TweetFollow Us on Twitter

MacEnterprise: Migrating FileVault

Volume Number: 24
Issue Number: 10
Column Tag: MacEnterprise

MacEnterprise: Migrating FileVault

Moving FileVault-encrypted accounts to a new machine

By Greg Neagle, MacEnterprise.org

Another FileVault challenge

A few issues ago, we looked at implementing FileVault in an enterprise environment. FileVault is Apple's technology for securing the contents of a user's home directory. Your organization may wish to protect its users' data on company laptops, in case a laptop is lost or stolen. Using FileVault is one method to accomplish this goal.

In those earlier issues of MacTech, we looked at preparing for FileVault implementation, turning it on for a given user account, and options for managing, automating, and controlling the use of FileVault in your organization. Later, we looked at dealing with some of the day-to-day issues in dealing with FileVault-protected home directories, and methods for recovering from a lost FileVault password.

Moving FileVault Accounts

One thing not covered in the earlier articles is how you might move a FileVault-protected account and home directory from one machine to another. If you are giving a user a new machine, you may need to move his or her existing account and home directory to the new machine. For reasons best known to Apple, the Migration Assistant is of little help in this task - it refuses to migrate a FileVault user unless there are no other users on the target machine. If you have a machine built from a standard image, you may have one or more prebuilt user accounts, like a local administrative account, on the new machine and so the Migration Assistant refuses to move the FileVault-protected user account.

The advice given by the Migration Assistant is to turn off FileVault, move the account, and turn it back on. While this might work, it is problematic for several reasons:

You'll need the user's password, or at least their cooperation, to turn FileVault off. This requires more coordination between you and the user.

You'll need enough available space on the startup disk to make a duplicate of the contents of the user's FileVault-protected home folder. That space may not be available.

Decrypting and re-encrypting the FileVault-protected home directory can take a long time.

If you are using MCX to enforce FileVault, turning it off (and back on) can present a challenge, as the GUI options are disabled.

So it would be better if we could just move the FileVault-protected account as-is. Fortunately, it can be done, and really isn't that difficult - at least if you aren't afraid of the command line.

Basic Concepts

The basic ideas behind moving the FileVault account are simple:

Recreate the account information on the new machine.

Move the FileVault sparseimage or sparsebundle to the new machine.

Edit the account information to point to the FileVault disk image.

Of course, the devil is in the details. So let's get started!

Recreating the account

If you are using mobile accounts, recreating the account is easy. Just create a new mobile account for the user - either graphically, or via the command line. In Tiger, the relevant command-line tool is MCXCacher, located in

/System/Library/CoreServices/mcxd.app/Contents/Resources/

You call it like so:

cd /System/Library/CoreServices/mcxd.app/Contents/Resources
./MCXCacher -U usershortname

which should create a new mobile account for the network user.

For Leopard, the relevant tool is called createmobileaccount. It is located in /System/Library/CoreServices/ManagedClient.app/Contents/Resources.

It's called like this:

cd /System/Library/CoreServices/ManagedClient.app
cd Contents/Resources
./createmobileaccount -n usershortname

If you aren't using mobile accounts, you can manually recreate the account using the Accounts preferences pane, or the dscl command-line utility, but be sure the shortname, uid, and GeneratedUID of the recreated account match the original. The dscl utility can be of great help here, allowing you to read the appropriate values from the old account and write them to the new one:

oldmac:/ root# dscl . read /Users/localuser uid
dsAttrTypeNative:uid: 4389
newmac:/ root# dscl . create /Users/localuser uid 4389

Another challenge, if you are not using mobile accounts, is copying the stored password from the old account and machine to the new one, but this, too, can be done. The passwords are stored in /private/var/db/shadow/hash. For local accounts, the shadow files are named after the GeneratedUID of the user account:

root# dscl . read /Users/localuser GeneratedUID
GeneratedUID: 1DECD42B-52EB-4B89-B2B2-359F0623EB1F

So for "localuser" above, the password is stored in /private/var/db/shadow/hash/1DECD42B-52EB-4B89-B2B2-359F0623EB1F. To copy the password hash from the old machine to the new one, you'd just copy that file.

