There's a couple of ways to set up a vault, and in this lesson we're going to focus mainly on doing
it with an institutional key.
Now, before I do that, I just want to go over briefly some things of how file works as an individual
user.
And that way, you can see what the difference is, because even if you have a lot of max in your environment,
you may only have a couple that you are going to encrypt.
So you really need to decide if you are going to treat it like an individual machine or an institutional
machine.
And so right now, I am logged in as administrator.
And because I'm administrator, I'll be able to go into the control panel when I enter my password.
And you can see that right now, Foll Vault is off.
Well, to turn it on, I need to do is click, turn it on and it's going to want to know if I want to
tie it to my iCloud account or to create a recovery key.
And I'm going to go ahead and use recovery key since I don't have an iCloud account.
Now, if your end users are administrator, one thing that you have to consider is regardless of how
you set up their machines with firewall, they'll always have the ability to turn it off or change how
it's set.
So in an environment where users are administrators, it's going to be hard to enforce any file vault
settings.
Now, that means that if a user leaves the company and you recover their their Mac, you may never be
able to decrypt any of the information, because if it's set up with their iCloud account where they
have the recovery key and you don't or they disabled whatever you did and then they did their own thing,
you just may never be able to get into it.
So keep that in mind.
All right.
So when we go ahead, this is our key.
When you use file vault with an individual log like we're doing now, all the keys are going to be different
for all the computers.
And you have to save all of these keys.
File vault right now is on.
And so if I reboot the computer.
You're going to see that it's going to ask me to type in my password right at boot up, so in other
words, the computer is not going to boot to a login screen.
It's going to immediately present me with my username and a password prompt, and that's going to be
to decrypt the hard drive.
And then after I do that, the computer will start to boot up.
All right, so as you can see, there certainly wasn't enough time for the computer to boot, and this
is simply just to get past firewall and now the boot up process is actually taking place.
All right, so as you can see, I'm logged in now, I'm back where I was I was going asked for your
username and password again, and my disk is in the process of being encrypted.
It's not fully encrypted.
But as you saw, once I turned foulmouthed on, then I had to go ahead and set up a or I had to put
in my password just to get past turning on the computer.
All right, so now I'm going to go ahead and log in with my network user.
Now, in a previous lesson I had mentioned when we were raising profiles after reboot that I added something
that would bypass a secure token prompt for the users.
And so I've disabled that.
So when I logged in, I'm getting this account now you can see says enter a secure token administrator's
name.
Well, I just logged in as an active directory user and I don't if I type in my username and password.
It's it's not going to work because I'm not an administrator.
So even though I logged in as Mojave and the administrator may not be anywhere around to type in the
username and password, this dialog box is not going to be very effective for very many people.
Now, if I had bypass, which I wouldn't intuitively know to do that, it's never going to ask me again.
And that mobile config profile that I showed you earlier just makes this not come up at all.
And so that might be something that you want to use in your environment.
Well, all right, so Mohave as a user on this machine, but it's not what's known as a file vault user,
so what do we do about that?
Well, that's the hard part, because the only way to make the final vote or to make McGarvey a file
vote user is for the administrator.
And Mo have to be in front of the machine at the same time or have a remote session where the administrator
can add McAvey as a file user because both passwords are known.
Now, there is a workaround if you nomo have a password, which you probably won't.
So when we set up the institutional key, we're going to create a P list with usernames and passwords
so we can so we can set up a file vault without user interaction.
Now, I just showed you how to set it up interactively, but I didn't show you how to do it remotely
without interaction.
And so we're going to do that next.
But I want to go back into a file vault so you can see something.
And so if we go in a firewall, you see it says some users are not able to unlock the disk.
What that means is if I reboot the computer, the only name that's going to show up is Administrator
and Mojave.
Not knowing administrator's password is not going to be able to actually boot up the computer.
If this was our laptop and how they was out in the field, then this would be a complete mess.
So right now I have to put in the administrator username and password.
And then I have to say enable users.
And now my hobbies in the list, I have to enable him.
And now I need Mahavir user.
And now when I reboot the computer, Moha, that is going to show up in the list and the Mojave user
is going to be able to.
Get into the computer after the computers start up.
All right, so now you can see I have administrator in Mojave, because now they are both filed all
users and if I were, say, on a laptop out in the field now, I have the ability to turn on the computer
as hobby and then the computer will boot up and then I'll be able to use the computer as normal.
All right.
So it's important to realize that if you set up the firewall with individual accounts, every computer
has a unique key and every user has to be added separately as a firewall user.
And in the next section, we are going to discuss how to do what's known as an institutional key, where
you have a single key for every computer in your organization.