>

List FileVault-Enabled Users with fdesetup

sudo fdesetup list prints every account authorized to unlock the encrypted startup volume, each with its UUID.

macOSfdesetupfilevaultencryptionMedium risk
Run `sudo fdesetup list` to see which users can unlock FileVault; remove one with `sudo fdesetup remove -u username`.

01Command

Command
$ sudo fdesetup list

02What it does

fdesetup status only tells you whether FileVault is on, while list shows the per-user unlock records — the practical audit when former employees or old accounts still appear. Each line pairs a username with the UUID of its cryptographic escape key. Removing a user with fdesetup remove immediately revokes their ability to unlock the disk, which matters during offboarding; keep at least one enabled admin or you risk locking yourself out.

03Risk

RiskMedium risk
Requirementssudo (admin account)
!Warning: Never remove the last enabled user — without an authorized unlock account the disk may become unrecoverable.

04Undo

Undo
$ sudo fdesetup remove -u username

05Sources

  • fdesetup(8) — macOS man page
    Xcode Man Pages (mirror) · technical · 2026-09-17
    Evidence: Documents `fdesetup list` (lists FileVault-enabled users with UUIDs) and `fdesetup remove -u user`.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Create an Encrypted Disk Image with hdiutil
macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17