Move the FileVault disk image

The next step is easier. All you need to do is copy the FileVault disk image from the old machine to the new one. But first, let's do some prep work. If you recreated the account on the new machine, you may have a folder in /Users that is partially populated. We don't really need the contents of this folder, as we're going to replace it with the FileVault disk image. If your new machine is running Tiger, or you've recreated a purely local user, just remove all the contents:

newmac:/ root# rm -rf /Users/localuser/*

If your new machine is running Leopard, and you have recreated a mobile account, you should keep the .account directory inside the user's home folder. This stores cached account info and is used by the new External Accounts in Leopard.

newmachine:/ root# ls /Users/mobileuser
.CFUserTextEncoding   Movies
.account                     Music
Desktop                     Pictures
Documents                  Public
Downloads                  Sites
Library

You can remove everything else in the user's folder; just leave .account.

Let's look at the old machine for a second. You might see two relevant directories in /Users:

.localuser/
localuser/

If you look inside .localuser/, you'll see the sparseimage/sparsebundle. If you look in localuser/, you'll see an .autodiskmounted file. This happens when the FileVault disk image is not unmounted cleanly. The important bit is that you want to find and copy the sparseimage/sparsebundle, even if it's in a different directory than you were expecting.

One strategy to copy the FileVault disk image is to startup the old machine in FireWire target disk mode, connect it to the new machine, and use sudo cp or ditto to copy the sparseimage/sparsebundle. If you do this, it's probably a good idea to uncheck the "Ignore ownership" box in the Get Info window for the FireWire-connected volume. If you don't do this, you can manually reassign ownership of the FileVault image after the copy.

cp -pvr /Volumes/oldmac/Users/myuser/myuser.sparsebundle \ /Users/myuser/myuser.sparsebundle
chown -R myuser /Users/myuser/myuser.sparsebundle

If you cannot abide the command line, it is possible to do this completely from the Finder, but you'll need to first change the permissions and/or ownership of the various directories so you can read and write. Be sure to change ownership and permissions back when you are done copying.

When you are done copying, you should have a username.sparsebundle or username.sparseimage in /Users/username on the new machine. /Users/username and /Users/username/username.sparsebundle should be owned by username, and the owner should have read, write and execute permissions:

chown -R username /Users/username
chmod -R u+rwX  /Users/username

Editing the new account

We're almost there! We've recreated the account, and we've copied the FileVault disk image. But the recreated account has the wrong value for the HomeDirectory attribute. We need to fix that. While previous steps could be done without using the command line, I'm afraid that for this task you have no choice but to fire up the terminal.

newmac:/ root# dscl . read /Users/myuser HomeDirectory   
No such key: HomeDirectory

For a "normal" non-FileVault encrypted home directory, this attribute does not exist (the NFSHomeDirectory attribute does exist, but that's a different thing...) We need to create this attribute and point it to the FileVault disk image.

dscl . create /Users/myuser HomeDirectory '<home_dir><url>file://localhost/Users/myuser/myuser.sparsebundle</url></home_dir>'

The above command should be all one line. Substitute the correct username for "myuser" and in "myuser.sparsebundle". If the encrypted home directory is in the older FileVault format, substitute "sparseimage" for "sparsebundle".

If you did everything right, the user should now be able to log in on their new machine with their username and password and access their FileVault-encyrpted home directory. And maybe you've learned some things about FileVault, mobile accounts and the Directory Service along the way.

Wrapping up

To review:

We recreated the user account on the new machine, using MCXCacher or createmobileaccount if the account was a mobile account; or manually if it was a local account, ensuring the shortname, uid, and GeneratedUIDs matched.

For local accounts, we copied the shadow password file. (Recreating a mobile account generates this for us automatically)

We copied the FileVault disk image from the old machine to the new one.

We edited the local accounts' HomeDirectory attribute to point to the FileVault disk image.

