Mojave on Mac Pro 2009, Can’t enable FileVault?

[DIY_glenn]

So I was finally able to finish my clean install of Mojave. I got all my drives formatted with APFS.
I didn’t choose encrypted, as I would rather enable through filevault later, and get the key in iCloud.
For some reason though, it won’t let me.

The error message is something like “FileVault cannot be used on this system and with this operating system”.
What...? Why?

 

[bookemdano]

Because Apple's recommended GPUs for the cMP in Mojave can't display anything in the EFI environment (which is where the FileVault password screen is). Rather than figure out a way to do that (or allow it for the few metal-capable cards that can display those screens) they chose to disable it wholesale. All avenues for enabling it are blocked.

Kinda sucks that they don't tell you that prior to welcoming you to download and install it.

FYI you won't be able to use Boot Camp Assistant either. Of course, there are workarounds for installing Windows, but not for FileVault. You're SOL.

Edit: I should add the only maybe possible way to get around that would be to connect your disk to another Mac, install Mojave, enable FV, and then move the disk back to the cMP. That would only be worth trying if you have a GTX 680 Mac Edition or 7950 Mac Edition (or another metal-capable card with boot screen support). I have not tested it so maybe that won't work either, but probably worth a try.

 

[DIY_glenn]

Because Apple's recommended GPUs for the cMP in Mojave can't display anything in the EFI environment (which is where the FileVault password screen is). Rather than figure out a way to do that (or allow it for the few metal-capable cards that can display those screens) they chose to disable it wholesale. All avenues for enabling it are blocked.

Kinda sucks that they don't tell you that prior to welcoming you to download and install it.

FYI you won't be able to use Boot Camp Assistant either. Of course, there are workarounds for installing Windows, but not for FileVault. You're SOL.

Edit: I should add the only maybe possible way to get around that would be to connect your disk to another Mac, install Mojave, enable FV, and then move the disk back to the cMP. That would only be worth trying if you have a GTX 680 Mac Edition or 7950 Mac Edition (or another metal-capable card with boot screen support). I have not tested it so maybe that won't work either, but probably worth a try.

Man, that sucks. I do have the GTX 680, so I can see everything when booting. I unfortunately do not have any other Macs to enable this with. I have just managed to clean install Mojave after first installing High Sierra on a second drive, and then installing Mojave to the main drive. I thought my issues would be over by now, but clearly not.

I really hoped I would be able to get FileVault enabled before I started using the computer, but guess I’ll have to live with it.

Is this problem new from Mojave? Could it be addressed in 10.14.X?

 

[w1z]

It's possible but requires a clean installation of Mojave and a Mac EFI GPU ... Follow my instructions here

 

[DIY_glenn]

It's possible but requires a clean installation of Mojave and a Mac EFI GPU ... Follow my instructions here

I tested on one of my other drives, and surely I could format as APFS Encrypted. Is this FileVault?

Of course that means the whole process of reinstalling my system... which I could handle.
I’m still a bit confused on APFS Encrypted vs. FileVault.

And I can’t use iCloud for the key then?

 

[bookemdano]

It's possible but requires a clean installation of Mojave and a Mac EFI GPU ... Follow my instructions here

Interesting... I didn't see your post on it until you just linked it, but I actually tried that yesterday. I was going to clean install the release version of Mojave anyway onto a new drive so I tried that exact sequence--booting from the USB installer, erasing the install disk as APFS (encrypted) and setting the password.

But when I then quit disk utility and went to install Mojave, I couldn't choose that disk--it said it could not install onto a an encrypted volume.

The difference is that I've got an RX 580 installed (thus no boot screens). So is the macOS installer smart enough to check for the presence of an EFI GPU? If so, I wonder why they didn't build that same intelligence into the other avenues of enabling FV.

I hope others will try this method also to see if the installer lets them proceed with an install to a pre-encrypted volume.
[doublepost=1538594099][/doublepost]

I tested on one of my other drives, and surely I could format as APFS Encrypted. Is this FileVault?

Of course that means the whole process of reinstalling my system... which I could handle.
I’m still a bit confused on APFS Encrypted vs. FileVault.

And I can’t use iCloud for the key then?

Yes since the debut of APFS, the "APFS (encryped)" format is the same thing as FileVault.

