New in Leopard is the ability to protect an account with FileVault as it is being created. When creating a mobile account, you can check the box to use FileVault, and this setting is easy to enforce with Workgroup Manager’s preference management as part of the Mobility settings.
If you use the Accounts preference pane to create a local account, you’ll see a new checkbox labeled “Turn on FileVault protection”, but it’s unchecked by default. What if your organization wants to ensure that all accounts — even purely local accounts — on laptops are protected with FileVault? With Workgroup Manager’s preference management, there does not seem to be a way to manage this setting in the Accounts preference pane. But you can manage it if you dig a little deeper…
You’ll need to use the “Details” view in the Preferences editor in WGM to directly manage specific preferences. Choose a Computer or ComputerGroup to manage, click the Preferences icon in the toolbar, then select the Details pane. Click the “+” button to add a new preference domain. Navigate to /Applications and double-click on the System Preferences app.
You should now have the com.apple.systempreferences domain available to you, and it should look like this:
Double-click the entry for com.apple.systempreferences, and delete all the imported keys – we don’t want any of them. Turn down the “Always” dictionary, and add a new key like this:
Save your changes.
If you want to look at this via the command line:
dscl mcxread /ComputerGroups/my_managed_laptops com.apple.systempreferences
On the managed machine(s), log out and back in, and go to the Accounts preferences pane and try to create a new account. It should look like this:
Hooray! FileVault is selected by default, and it can’t be unselected. Problem solved.
Note that by default, “Use secure virtual memory” is unchecked. If you want that on by default, you’ll need to manage com.apple.virtualMemory UseEncryptedSwap. The technique is similar. Via the command line, it looks like:
dscl mcxread /ComputerGroups/my_managed_laptops com.apple.virtualMemory
For some reason, even when it’s set to be managed always, the checkbox can still be deselected by the user. Grrr.