- \n
- FileVault needs to be enabled on the device for this window to appear. See Create a Mac FileVault 2 Policy<\/a> to learn more.<\/li>\n<\/ul>\n\n\n\n
![\"FileVault](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/10\/macos_filevault_login_window.png\")
<\/p>\n\n\n\n- \n
- What is FileVault encryption<\/strong>? FileVault is Apple’s encryption tool that creates an additional login window, known as the FileVault login window.<\/li>\n\n\n\n
- How do you identify the FileVault login window<\/strong>?\n
- \n
- The JumpCloud Service Account appears at the FileVault window.<\/li>\n\n\n\n
- On Apple Silicon devices, pressing Option<\/strong> + Shift<\/strong> + Enter<\/strong> presents an option to enter the Recovery Key to unlock the disk. To clear this and return to the user list, click the back arrow,<\/strong> or press the Escape <\/strong>key.
![\"Enter](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/10\/macos_filevault_login_window_recovery_key.png\")
<\/li>\n<\/ul>\n<\/li>\n\n\n\n- How often do users need to perform this initial login?<\/strong> Users only need to log in at the FileVault window once to decrypt the disk, which is necessary only on startup or after a reboot.<\/li>\n\n\n\n
- Is the device connected to the network here? <\/strong>The device isn\u2019t connected to any network as the operating system isn\u2019t fully loaded. The JumpCloud agent cannot check into the Admin Portal, where the device will show as inactive.<\/li>\n\n\n\n
- Is MFA required here? <\/strong>No, the FileVault window doesn\u2019t prompt for device MFA. You\u2019ll be prompted for MFA at the device login window. <\/li>\n\n\n\n
- How does FileVault handle password changes<\/strong>? Password changes from the Admin Portal or the User Portal won\u2019t affect the FileVault login window because the device is inactive and not connected to a network.<\/li>\n\n\n\n
- How is the FileVault password updated?<\/strong> The recommended method for password changes is through the JumpCloud Mac Menu Bar app as it automatically updates the FileVault password. Other password reset methods only change the JumpCloud user password and require additional steps such as entering the password at the device login window to sync with FileVault.<\/li>\n\n\n\n
- What should a user do if they’re locked out?<\/strong> If a user is locked out at the FileVault window on a device with JumpCloud’s FileVault 2 MDM policy, retrieve the recovery key from the JumpCloud admin portal to bypass\/decrypt FileVault and access the user login window.<\/li>\n<\/ul>\n\n\n\n
JumpCloud macOS User Login Window<\/h2>\n\n\n\n
On JumpCloud managed devices, after entering the FileVault password, the JumpCloud macOS login window appears. <\/p>\n\n\n\n
Considerations<\/strong>: <\/p>\n\n\n\n
- \n
- The JumpCloud login window only appears if Self-Service Account Provisioning feature is enabled. See Provision New Users on Device Login<\/a> to learn more. <\/li>\n\n\n\n
- Jump to Alternate macOS User Login Window<\/a> to learn about the default login window when this feature is disabled. <\/li>\n<\/ul>\n\n\n\n
![\"The](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/10\/macos_device_login_window_jumpcloud.png\")
<\/p>\n\n\n\n- \n
- How do you identify the JumpCloud login window<\/strong>? This login window has a bottom navigation bar with power, network, and refresh options in addition to the JumpCloud logo. The JumpCloud Service Account won\u2019t appear here either. <\/li>\n\n\n\n
- Is the device connected to the network here? <\/strong>At the user login window, the device will be connected to WiFi if the credentials are cached or connected via an ethernet connection.<\/li>\n\n\n\n
- At what point does the JumpCloud agent consider the device active?<\/strong> The device should be in an active state when it\u2019s connected to the internet and able to check in.<\/li>\n\n\n\n
- How does device MFA alter the login experience? <\/strong>With device MFA enabled and enforced in JumpCloud, the TOTP<\/strong> and PUSH<\/strong> buttons appear below the password field. Select the appropriate MFA method and proceed to log in.
![\"TOTP](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/10\/macos_device_login_window_mfa_jumpcloud.png\")
<\/li>\n\n\n\n- If the JumpCloud password is changed elsewhere does it apply here<\/strong>? Yes, password changes from the Admin Portal or the User Portal will apply here on next login. However, if the user is able to log in to the device, password changes using the JumpCloud menu bar app are recommended.<\/li>\n\n\n\n
- What happens when a user logs out of their device account? <\/strong>When users log out, they return to the JumpCloud login window, not the FileVault window.<\/li>\n\n\n\n
- Do JumpCloud policy and user updates apply here?<\/strong> At the user login window, the agent is active, and the device will receive user and policy updates made in the JumpCloud Admin Portal.<\/li>\n<\/ul>\n\n\n\n
Alternate macOS User Login Window<\/h3>\n\n\n\n
When Self-Service Account Provisioning is disabled, the device login window more closely resembles the default macOS login window.
![\"The](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/10\/macos_device_login_window_ssao_disabled.png\")
<\/p>\n\n\n\n- \n
- How do you identify this login window? <\/strong>\n
- \n
- The JumpCloud Service Account doesn\u2019t appear.<\/li>\n\n\n\n
- Pressing Option<\/strong>+Shift<\/strong>+Enter<\/strong> key combination has no effect.<\/li>\n\n\n\n
- Selecting a user presents a square password login box.
<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Troubleshoot: FileVault Password Doesn’t Sync<\/h2>\n\n\n\n
Problem<\/strong>: A user may get stuck on the FileVault login window if their FileVault password hasn\u2019t synced with their JumpCloud password.<\/p>\n\n\n\n
Cause<\/strong>: This issue can be caused by an off-device password reset, an unhealthy service account, or an incomplete account takeover process.<\/p>\n\n\n\n
Resolution<\/strong>: To resolve this, follow these troubleshooting steps:<\/p>\n\n\n\n
- \n
- Confirm user is at the FileVault window<\/strong>: Verify that the user is on the FileVault login window and not the JumpCloud user login window. The best method to identify this is the presence of the JumpCloud Service Account.\u00a0<\/li>\n\n\n\n
- Reset the user\u2019s password using recommended methods<\/strong>: Ensure that any password resets are performed through the Menu Bar app on the macOS device which correctly updates both JumpCloud and FileVault passwords simultaneously.\n
- \n
- See Users: Change Your MacOS Password<\/a> to learn more.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Complete the user account takeover process<\/strong>: Make sure the takeover process for managing the user account and passwords via JumpCloud has been completed.\n
- Reset the user\u2019s password using recommended methods<\/strong>: Ensure that any password resets are performed through the Menu Bar app on the macOS device which correctly updates both JumpCloud and FileVault passwords simultaneously.\n
- Selecting a user presents a square password login box.
- Is the device connected to the network here? <\/strong>At the user login window, the device will be connected to WiFi if the credentials are cached or connected via an ethernet connection.<\/li>\n\n\n\n
- Jump to Alternate macOS User Login Window<\/a> to learn about the default login window when this feature is disabled. <\/li>\n<\/ul>\n\n\n\n
- How often do users need to perform this initial login?<\/strong> Users only need to log in at the FileVault window once to decrypt the disk, which is necessary only on startup or after a reboot.<\/li>\n\n\n\n
- How do you identify the FileVault login window<\/strong>?\n
- What is FileVault encryption<\/strong>? FileVault is Apple’s encryption tool that creates an additional login window, known as the FileVault login window.<\/li>\n\n\n\n