Edit: As an aside, were you actually able to install Mojave from USB with a GTX 680? I've read a bunch of posts here from people who said that the USB installer mistakenly thinks that the 680 is not metal-capable and will not let you install. People in that situation have had to boot from High Sierra and run the Mojave installer from there. I re-read your post above that you did install Mojave from within HS. Unfortunately I don't think you will be able to use W1SS's method because it depends on booting from the USB installer, which will not work with your 680. Hopefully, Apple will fix that bug with 10.14.1.

 

[w1z]

Interesting... I didn't see your post on it until you just linked it, but I actually tried that yesterday. I was going to clean install the release version of Mojave anyway onto a new drive so I tried that exact sequence--booting from the USB installer, erasing the install disk as APFS (encrypted) and setting the password.

But when I then quit disk utility and went to install Mojave, I couldn't choose that disk--it said it could not install onto a an encrypted volume.

The difference is that I've got an RX 580 installed (thus no boot screens). So is the macOS installer smart enough to check for the presence of an EFI GPU? If so, I wonder why they didn't build that same intelligence into the other avenues of enabling FV.

Can you check if the APFS encrypted volume was mounted after erasing it? Also, what USB installer method did you opt for?
[doublepost=1538594682][/doublepost]

I tested on one of my other drives, and surely I could format as APFS Encrypted. Is this FileVault?

Of course that means the whole process of reinstalling my system... which I could handle.
I’m still a bit confused on APFS Encrypted vs. FileVault.

And I can’t use iCloud for the key then?

Yes, it is filevault and you can confirm this after the installation and setup. You also shouldn't have any issue with Cloud Keychain if that's what you are asking. I don't use it but you can try.

 

[bookemdano]

Can you check if the APFS encrypted volume was mounted after erasing it? Also, what USB installer method did you opt for?
[doublepost=1538594682][/doublepost]

Yes, it is filevault and you can confirm this after the installation and setup. You also shouldn't have any issue with Cloud Keychain if that's what you are asking. I don't use it but you can try.

I used createinstallmedia. Since I don't have an EFI GPU (thus no boot picker) I had to pull all bootable drives from the chassis, leaving only the blank installation drive and the USB stick with the installer. Long black screen waiting for it to boot from the USB flash drive. Then I immediately went into Disk Utility and proceeded to erase the drive as APFS (encypted), which worked fine.

Yes, the volume was re-mounted after it was erased with disk utility.

I will try this again today when I get back to my cMP. Obviously, with a non-EFI GPU it's not viable for me to enable FV anyway, but I was curious if Apple had blocked that method also. If it worked for you that's definitely encouraging though. I will report back later today.

Edit: and I think OP was speaking about losing the ability to store your recovery key in iCloud, which is normally offered when enabling FV through the GUI. I think he was asking if there is any way to do that after the fact. I don't believe so, but have never actually looked into it.

 

[w1z]

I don't think you will be able to use W1SS's method because it depends on booting from the USB installer, which will not work with your 680. Hopefully, Apple will fix that bug with 10.14.1.

@DIY_glenn Try dosdude's Mojave patcher if you are having issues with Apple's createinstallmedia installer. Also, you can create the installer on an internal partition using dosdude's patcher... many options, pick what works for you.

 

[bookemdano]

@DIY_glenn Try dosdude's Mojave patcher if you are having issues with Apple's createinstallmedia installer. Also, you can create the installer on an internal partition using dosdude's patcher... many options, pick what works for you.

Does dosdude's patcher remove the check for a metal-enabled GPU? Because that is what makes the USB installer fail with a GTX 680 installed), whereas when run from within High Sierra that GPU passes the check. Obviously a bug Apple neglected to fix, but if dosdude's patcher eliminates that check that would be good for folks with the 680.

 

[w1z]

I used createinstallmedia. Since I don't have an EFI GPU (thus no boot picker) I had to pull all bootable drives from the chassis, leaving only the blank installation drive and the USB stick with the installer. Long black screen waiting for it to boot from the USB flash drive.

Yes, the volume was re-mounted after it was erased with disk utility.

I will try this again today when I get back to my cMP. Obviously, with a non-EFI GPU it's not viable for me to enable FV anyway, but I was curious if Apple had blocked that method also. If it worked for you that's definitely encouraging though. I will report back later today.

When there's a will, there's a way (always) .. Use dosdude1's mojave patcher to create the USB and try again. If you succeed and you see a blank white/black screen with no progress after the system restarts, which is due to the absence of a mac efi card, enter the filevault password carefully and hit enter.

