorized with FileVault 2
userCheck=`fdesetup list | awk -v usrN="$userNameUUID" -F, 'match($0, usrN) {print $1}'`

if [ "${userCheck}" != "${userName}" ]; then
  echo "This user is not a FileVault 2 enabled user."
  exit 3
fi

## Check to see if the encryption process is complete
encryptCheck=`fdesetup status`
statusCheck=$(echo "${encryptCheck}" | grep "FileVault is On.")
onStatus="FileVault is On."
if [ "${statusCheck}" == "${onStatus}" ]; then
  echo "FileVault is already enabled"
else
  echo "FileVault is disabled"
fi

passwordPrompt () {
  ## Get the logged in user's password via a prompt
  echo "Prompting ${userName} for their login password."
  text="Admin has requested to disable FileVault"
  if [[ "$FORCE_SYNC_PRK_KEY" = "yes" ]]; then
    text="Admin has request to enable FileVault"
  fi

  userPass=$(/usr/bin/osascript <<EOF
  on run
  set userInput to text returned of (display dialog "$text" & return & "Enter login password for '$userName'" default answer "" with title "$title" buttons {"Cancel", "Ok"} default button 2 with icon POSIX file "$brandIcon" with hidden answer)
  return userInput
  end run
EOF
)

  # Check if the user canceled the dialog
  if [ "$?" == "1" ]; then
    echo "User Canceled"
    exit 0
  fi

  # Use the retrieved password
  if [[ ! -z "$userPass" ]]; then
    echo "User Password is present"
  else 
    echo "User password is empty"
    exit 4;
  fi

  if [[ "$FORCE_SYNC_PRK_KEY" = "yes" ]]; then
    echo "Attempting to enable FV with the entered credentials"
    sudo fdesetup enable -user "$userName" -password "$userPass"
    sudo fdesetup changerecovery -personal -user "$userName" -password "$userPass"
  fi
}

passwordPrompt

exit
```

> #### 
> 
> Follow [our guide](/docs/execute-shell-scripts-on-macos-devices-with-scalefusion) to upload & publish the Shell script using Scalefusion Dashboard.

> #### 
> 
> Please note that to use the Shell scripts, the Scalefusion MDM Client Application must be installed on the device(s). Please follow [our guide](/docs/scalefusion-mdm-agent-application-for-mac-devices) to publish and install the Scalefusion MDM Agent Application.

> #### Notes:
> 
> 1. The scripts and their contents are sourced from various albeit authenticated Apple Developer communities and forums.
> 2. Please validate the scripts on a test machine before deploying them on all your managed devices.
> 3. Scalefusion has tested these scripts, however, Scalefusion will not be responsible for any loss of data or system malfunction that may arise due to the incorrect usage of these scripts.