Overview

When FileVault is on, a Mac shows a FileVault unlock screen after every restart, before the normal macOS login window. The unlock screen lists only users who can unlock the disk, never shows Other…, and follows different rules on Intel and Apple silicon Macs.

This article explains the two screens, what controls each one, and how to configure them with Swif's Apple Login Window Policy.

Start here

If users report a missing account, a missing Other… option, or an unexpected name-and-password prompt, check these first:

Was the Mac restarted, or logged out? After a restart, users see the FileVault unlock screen. After a logout, they see the normal login window. The two behave differently.
Is FileVault on? Run fdesetup status in Terminal.
Is the user enabled for FileVault? Run sudo fdesetup list. Only users in this list appear on the unlock screen.
Which login window mode is applied? Check Login window prompt configuration in the Apple Login Window Policy, or on the Mac, as described in Verify the current configuration below.

Two screens: FileVault unlock and macOS login

With FileVault on, startup has two sign-in stages. They look similar, but they're controlled differently.

	FileVault unlock screen	macOS login window
When it appears	After a restart or cold boot	After a logout or user switch, or after unlock (see below)
What it does	Unlocks the encrypted disk, before macOS starts the user session	Signs the user in to macOS
Users listed	Only users enabled for FileVault	Follows your login window settings
Other…, network accounts, Platform SSO	Never	Depends on your settings
Wi-Fi menu	No	Yes
How to recognize it	A progress bar appears after you enter a password, while the disk unlocks	The standard macOS login window

Which screens users see

Situation	What users see
FileVault on, Disable automatic login if FileVault is enabled off (default)	The unlock screen, then straight to the desktop. The login window is skipped.
FileVault on, Disable automatic login if FileVault is enabled on	The unlock screen, then the login window, where they sign in again
FileVault off	Only the login window, unless a user is set to sign in automatically
Any Mac, after a logout	Only the login window, because the disk is already unlocked

How the screens differ on Intel and Apple silicon

	Intel Macs (including T2 models)	Apple silicon Macs
Unlock screen	Follows Login window prompt configuration: a list of FileVault-enabled users when off, name-and-password fields when on	Name-and-password fields, unless Login window prompt configuration is off and Display administrator users at login window is on. Then it shows a list of FileVault-enabled users.
Login window, after unlock	Skipped, unless Disable automatic login if FileVault is enabled is on. Then it follows Login window prompt configuration.	Skipped, unless Disable automatic login if FileVault is enabled is on. Then it follows the same rules as the unlock screen.
Display administrator users at login window	None on which screen type appears	Decides whether the screens show a user list or name-and-password fields

Disable automatic login if FileVault is enabled works the same way on both: off skips the login window after unlock, and on shows it.

Apple silicon: the Preboot volume

On Apple silicon, the unlock screen reads Login window prompt configuration from the Mac's Preboot volume, not from the running system. A changed setting takes effect at the next restart only after the Preboot volume is updated.

macOS updates the Preboot volume on certain events, such as user and password changes. To apply a change right away, run:

sudo diskutil apfs updatePreboot /

Then restart to confirm.

Administrator users on the unlock screen

Display administrator users at login window applies to both the FileVault unlock screen and the login window. On Apple silicon, it decides which kind of screen users see:

On (default), with Login window prompt configuration off: both screens show a list of FileVault-enabled users.
Off: both screens show name-and-password fields.

On Intel, it doesn't change which kind of screen appears.

This setting was previously labeled Root login (local and remote). It doesn't turn on the root account.

Why a user or Other… doesn't appear

A user is missing from the FileVault unlock screen

Only users enabled for FileVault can unlock the disk. A user is missing when:

The account doesn't have a Secure Token. Accounts created from the command line, by a script, or by some management tools may not get one automatically.
On Apple silicon, the account isn't a volume owner. This normally follows from having a Secure Token.
It's a network or identity provider account that has never signed in locally, so it has no local password to unlock the disk.
The Preboot volume hasn't been updated since the account was enabled for FileVault.
It's an administrator account, and Display administrator users at login window is off. Administrators are hidden from the list.

To add a user, see A user can't unlock FileVault under Troubleshooting.

Other… is missing

Where	Why
FileVault unlock screen	Expected. The unlock screen never shows Other…, on any Mac or macOS version.
Login window, showing a user list	Other… appears only when Show "Other…" in the user list is on, or the Mac is set up for network accounts.
Login window, set to name and password	There's no user list, so there's no Other…. Users type any username in the name field.

Signing in as a hidden account. To sign in as a hidden account, such as the Swif Admin account (swifteam), the login window needs Other… or name-and-password fields. On a FileVault Mac, first unlock the disk with a FileVault-enabled user, and turn on Disable automatic login if FileVault is enabled, so the login window appears after unlock.

Guest users on FileVault Macs

On a Mac with FileVault on, selecting Guest User restarts the Mac into a separate, restricted system that can only run a web browser. The guest can't use other apps, and can't see the encrypted disk. This can't be changed while FileVault is on. See the Apple Login Window Policy for details.

Configure the login experience with Swif

Use the Apple Login Window Policy to manage these settings across Macs, instead of changing each Mac in Terminal.

In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Apple Login Window Policy, or open an existing one.
Set the options below, save, and assign the policy to your Macs or device groups.