Let us know please as I am sure other filevault users will be interested in your results.
[doublepost=1538595805][/doublepost]

Does dosdude's patcher remove the check for a metal-enabled GPU? Because that is what makes the USB installer fail with a GTX 680 installed), whereas when run from within High Sierra that GPU passes the check. Obviously a bug Apple neglected to fix, but if dosdude's patcher eliminates that check that would be good for folks with the 680.

Not sure really but you can try. I have an MVC flashed 680 on hand but used my other MVC 780 with my instructions.

Edit: Got confused with the many replies @DIY_glenn is the one with the 680.

 

[bookemdano]

When there's a will, there's a way (always) .. Use dosdude1's mojave patcher to create the USB and try again. If you succeed and you see a blank white/black screen with no progress after the system restarts, which is due to the absence of a mac efi card, enter the filevault password carefully and hit enter.

Let us know please as I am sure other filevault users will be interested in your results.

I will definitely test it again with my createinstallmedia method USB drive, and then will try dosdude1's patcher, time permitting.

Not sure I'm that keen on using FV2 blind, but maybe I'll try it for a while (assuming I can get this to work with the 580 installed). I wonder if FV2 can be turned off via the normal way in Mojave. Something else to test.

 

[w1z]

Not sure I'm that keen on using FV2 blind, but maybe I'll try it for a while (assuming I can get this to work with the 580 installed). I wonder if FV2 can be turned off via the normal way in Mojave. Something else to test.

I personally wouldn't but there's no harm in trying. I noticed that you only needed to enter the disk password once during the installation after which it is linked to the user account created during installation. You won't be able to see that user account on the login window and will have to enter the password blindly.

There is another option for 4,1/5,1 users with no mac efi GPUs but it provides partial encryption - OS/Apps residing on a normal apfs volume with the users' home folders residing on an encrypted apfs volume but you will need to login in with a secondary admin user account to 'manually' mount the encrypted partition then switch to your encrypted user account on every boot. I could share the steps if you are interested in that.

 

[DIY_glenn]

So I deleted everything, and yes - I’m stuck with not being able to install to an encrypted drive. So this patcher, is that like a hackintosh thing? I’d like to install normally, but guess I’m stuck because of the 680 bug.
High Sierra works as it should. APFS Encrypted shows up as FileVault enabled. I was able to click disable, but it says 9 hours left...

Where can I go from here? Wait for 10.14.1?
Anyone who has the dev that can confirm it will fix the issue?

 

[w1z]

So this patcher, is that like a hackintosh thing? I’d like to install normally, but guess I’m stuck because of the 680 bug.

No it isn't a hackintosh thing - the mojave installer is downloaded directly from Apple's servers . Head over to the macos 10.14 sub forum and read about it. If it isn't for you then stay with High Sierra and wait for Apple to fix the bug.

 

[DIY_glenn]

Is listed as known issue
https://developer.apple.com/documentation/macos_release_notes/macos_mojave_10_14_release_notes
[doublepost=1538597831][/doublepost]

No it isn't a hackintosh thing - the mojave installer is downloaded directly from Apple's servers . Head over to the macos 10.14 sub forum and read about it. If it isn't for you then stay with High Sierra and wait for Apple to fix the bug.

Ok. Thanks. But would FileVault still be disabled?
Maybe they “fix” the installer so your method won’t work either then...

 

[bookemdano]

Dosdude1's patcher is meant to allow the installation of macOS onto Macs that Apple dropped support for (some of them anyway). He has kindly released them for a bunch of macOS versions, so he knows what he's doing. His patchers are widely used, so if there were any super major bugs, they would probably have been found by now. That said, there is always the possibility his patcher would introduce a problem. I think the risk is low, but it is there. So if you're not comfortable with that method (assuming it even works to overcome the 680 bug) then you may want to just wait until 10.14.1 (no ETA on that though, at least not that I've seen).
[doublepost=1538598177][/doublepost]

Is listed as known issue
https://developer.apple.com/documentation/macos_release_notes/macos_mojave_10_14_release_notes
[doublepost=1538597831][/doublepost]
Ok. Thanks. But would FileVault still be disabled?
Maybe they “fix” the installer so your method won’t work either then...

I think he's suggesting to try the dosdude1 patcher to overcome the 680 issue with installing from USB, not the FileVault stuff. If the patcher lets you bypass the 680 bug then you could proceed to try W1SS's method for enabling FileVault prior to install.

And re: Apple "fixing" his method in 10.14.1 that it entirely possible, although at some point I think they draw a line. They're mainly trying to prevent people from accidentally enabling FV and then rebooting to a black screen and not knowing why.