That was a lot of work - but should have been faster than turning FileVault off, moving the account and data, and then turning it back on. Additionally, the user's password was not needed to move the account and data. Once you get this technique down, you might consider writing a script to do most of it for you, which is, of course, what I've done. Better would be to help persuade Apple to update the Migration Assistant to do this: if we can do it, so could the Migration Assistant!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 
AAPL
$109.70
Apple Inc.
+0.87
MSFT
$48.87
Microsoft Corpora
-0.02
GOOG
$550.29
Google Inc.
+2.80

MacTech Search:
Community Search:

Software Updates via MacUpdate

Google Chrome 38.0.2125.122 - Modern and...
Google Chrome is a Web browser by Google, created to be a modern platform for Web pages and applications. It utilizes very fast loading of Web pages and has a V8 engine, which is a custom built... Read more
Tidy Up 4.0 - Find duplicate files and t...
Tidy Up is a complete duplicate finder and disk-tidiness utility. With Tidy Up you can search for duplicate files and packages by the owner application, content, type, creator, extension, time... Read more
Adobe Flash Player 15.0.0.223 - Plug-in...
Adobe Flash Player is a cross-platform, browser-based application runtime that provides uncompromised viewing of expressive applications, content, and videos across browsers and operating systems.... Read more
Firefox 33.1 - Fast, safe Web browser. (...
Firefox for Mac offers a fast, safe Web browsing experience. Browse quickly, securely, and effortlessly. With its industry-leading features, Firefox is the choice of Web development professionals... Read more
TextSoap 7.4.3 - Flexible text editing u...
TextSoap is for people who work with text. TextSoap effortlessly cleans up text from endlessly different formats. Wash away unwanted characters, spaces, tabs. Fix paragraphs with hard returns at the... Read more
Pixa 1.1.5 - Quickly and easily organize...
Pixa is an image-organizing application. The new app functions well, is easy to use, and helps people organize their images quickly and easily on their computers. For those who prefer not to use the... Read more
Yummy FTP 1.10.1 - FTP/SFTP/FTPS client...
Yummy FTP is an FTP + SFTP + FTPS file transfer client which focuses on speed, reliability and productivity. Whether you need to transfer a few files or a few thousand, schedule automatic backups, or... Read more
X Lossless Decoder 20141109 - Encode, tr...
X Lossless Decoder (XLD) is a tool for OS X that is able to decode/convert/play various 'lossless' audio files. The supported audio files can be split into some tracks with cue sheet when decoding... Read more
Monosnap 3.0.1 - Versatile screenshot ut...
Monosnap lets you capture screenshots, share files, and record video and .gifs! Capture: Capture full screen, just part of the screen, or a selected window Make your crop area pixel perfect with... Read more
DiskCatalogMaker 6.4.11b2 - Catalog your...
DiskCatalogMaker is a simple disk management tool which catalogs disks. Simple, light-weight, and fast. Finder-like intuitive look and feel. Super-fast search algorithm. Can compress catalog data... Read more

Latest Forum Discussions

See All

MORPG Darkness Reborn has an Official Re...
MORPG Darkness Reborn has an Official Release Date Posted by Jessica Fisher on November 11th, 2014 [ permalink ] GAMEVIL has announced that their live MORPG, | Read more »
Save the Bears! Candy Crush Soda Saga Av...
Save the Bears! Candy Crush Soda Saga Available Today Posted by Jessica Fisher on November 11th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Car Breakers Review
Car Breakers Review By Jennifer Allen on November 11th, 2014 Our Rating: :: FLINGING FUNUniversal App - Designed for iPhone and iPad Flinging a crash test dummy is kind of fun, as Car Breakers demonstrates.   | Read more »
Lipa Knight Review
Lipa Knight Review By Amy Solomon on November 11th, 2014 Our Rating: :: BRIDGE BUILDING FUNUniversal App - Designed for iPhone and iPad Lipa Knight is a thoughtfully developed logic and reasoning app children and their adults will... | Read more »
Seasonality Go Review
Seasonality Go Review By Jennifer Allen on November 11th, 2014 Our Rating: :: VARIED WEATHER REPORTINGUniversal App - Designed for iPhone and iPad Get detailed weather reporting quickly via Seasonality Go.   | Read more »
.NOON Review
.NOON Review By Jennifer Allen on November 11th, 2014 Our Rating: :: TWITCHY CLOCKSUniversal App - Designed for iPhone and iPad Tapping on a clock at just the right moment can be surprisingly fun, if basic, when it comes to .NOON... | Read more »
Beep-Beep! RGB Express Update Coming Thr...
Beep-Beep! RGB Express Update Coming Through Posted by Jessica Fisher on November 11th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Overview Calendar Review
Overview Calendar Review By Jennifer Allen on November 11th, 2014 Our Rating: :: CLASSY ORGANIZINGiPhone App - Designed for the iPhone, compatible with the iPad Organize your life in a more stylish way than usual, thanks to... | Read more »
Jet Run: City Defender Review
Jet Run: City Defender Review By Jordan Minor on November 11th, 2014 Our Rating: :: PRETTY, SIMPLEUniversal App - Designed for iPhone and iPad Jet Run: City Defender’s beauty might be its own worst enemy.   | Read more »
This Week at 148Apps: November 3-7, 2014
Expert App Reviewers   So little time and so very many apps. What’s a poor iPhone lover to do? Fortunately, 148Apps is here to give you the rundown on the latest and greatest releases. And we even have a tremendous back catalog of reviews; just... | Read more »

