Open Radar

 
Summary:

Enabling deferred FileVault 2 disk encryption in macOS Sierra renders the user unable to log in and begin the encryption process.


Steps to Reproduce:

1. Begin on a machine running macOS 10.12 Sierra (beta 1 or beta 2) that does not currently have disk encryption enabled.

2. Enable deferred FileVault encryption either by installing a Profile (.mobileconfig) or by running the following as root:
# fdesetup enable -defer /etc/fvkey -dontaskatlogout -forceatlogin 0

3. Reboot the machine.


Expected Results:

User is prompted for password at login screen. Upon entering correct password, a confirmation dialog appears that disk encryption has been enforced by the administrator. The user has a choice to begin the encryption process or cancel and return to the login window.


Actual Results:

User is prompted for password at login screen. Upon entering correct password, no dialog appears. Instead, the spinner rotates for several seconds, the screen briefly goes black, and the machine returns to the login window. Repeat.


Regression:

The same command was tested on 10.10 and works as expected.


Notes:

Affects both beta 1 and beta 2 of Sierra. The same command was tested on 10.10 and works as expected.

Fully restarting the machine did not avoid the infinite loop; same results occur.

Additionally, omitting the -dontaskatlogout flag did not change results. I was able to cancel the prompt at logout (postponing the encryption process as intended), but the login experience was the same.