 

[w1z]

Is listed as known issue
https://developer.apple.com/documentation/macos_release_notes/macos_mojave_10_14_release_notes
[doublepost=1538597831][/doublepost]
Ok. Thanks. But would FileVault still be disabled?
Maybe they “fix” the installer so your method won’t work either then...

My method will continue to work as no system files were modified. It only bypasses the restriction Apple put in place so they don't get inundated with support requests from angry customers until they release a fix.. Maybe for the 680 but I wouldn't hold my breath for a fix that addresses their non-mac efi AMD recommendations. Might take them a while or they may never address it.

 

[bookemdano]

See my reply here. There are two possibilities for what makes your method work for you and not for me:

Either dosdude1's patcher removes the cMP 5,1 block for installing onto an encrypted drive

or

The USB installer looks for the presence of an EFI GPU before allowing install onto an encrypted drive.

My hunch is that it's the former. W1SS - did you use dosdude1's patcher to create your bootable installer? If so, maybe you can list what options you chose so others can try to duplicate your method exactly.

If you used createinstallmedia then I guess it is checking for an EFI GPU after all. That would really surprise me though, as all the other blocks for FV in Mojave are just based on the model identifier and block it from all cMPs no matter what GPU is installed.

 

[bookemdano]

See my reply here. There are two possibilities for what makes your method work for you and not for me:

Either dosdude1's patcher removes the cMP 5,1 block for installing onto an encrypted drive

or

The USB installer looks for the presence of an EFI GPU before allowing install onto an encrypted drive.

My hunch is that it's the former. W1SS - did you use dosdude1's patcher to create your bootable installer? If so, maybe you can list what options you chose so others can try to duplicate your method exactly.

If you used createinstallmedia then I guess it is checking for an EFI GPU after all. That would really surprise me though, as all the other blocks for FV in Mojave are just based on the model identifier and block it from all cMPs no matter what GPU is installed.

EDIT: Just want to confirm that it's dosdude1's patcher that allows this method to work. I created an installer with his tool and was allowed to install Mojave to my encrypted drive.

So the method W1SS posted does work, but the "magic" of it is dosdude1's patcher modifications to the Mojave installer (which makes sense since his patcher removes the other checks so Mojave can be installed on Mac models Apple no longer supports). The normal createinstallmedia installer will not allow Mojave to be installed on an encrypted volume on a cMP.

 

[w1z]

EDIT: Just want to confirm that it's dosdude1's patcher that allows this method to work. I created an installer with his tool and was allowed to install Mojave to my encrypted drive.

So the method W1SS posted does work, but the "magic" of it is dosdude1's patcher modifications to the Mojave installer (which makes sense since his patcher removes the other checks so Mojave can be installed on Mac models Apple no longer supports). The normal createinstallmedia installer will not allow Mojave to be installed on an encrypted volume on a cMP.

Glad it worked for you. I will retest Apple's installer again over the weekend as I am sure I tested both installer routes previously.

 

[bookemdano]

Glad it worked for you. I will retest Apple's installer again over the weekend as I am sure I tested both installer routes previously.

I don't think Apple's installer would work for you at all since you're using the Nvidia 680 (which is accidentally blocked as a non-metal card by the installer) and the 780 (which is probably intentionally blocked by the installer since drivers for it are not built into the OS). Maybe that's what led you to use dosdude1's patcher in the first place? It is not actually meant to be used on the MacPro5,1 since that model is natively supported by Mojave.

 

[w1z]

I don't think Apple's installer would work for you at all since you're using the Nvidia 680 (which is accidentally blocked as a non-metal card by the installer) and the 780 (which is probably intentionally blocked by the installer since drivers for it are not built into the OS). Maybe that's what led you to use dosdude1's patcher in the first place? It is not actually meant to be used on the MacPro5,1 since that model is natively supported by Mojave.

I had zero issues with the 780 and again, I tested both routes previously and am surprised with your result. I am leaning more towards your GPU being the issue.

 

[bookemdano]

I had zero issues with the 780 and again, I tested both routes previously and am surprised with your result. I am leaning more towards your GPU being the issue.

I am referring to reports that NVIDIA cards are blocked from installing Mojave via USB (see posts here).

 

[w1z]

I am referring to reports that NVIDIA cards are blocked from installing Mojave via USB (see posts here).

Of course it will be blocked - that's a 980 GPU. 680s and 780s are supported by Apple meaning they don't require Nvidia's web drivers to work out of the box.