Due to history, we use BigFix with an different MDM that predates BigFix MCM. After quite a bit of research, I think I’ve found an actionable path forward to bring our lackadaisical installed base up to full supervised MDM with FileVault and escrowed keys.
Note: This approach may not be applicable if you’re using BigFix MCM.
As a high level overview which might be useful to someone else:
-
Analysis properties to assess hardware, running macOS, and maximum OS upgradability.
-
BigFix action to script
profiles status -type enrollmentoutput to a file. Output looks like:
Enrolled via DEP: Yes
MDM enrollment: Yes (User Approved)
MDM server: [REDACTED]
- BigFix action to script
profiles status -type bootstraptokenoutput to a file. Output looks like:
profiles: Bootstrap Token supported on server: YES
profiles: Bootstrap Token escrowed to server: YES
- Analysis properties that parses the output of these files.
- WebReports that filter fields from [1] and [4], resulting in CSV lists of machine to match difference scenarios.
The target workpath includes:
- Can’t be upgraded to Monterey or Ventura? Discard.
- Not in MDM? Enroll.
- MDM isn’t
(User Approved)? Fix it. - Proceed with OS upgrade. (Monterey or Ventura, whichever is maximum)
- Assess Bootstrap Token escrow. If not escrowed, fix it.
I think this gets us to a point where one can proceed with FileVault via MDM, while maintaining manageability for volume ownership and multiple accounts to function normally.
Informative reading: