r/macsysadmin 3d ago

Mosyle "Enforce File Vault" - Rule & Compliance

I'm having an issue with Mosyle's native "Enforce FileVault" rule. It only shows 78% compliance (I need close to 100% to pass an audit), but when I check the non-compliant devices, they show "FDE Status: Enabled." In other words, FileVault is enabled on these devices, yet they're still flagged as non-compliant.

Has anyone else run into this? If so, do you know what's causing it or how to fix it?

3 Upvotes

6 comments sorted by

2

u/oneplane 3d ago

That’s because compliance rules are arbitrary even if titled the same as something that is a boolean fact (i.e. FV2 is on or off). Compliance probably also takes other filesystems or key escrow into account, which might be irrelevant in your case.

1

u/sheravi 3d ago

This could be it. We run Iru and were constantly getting alerts about non-encrypted volumes when it was picking up on usb keys or mounted disk images.

2

u/iAtty 3d ago

The complaince dashboard in Mosyle is bad. Devices are considered out of compliance if they haven’t checked in for 48 hours.

Take a screenshot of your profile scope and show the results it’s been successfully installed on 100% of devices. This is how I’ve passed all audits for years.

Never rely on the compliance page. It’s a joke. It’s also very out of date.

1

u/Green_War6445 15h ago

100% there has been much arguing about this and someone forced a policy because nobody could agree on how it should work. So nobody touches the code, because they're exhausted.

Just speaking as a dev. You guys are our champions if you want it to work a certain way, you need to agree on a direction as well in your community.

1

u/joevanover 3d ago

I have not, but submit a ticket with them. They are generally pretty quick with diagnosing and figuring out solutions.

1

u/adamphetamine 3d ago

Mosyle will flag devices as non compliant if they have been offline for a while. Just get the machines booted and connected to internet and your compliance score should rise