FileVault Token Revoker

The FileVault Token Revoker tool facilitates the removal of FileVault secure tokens from specified user accounts. It complements the Secure Token Sharing Tool, enabling comprehensive management of secure tokens on macOS devices.

Quick Start

Example Command

Single User Token Revocation

rocketman FileVaultTokenRevoker --username alice

This command revokes the FileVault secure token from the user account "alice."

Multiple Users Token Revocation

rocketman FileVaultTokenRevoker --username alice bob charlie

This command removes FileVault secure tokens from the user accounts "alice," "bob," and "charlie."

Command Options

Required Parameters

None. No required parameters are needed to execute this tool, though specifying users is recommended for targeted token revocation.

Optional Parameters

--username [USER1 USER2 ...]

• Specifies one or more usernames to revoke their FileVault secure tokens.
• Type: array (space-separated list)
• Example:

  rocketman FileVaultTokenRevoker --username alice bob

--domain [string]

• Defines a custom domain identifier for the .plist configuration file.
• Default: tech.rocketman.fileVaultTokenRevoker
• Example:

  rocketman FileVaultTokenRevoker --domain tech.rocketman.customDomain

Important Notes

• Token Revocation Scope: The tool only removes FileVault secure tokens from specified users. If no users are specified via the --username option, the tool will default to user information found in the .plist file located at /Library/Managed Preferences/tech.rocketman.fileVaultTokenRevoker.plist.
• .plist Location: Ensure any custom .plist files are stored in /Library/Managed Preferences/ for correct domain identification.