FileVault2 Encryption Status all partitions
| 0 Votes |
Description
Property Details
| 2998453 | |
| Beta - Preliminary testing ready for more | |
| FileVault2 Encryption Status all partitions | |
| BESC | |
| filevault, filevault2, partition, mac, mac OS X, macos, OSX, encryption, disk, partition | |
| BrianCanFixIT on 10/6/2016 9:59:40 AM | |
| BrianCanFixIT on 10/6/2016 10:00:19 AM | |
| 5298 Views / 19 Downloads | |
* Average over 0 ratings.
** Log In or Register to add your rating.
|
Properties
FileVault2
Period
Every Report
| * Results in a true/false |
(names of it, (if (not exists (booleans whose (it) of values of entries whose ("CoreStorage Encrypted" = key of it) of dictionaries of nodes of nodes of nodes "CoreStoragePhysical" of it)) then "Not Encrypted" else "Encrypted")) of nodes of nodes "IOGUIDPartitionScheme" of nodes of nodes "IOBlockStorageDriver" of nodes "IOAHCIBlockStorageDevice" of nodes "AppleAHCIDiskDriver" of nodes "IOAHCIDevice" of (it; nodes of nodes "AppleAHCI" of it) of nodes of nodes of nodes of nodes "AppleACPIPCI" of nodes whose(name of it starts with "PCI") of nodes "AppleACPIPlatformExpert" of service plane of iokit registry
Relevance
mac of operating system
Sharing
| Social Media: |
Comments
 |
|
| Hey @jgstew, I am using the below query to check FileVault statuses and noticed it does not return values (returns none) for newer macs with the m1 processor. However, older macs with intel processors return expected boolean values. booleans of values of entries whose("Encrypted" = key of it) of dictionaries of nodes of nodes of nodes of nodes "AppleAPFSContainerScheme" of nodes of nodes "IOGUIDPartitionScheme" of nodes of nodes "IOBlockStorageDriver" of nodes of (nodes of it; nodes of nodes of it) of nodes of nodes of nodes of nodes "AppleACPIPCI" of nodes whose(name of it starts with "PCI") of nodes "AppleACPIPlatformExpert" of service plane of iokit registry | |
 |
|
| I modified the above to support APFS, though I havent tried merging (all in one). booleans of values of entries whose("Encrypted" = key of it) of dictionaries of nodes of nodes of nodes of nodes "AppleAPFSContainerScheme" of nodes of nodes "IOGUIDPartitionScheme" of nodes of nodes "IOBlockStorageDriver" of nodes of (nodes of it; nodes of nodes of it) of nodes of nodes of nodes of nodes "AppleACPIPCI" of nodes whose(name of it starts with "PCI") of nodes "AppleACPIPlatformExpert" of service plane of iokit registry | |
 |
|
| Related: https://forum.bigfix.com/t/bigfix-checking-for-filevault-2-without-writing-output-files-on-the-endpoint/14709/4 | |
|
|
| Related: https://www.bigfix.me/analysis/details/2998121 | |
