topic Re: Disk Decryption on MAC OS in Cortex XDR Discussions

Disk Decryption on MAC OS

EJaspe — Tue, 14 Nov 2023 03:07:23 GMT

Hi Everyone,

I'm seeking for help on how to decrypt the drive on MAC OS after the encrypting the drive using the Cortex XDR Tenant/Console?

I tried to check and use on this documentation guide by Palo Alto Networks but I think it is not working or do I miss something.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Disk-Encryption

Hoping for your best answers!

Thank you and best regards!

Re: Disk Decryption on MAC OS

aspatil — Tue, 14 Nov 2023 07:46:26 GMT

Hello,

Thank you for writing to Live Community.

Please refer below document for the further reference.

The Cortex XDR Disk Encryption profile for Mac can encrypt the endpoint disk, however, it cannot decrypt it. After you disable the Cortex XDR policy rule on the endpoint, you can decrypt the endpoint manually.

Hope this helps.

Please mark the response as "Accept as Solution" if it answers your query.

Re: Disk Decryption on MAC OS

PiyushKohli — Thu, 16 Nov 2023 11:29:38 GMT

@EJaspe

You may run sudo fdesetup disable to decrypt the disk in mac with admin permissions and to check status run the following command sudo fdesetup status.

Feel free to write back if you have further query.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Disk Decryption on MAC OS

CarmenKardos — Sat, 18 Nov 2023 10:50:28 GMT

Thanks for helping me out as well. Please mark it as a solution. Thanks.