Force Time Machine Disk Encryption

[MM022]

Is there a place to edit a plist or enforce that anytime you create a Time Machine on a drive it forces the "Encrypt Backup Disk" is checked off?

Trying to setup work machines, and want user to be able to use Time Machine but make sure all backup disks are encrypted.

 

[KALLT]

I do not think that there is something like that. Even if you could disable it there, a user could always reverse the encryption through other means. The biggest problem is that enabling and managing Time Machine itself requires root privileges and this kind of access will also allow these other changes. The best way is to set up and approve the drives manually before and store the encryption keys in the System keychain.

 

[grahamperrin]

A good question.

There's the 2012 Apple technical white paper, Best Practices for Deploying FileVault 2. Also in the Internet Archive Wayback Machine: http://web.archive.org/web/*/http://training.apple.com/pdf/WP_FileVault2.pdf (I expect the original training document to become outdated before 2018).

 

[KALLT]

@grahamperrin: This is about Time Machine though, not FileVault.

 

[grahamperrin]

I should have added the subtitle of the white paper: Deploying OS X Full Disk Encryption Technology. Years have passed since I read the document in its entirety but from what I recall, some of the logic may be applicable in a Time Machine context.