How's FileVault and APFS Encryption working for You?

[isomorphic]

If you want to turn on FV and it not take several hours, do so during a fresh drive install of the OS. If not, turn it on and be patient. I had no problems with it and was able to use my computer during the process, although doing that can make the process longer.

If I remember correctly, it took about 2 hours for me (as I turned it on after the install) and I only had 130 GB (give or take) on my 1TB SSD.

As a counterpoint, I'm booting from an external (USB3) Samsung 840 Pro. I formatted the drive as part of the High Sierra install process, but forgot to enable FileVault during the install. I enabled FileVault once the OS was loaded. We're on day two and it's just over half done. I'm giving up and going to reformat and reinstall. That kind of speed is... not acceptable.

(Edit: The machine is unusable while this is going on.)

Someone probably should have checked to ensure APFS I/O speed doesn't go to #@$% when enabling FileVault or using USB3. Or perhaps I've triggered some weird edge case. I will note that FileVault seems much, much slower with APFS even on a (different machine) maxed-out Mac Pro with internal SSD. I was under the impression that iOS stored everything encrypted, so you'd think all of this would've had a shakedown already when APFS was deployed there.

 

[steve62388]

I had a bad first and only experience turning on FV towards the middle/end of the beta cycle. I am gun shy to try it again but I know I should have some protection. There was a ton of FV issues throughout the beta as referenced in the release notes. Just wanted to see if it's ready for prime time.

I can't even enable FV on my Macbook and I have no idea how to fix the problem. I posted here https://forums.macrumors.com/threads/cant-enable-filevault.2072175/ but it either got buried in the avalanche of HS posts or nobody has a scooby. My iMac with FV already turned on converted fine.

 

[Floris]

My idea was with High Sierra to do a fresh install on the really fast 2gb write and 2,6gb read 1TB ssd to turn on FV, but during beta I already read a few caveats and problems, and was hoping the stable release would have solved those.

Since I dont' want to try this on the personal system as i can't just undo it .. i was hoping the fast ssd and cpu/ram etc would make the encryption perform almost unnoticeable...

I guess I am going back to storing certain data fully encrypted ~ using my shell scripts .. as before.

 

[LarryJoe33]

Well, as I said originally, my first experience with FV was bad and now I am 0-2. If it somehow thinks for whatever reason that I (the Admin of the machine) do not have credentials to enable FV, I could only imagine the possibility of being locked out of my machine/data if it somehow didn't like my credentials after it ran.

I want to use FV, just not a great feeling having these issues, as well as all the bugs and references to FV in the release notes throughout the High Sierra beta period. Hopefully someone will post a fix for my issue other than a clean install. I'm not willing to do the latter just yet, not for FV, everything is running fine.

I hope some of these certificate/token terminal commands didn’t screw up anything else for me. I do have a “other user” at login now that I didn’t have before (in addition to my usual and guest) now and the username is my last name with my usual password but it logs me into my usual account. No reference to “other user” in settings.

 

[JaxGator3]

Sorry to hijack the thread but I think I have a similar issues that I would love some advice on. I had the double password and the extra “other" user issue. To try and fix this I turned off FV (took 3 days to decrypt, 2011 iMac with a 1TB SSD) Now when I try and turn FV back on I get the error "Authentication server failed to complete the requested operation” I would be very grateful of any help or advice.

Same exact chain of events and issues. HS install prompted me to set a new account password to not match iCloud, double password prompt with account and icloud during login, turned off filevault to resolve, 1.5 days to decrypt, double login gone (but back to using iCloud password), and now error when trying enable filevault.

I may be backing up data and doing a fresh install. Too many gremlins with the upgrade for me to be comfortable going forward.

 

[JISystems]

Same exact chain of events and issues. HS install prompted me to set a new account password to not match iCloud, double password prompt with account and icloud during login, turned off filevault to resolve, 1.5 days to decrypt, double login gone (but back to using iCloud password), and now error when trying enable filevault.

I may be backing up data and doing a fresh install. Too many gremlins with the upgrade for me to be comfortable going forward.

What did you end up doing ? I think I might go the same way and do a clean install.

 

[Floris]

It seems logical that the pass you set for filevault can't be the same as iCloud, as the key for both are stored in different locations.

 

[JISystems]

It seems logical that the pass you set for filevault can't be the same as iCloud, as the key for both are stored in different locations.

It's strange as I have been doing that for years it only changed when I upgraded to High Sierra. Also now I cant even turn FV on

 

[Floris]

I got no response back from Apple on the matter. Just a link to how to turn on FV on their support community.

 

[Floris]

Haha, turns out that encrypting wasn't even effective; https://medium.com/@matheusmariano/...d-of-an-encrypted-apfs-container-b4f2f5326e79

They had ONE job 1 !
The whole purpose of encryption is moot if the bug is that the password is displayed.
That's just utterly embarrassing. No matter what excuse you have for it.

 

[LarryJoe33]

This is just another reason why I am apprehensive about FV. Probably a good thing I'm not able to turn it on.

 

[Ritsuka]

That bug had nothing to do with FileVault. It affected only encrypted disk created manually in Disk Utility.

 

[cubbie5150]

I really had no complaints about performance with APFS encryption (enabled during clean HS install). That stupid bug w/ guest account stubbornly showing up on the login screen (even though I have guest account disabled) is annoying. I turned off FV & it fixed that problem, but I want encryption turned on, so I turned it back on after a day. I'll just be annoyed looking at that damn guest account icon when logging in, hahaha.

