You can use the JSS to create smart computer groups that can be used as the scope of FileVault tasks. FileVault smart computer groups can be based on the following criteria:

Computers that are eligible to be FileVault encrypted but are not yet encrypted
Computers that are FileVault encrypted
Computers that are in a specific FileVault partition encryption state
Computers that are not eligible to be FileVault encrypted
Computers with an invalid individual recovery key
Computers on which a specified user is enabled for FileVault

After creating a smart computer group, you can view its memberships.

Note: You can create smart computer groups based on additional FileVault criteria that are not covered in this guide. For information on all FileVault smart group criteria, see the following Knowledge Base article:
Smart Group and Advanced Search Criteria for FileVault 2 and Legacy FileVault

Creating a Smart Group of Computers that are Eligible to be FileVault Encrypted but are Not Yet Encrypted

Log in to the JSS with a web browser.
Click Computers at the top of the page.
Click Smart Computer Groups.
On a smartphone, this option is in the pop-up menu.
Click New .
On the Computer Group pane, enter a display name for the group.
To enable email notifications, select the Send email notification on membership change checkbox.
Click the Criteria tab.
Click Add .
Click Choose for “All Criteria”, and then click Choose for “FileVault 2 Eligibility”.
When the criteria is displayed, make sure the operator is set to “is”.
Click Browse , and then click Choose for “Eligible”.
Click Add .
Click Choose for “All Criteria”, and then click Choose for “FileVault 2 Partition Encryption State”.
When the criteria is displayed, make sure the operator is set to “is”.
Click Browse , and then click Choose for “Not Encrypted”.
Choose “and” from the And/Or pop-up menu to specify the relationship between the criteria.
Click Save.

Group memberships are updated each time computers check in with the JSS and meet or fail to meet the specified criteria.

To view the group’s membership, click View.

Creating a Smart Group of Computers that are FileVault Encrypted

Log in to the JSS with a web browser.
Click Computers at the top of the page.
Click Smart Computer Groups.
On a smartphone, this option is in the pop-up menu.
Click New .
On the Computer Group pane, enter a display name for the group.
To enable email notifications, select the Send email notification on membership change checkbox.
Click the Criteria tab.
Click Add .
Click Choose for “All Criteria“, and then click Choose for “FileVault 2 Status”.
When the criteria is displayed, make sure the operator is set to “is”.
Click Browse , and then click Choose for “Boot Partitions Encrypted”.
Click Save.

Group memberships are updated each time computers check in with the JSS and meet or fail to meet the specified criteria.

To view the group’s membership, click View.

Creating Smart Groups of Computers with a Partition in a Specific Encryption State

You can create a smart group of computers with a partition that is in any of the following encryption states:

Decrypted
Decrypting
Encrypted
Encrypting
Ineligible
Not Encrypted
Unknown

Log in to the JSS with a web browser.
Click Computers at the top of the page.
Click Smart Computer Groups.
On a smartphone, this option is in the pop-up menu.
Click New .
On the Computer Group pane, enter a display name for the group.
To enable email notifications, select the Send email notification on membership change checkbox.
Click the Criteria tab.
Click Add .
Click Choose for “All Criteria“, and then click Choose for “Partition Name”.
Choose “has” from the Operator pop-up menu.
Type a partition name in the Value field, or click Browse , and then click Choose for “Boot Partition”.
Click Add .
Click Choose for “All Criteria“, and then click Choose for “FileVault 2 Partition Encryption State”.
When the criteria is displayed, make sure the operator is set to “is”.
Click Browse , and then click Choose for the encryption state you want to base the group on.
Choose “and” from the And/Or pop-up menu to specify the relationship between the criteria.
Click Save.

Group memberships are updated each time computers check in with the JSS and meet or fail to meet the specified criteria.

To view the group’s membership, click View.

Creating a Smart Group of Computers that are Not Eligible for FileVault Encryption

You can create a smart group of computers that do not have an institutional recovery key.

Log in to the JSS with a web browser.
Click Computers at the top of the page.
Click Smart Computer Groups.
On a smartphone, this option is in the pop-up menu.
Click New .
On the Computer Group pane, enter a display name for the group.
To enable email notifications, select the Send email notification on membership change checkbox.
Click the Criteria tab.
Click Add .
Click Choose for “All Criteria“, and then click Choose for “FileVault 2 Eligibility”.
Choose “is not” from the Operator pop-up menu.
Click Browse , and then click Choose for “Eligible”.
Click Save.

Group memberships are updated each time computers check in with the JSS and meet or fail to meet the specified criteria.

To view the group’s membership, click View.

Creating a Smart Group of Computers with an Invalid Individual Recovery Key

You can create a smart computer group to validate that the individual recovery key on computers matches the key stored in the JSS.

Log in to the JSS with a web browser.
Click Computers at the top of the page.
Click Smart Computer Groups.
On a smartphone, this option is in the pop-up menu.
Click New .
On the Computer Group pane, enter a display name for the group.
To enable email notifications, select the Send email notification on membership change checkbox.
Click the Criteria tab.
Click Add .
Click Choose for “All Criteria“, and then click Choose for “FileVault 2 Individual Key Validation”.
When the criteria is displayed, make sure the operator is set to “is”.
Click Browse , and then click Choose for “Invalid”.
Click Save.

Group memberships are updated each time computers check in with the JSS and meet or fail to meet the specified criteria.

To view the group’s membership, click View.

Creating a Smart Group of Computers for Which a Specified User is Enabled for FileVault

You can create a smart computer group to identify the computers for which a specified user is enabled for FileVault.

Log in to the JSS with a web browser.
Click Computers at the top of the page.
Click Smart Computer Groups.
On a smartphone, this option is in the pop-up menu.
Click New .
On the Computer Group pane, enter a display name for the group.
To enable email notifications, select the Send email notification on membership change checkbox.
Click the Criteria tab.
Click Add .
Click Choose for “All Criteria“, and then click Choose for “FileVault 2 User”.
When the criteria is displayed, make sure the operator is set to “has”.
Enter a username, or click Browse , and then click Choose for a FileVault 2-enabled user.
Click Save.

Group memberships are updated each time computers check in with the JSS and meet or fail to meet the specified criteria.

To view the group’s membership, click View.

Creating Smart Computer Groups for FileVault

Creating a Smart Group of Computers that are Eligible to be FileVault Encrypted but are Not Yet Encrypted

Creating a Smart Group of Computers that are FileVault Encrypted

Creating Smart Groups of Computers with a Partition in a Specific Encryption State

Creating a Smart Group of Computers that are Not Eligible for FileVault Encryption

Creating a Smart Group of Computers with an Invalid Individual Recovery Key

Creating a Smart Group of Computers for Which a Specified User is Enabled for FileVault

Search results