TMA-INTUNE-MACOS-2.11.1.5
Ensure "Destroy FV Key On Standby" is set to "True"
Description
When enabled, the FileVault keys are completely destroyed from the SMC or RAM when the system enters sleep, requiring the user to re-enter their password upon wakeup to decrypt the disk. The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
macOS: Intune admin center: Expand the System Configuration heading; Under the Energy Saver subheading; Verify that Destroy FV Key On Standby is present and set to True. On the device: Double-click com.apple.MCX Profile; Under the Details section; Confirm Remove FileVault Key on Standby is set to True
How it is fixed
Fix method: Guidance or infrastructure patch
Intune admin center: Select System Configuration then Energy Saver; Check Destroy FV Key On Standby; On the left side of the page set Destroy FV Key On Standby to True; Verify that Destroy FV Key On Standby is present and set to True
Properties
- Operating systems
- Any
- Tags
- intune-macosintunemanual-review
- Reference
- CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.11.1.5 Ensure "Destroy FV Key On Standby" is set to "True"