Price Scanner via MacPrices.net

Satechi Launches Multi-Functional Edge Wirele...
Your humble servant isn’t much of a gamer, but I’m a big fan of gaming mice, which typically feature higher tracking precision and rugged construction along with comfortable ergonomics than “regular... Read more
LINK Power Drive Combines Flash Drive and Pow...
Imation Corp. has announced the Imation LINK Power Drive — a new device that brings flash storage and battery-charging capabilities together in a single unit for the iPhone and other iOS devices. “... Read more
Sale! $200 off the 15″ 2.2GHz Retina MacBook...
 B&H Photo has the 2014 15″ 2.2GHz Retina MacBook Pro on sale for $1799.99 for a limited time. Shipping is free, and B&H charges NY sales tax only. B&H will also include free copies of... Read more
Roundup of Apple refurbished iPads
Apple dropped prices recently on Apple Certified Refurbished iPad Airs and iPad mini 2s, with models available starting at $249. Apple’s one-year warranty is included with each model, and shipping is... Read more
13-inch 2.6GHz/256GB Retina MacBook Pro now o...
 Best Buy has dropped their sale price on the 13″ 2.6GHz/256GB Retina MacBook Pro to $1349.99, or about $150 off MSRP. Choose free home shipping or free local store pickup (if available). Price valid... Read more
Today’s lowest prices on 2014 MacBook Airs, u...
The Apple Store has Apple Certified Refurbished 2014 MacBook Airs available for up to $180 off the cost of new models. An Apple one-year warranty is included with each MacBook, and shipping is free.... Read more
New 1.4GHz Mac mini on sale and in stock for...
B&H Photo has the new 1.4GHz Mac mini in stock today and on sale for $459.99 including free shipping plus NY tax only. Their price is $40 off MSRP, and it’s the lowest price available for this... Read more
21-inch iMacs on sale for up to $150 off MSRP
B&H Photo has 21″ iMacs on sale for up to $150 off MSRP including free shipping plus NY sales tax only: - 21″ 1.4GHz iMac: $999.99 $100 off - 21″ 2.7GHz iMac: $1199.99 $100 off - 21″ 2.9GHz iMac... Read more
27-inch 5K iMac available for $2449, save $50
Amazon.com has the 27″ 3.5GHz 5K iMac available for $2449 including free shipping. Their price is $50 off MSRP, and it’s currently the lowest price available for this model from any reseller (outside... Read more
Roundup of Mac Pro sale prices, save up to $3...
B&H Photo has Mac Pros on sale for up to $350 off MSRP. Shipping is free, and B&H charges sales tax in NY only: - 4-core Mac Pro: $2649, $350 off MSRP - 6-core Mac Pro: $3739.99, $260 off... Read more

Jobs Board

Project Manager / Business Analyst, WW *Appl...
…a senior project manager / business analyst to work within our Worldwide Apple Fulfillment Operations and the Business Process Re-engineering team. This role will work Read more
Project Manager / Business Analyst, WW *Appl...
…a senior project manager / business analyst to work within our Worldwide Apple Fulfillment Operations and the Business Process Re-engineering team. This role will work Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
Position Opening at *Apple* - Apple (United...
…customers purchase our products, you're the one who helps them get more out of their new Apple technology. Your day in the Apple Store is filled with a range of Read more
Position Opening at *Apple* - Apple (United...
**Job Summary** The Apple Store is a retail environment like no other - uniquely focused on delivering amazing customer experiences. As an Expert, you introduce people Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.