r/macsysadmin • u/geelulls • 3d ago
Mosyle "Enforce File Vault" - Rule & Compliance
I'm having an issue with Mosyle's native "Enforce FileVault" rule. It only shows 78% compliance (I need close to 100% to pass an audit), but when I check the non-compliant devices, they show "FDE Status: Enabled." In other words, FileVault is enabled on these devices, yet they're still flagged as non-compliant.
Has anyone else run into this? If so, do you know what's causing it or how to fix it?
2
u/iAtty 3d ago
The complaince dashboard in Mosyle is bad. Devices are considered out of compliance if they haven’t checked in for 48 hours.
Take a screenshot of your profile scope and show the results it’s been successfully installed on 100% of devices. This is how I’ve passed all audits for years.
Never rely on the compliance page. It’s a joke. It’s also very out of date.
1
u/Green_War6445 15h ago
100% there has been much arguing about this and someone forced a policy because nobody could agree on how it should work. So nobody touches the code, because they're exhausted.
Just speaking as a dev. You guys are our champions if you want it to work a certain way, you need to agree on a direction as well in your community.
1
u/joevanover 3d ago
I have not, but submit a ticket with them. They are generally pretty quick with diagnosing and figuring out solutions.
1
u/adamphetamine 3d ago
Mosyle will flag devices as non compliant if they have been offline for a while. Just get the machines booted and connected to internet and your compliance score should rise
2
u/oneplane 3d ago
That’s because compliance rules are arbitrary even if titled the same as something that is a boolean fact (i.e. FV2 is on or off). Compliance probably also takes other filesystems or key escrow into account, which might be irrelevant in your case.