topic Re: Unexpected Decryption on OS patching or Agent Upgrade - macOS in Endpoint

Unexpected Decryption on OS patching or Agent Upgrade - macOS

Saul_Goodman — Mon, 26 Sep 2022 18:29:38 GMT

Hi Checkmates,

does anyone having an event when the Harmony Endpoint FDE Filevault decrypt/encrypts the disk whenever they have OS patching or harmony endpoint agent upgrade activity on their Mac.

is this the right behavior and is working as is? if yes can someone provide proper documentation

or not and could be a software issue which can be fixed by R&D?

macOS versions - Big Sur, Catalina, Mojave and Monterey

Harmony Endpoint Agent Version - Starting from E85.30 and up

Re: Unexpected Decryption on OS patching or Agent Upgrade - macOS

_Val_ — Tue, 27 Sep 2022 07:34:30 GMT

FDE on Mac relies on OS for disk encryption. I would assume the mentioned behavior is caused by OS and not the client. To be sure, please open a TAC case for this.

Re: Unexpected Decryption on OS patching or Agent Upgrade - macOS

PhoneBoy — Tue, 27 Sep 2022 17:43:19 GMT

What evidence have you seen that Filevault is decrypting?

Remember that Apple made changes to macOS so we cannot use our native FDE and must use Filevault.
The only time I believe we tell Filevault to decrypt would be when we uninstall the Endpoint client.