 

[Weaselboy]

I really had no complaints about performance with APFS encryption (enabled during clean HS install).

So you did a clean install and before the install you used Disk Util to format to APFS encrypted, then did the install?

If that is what you did, that is the reason you had problems. When you turn on FileVault from System Preferences it makes some changes to how the system boots and sets up the recovery volume to handle the boot and login screen process. When you format to encrypted first, then install, that configuration process does not get done properly and you have these odd problems.

 

[r2nand2]

Sorry to hijack the thread but I think I have a similar issues that I would love some advice on. I had the double password and the extra “other" user issue. To try and fix this I turned off FV (took 3 days to decrypt, 2011 iMac with a 1TB SSD) Now when I try and turn FV back on I get the error "Authentication server failed to complete the requested operation” I would be very grateful of any help or advice.

Same issue here, neither the iCloud or local key is working for me. Always "Authentication server failed to complete the requested operation” alert.

 

[Apple_Robert]

I really had no complaints about performance with APFS encryption (enabled during clean HS install). That stupid bug w/ guest account stubbornly showing up on the login screen (even though I have guest account disabled) is annoying. I turned off FV & it fixed that problem, but I want encryption turned on, so I turned it back on after a day. I'll just be annoyed looking at that damn guest account icon when logging in, hahaha.

In my opinion, the best course of action is to wipe the disk, do a clean install, and enable the FV option during the install process. That should solve your problem.

 

[r2nand2]

Sorry to hijack the thread but I think I have a similar issues that I would love some advice on. I had the double password and the extra “other" user issue. To try and fix this I turned off FV (took 3 days to decrypt, 2011 iMac with a 1TB SSD) Now when I try and turn FV back on I get the error "Authentication server failed to complete the requested operation” I would be very grateful of any help or advice.

Fixed the problem!

I was able to activate File Vault after update my iCloud/user password.

No ideia why, but tried after I found it: https://www.reddit.com/r/MacOS/comments/74scld/unable_to_turn_on_filevault_on_high_sierra_apfs/

 

[LarryJoe33]

Fixed the problem!

I was able to activate File Vault after update my iCloud/user password.

No ideia why, but tried after I found it: https://www.reddit.com/r/MacOS/comments/74scld/unable_to_turn_on_filevault_on_high_sierra_apfs/

Hi, I read the Reddit quickly and will do so more throughly. It appeared to use terminal to look for users with the correct privileges. That said, did you just simply give yourself a new Password for your Apple ID and it worked?

 

[r2nand2]

That said, did you just simply give yourself a new Password for your Apple ID and it worked?

That's right.

 

[LarryJoe33]

That's right.

No such luck for me. I tried it. I still have Token DISABLE and same error message.

 

[LarryJoe33]

I have no users with an enabled token. How can this be? Very frustrating. I give up on FV, but I am wondering if not having and enabled tokens on my machine will be problematic in some way (restoring time machine?).

 

[Apple_Robert]

I have no users with an enabled token. How can this be? Very frustrating. I give up on FV, but I am wondering if not having and enabled tokens on my machine will be problematic in some way (restoring time machine?).

If you have all your important files backed up and you know the backups are good, why are you sitting around being frustrated with a corrupt OS install? That makes no sense to me. You know what it takes to resolve the issue. Why not do that? So what if it is a little time consuming. At the same time, it isn't as big a deal as you are making it out to be.

 

[Stef202]

I have an imac 512 GB SSD and Filevault activated in Sierra and plan to change to High Sierra.
The reason why I acitvated File Vault is that in case of shipping the imac back to apple for repair or even selling it some day not to give those people access to my data.

I did not understand the benefit of having APFS (encrypted) AND File Vault activated???
Please, explain to me.

My plan now is to deactivate File Vault and change to High Sierra with APFS encrypted.

 

[Weaselboy]

I have an imac 512 GB SSD and Filevault activated in Sierra and plan to change to High Sierra.
The reason why I acitvated File Vault is that in case of shipping the imac back to apple for repair or even selling it some day not to give those people access to my data.

I did not understand the benefit of having APFS (encrypted) AND File Vault activated???
Please, explain to me.

My plan now is to deactivate File Vault and change to High Sierra with APFS encrypted.

You are confusing the feature name FileVault with the underlying technology used to do the encryption.

Right now FileVault under Sierra uses HFS+ encrypted as the format type. When you upgrade to HS, that will automatically be converted to APFS encrypted. Both are still FileVault.

You don't need to do anything. Just install HS and it will covert the drive format to APFS encrypted, and you will still have FileVault enabled and you will be all done.

 

[LarryJoe33]

If you have all your important files backed up and you know the backups are good, why are you sitting around being frustrated with a corrupt OS install? That makes no sense to me. You know what it takes to resolve the issue. Why not do that? So what if it is a little time consuming. At the same time, it isn't as big a deal as you are making it out to be.

Thanks for your input. I guess from my perspective, I would not exactly call my OS install corrupted. It's running extremely smoothly. No freezes, crashes, etc. To wipe my hard drive clean and reinstall to use FileVault means I would have to restore all my personal settings. Even something as trivial as how I like my trackpad set up and all the gestures would have to be reset, correct?

I guess it's somewhat annoying to me that I can't find a fix. It's more of a challenge at this point. Yes, I know I can wipe it and fix it. I did a lot of that in my Windows days. It should not always be the answer to every problem. I think people wipe way to often. Not to mention, I did get FileVault running with a derivative of this install somewhere along the beta program. So, my credentials and token had to be ok at some point.