Setting	What it does
Disable automatic login if FileVault is enabled	Off (default): after the user unlocks FileVault, macOS signs them straight in, skipping the login window. On: the login window appears after unlock, and the user signs in again. Works on Intel and Apple silicon. macOS 10.9 or later.
Display administrator users at login window	On (default): administrator accounts appear in the user list, on both the unlock screen and the login window. On Apple silicon, it must be on, with Login window prompt configuration off, for the screens to show a user list. Off: on Apple silicon, both screens show name-and-password fields.
Login window prompt configuration	Off (default): the login window shows a list of users. On: it shows name-and-password fields. On Intel, the unlock screen follows the same setting. On Apple silicon, On gives name-and-password fields on both screens.
Show "Other…" in the user list	On: adds Other… to the login window's user list, so users can type any account name. Off (default): no Other… option. No effect on the unlock screen, or when Login window prompt configuration is on.

When to turn on Disable automatic login if FileVault is enabled:

Admins or other users need the login window after a restart, for example to use Other…, or to sign in as a different account than the one that unlocked the disk.
You use the Apple Platform SSO Policy on the same Macs. This setting must be on, so users sign in through Platform SSO at the login window.

On Apple silicon, a change to Login window prompt configuration reaches the unlock screen only after the Preboot volume is updated. See Apple silicon: the Preboot volume above.

Summary

Use this table to predict what users see after a restart.

Mac	FileVault	Disable automatic login if FileVault is enabled	Login window prompt configuration	Display administrator users at login window	FileVault unlock screen	Login window
Intel	On	Off	Off	Any	List of FileVault-enabled users	Skipped
	On	Off	On	Any	Name and password	Skipped
	On	On	Off	Any	List of FileVault-enabled users	List of users
	On	On	On	Any	Name and password	Name and password
	Off	Any	Off	Any	None	List of users
	Off	Any	On	Any	None	Name and password
Apple silicon	On	Off	Off	On	List of FileVault-enabled users	Skipped
	On	Off	Off	Off	Name and password	Skipped
	On	Off	On	Any	Name and password	Skipped
	On	On	Off	On	List of FileVault-enabled users	List of FileVault-enabled users
	On	On	Off	Off	Name and password	Name and password
	On	On	On	Any	Name and password	Name and password
	Off	Any	Off	Any	None	List of users
	Off	Any	On	Any	None	Name and password

Notes

Apple silicon: changes to the unlock screen apply after the Preboot volume is updated. See Apple silicon: the Preboot volume above.
FileVault off: the table assumes no user is set to sign in automatically. If one is, the Mac skips the login window after a restart. To prevent this, keep Disable automatic login on in the Apple Login Window Policy. It's on by default.
After a logout: there's no unlock screen on any Mac. The login window follows Login window prompt configuration.
Other… never appears on the unlock screen. It appears on the login window only when the login window shows a user list, and Show "Other…" in the user list is on.

Verify the current configuration

Run these in Terminal on the Mac, or with Swif's Live Terminal.

Check FileVault status:
```
fdesetup status
```
FileVault is On. means the unlock screen appears after every restart.
List the users who can unlock FileVault:
```
sudo fdesetup list
```
Only users in this list appear on the unlock screen.
Check a user's Secure Token, replacing <username> with the account's short name:
```
sysadminctl -secureTokenStatus <username>
```
ENABLED is required for FileVault access.
Check the managed login window settings:
```
defaults read "/Library/Managed Preferences/com.apple.loginwindow"
```
The output uses Apple's names for the settings. 1 means on, and 0 means off:

In the output	Swif setting
`DisableFDEAutoLogin`	Disable automatic login if FileVault is enabled
`SHOWFULLNAME`	Login window prompt configuration
`SHOWOTHERUSERS_MANAGED`	Show "Other…" in the user list

If the command says the domain doesn't exist, no login window policy is applied, and macOS defaults are in use.

Confirm the policy profile is installed:
```
sudo profiles show -type configuration | grep -i -A8 loginwindow
```
If nothing is returned, the Login Window Policy hasn't reached this Mac. Check the policy's assignment, and the device's Policies tab in Swif.

FileVault and Platform SSO

Platform SSO can't sign users in at the FileVault unlock screen, because the unlock screen runs before macOS starts, and has no network access.

A local account with a FileVault-enabled password is always needed to unlock the disk.
After the disk is unlocked, Platform SSO can handle sign-in at the login window, if the login window is shown.
To make sure users reach the login window after a restart, turn on Disable automatic login if FileVault is enabled in the Login Window Policy.
If Platform SSO keeps the local password in sync with your identity provider, users unlock FileVault with their identity provider password.

This is how macOS works, and it applies to every MDM. For setup details, see the Apple Platform SSO Policy.

Troubleshooting

Other… appears after a logout, but not after a restart

This is expected on a FileVault Mac. After a restart, users see the unlock screen, which never shows Other…. To reach the login window after a restart, turn on Disable automatic login if FileVault is enabled.

Other… never appears on the login window

Confirm the login window shows a user list, not name-and-password fields.
Check that Show "Other…" in the user list is on in the Apple Login Window Policy. On the Mac, SHOWOTHERUSERS_MANAGED should be 1, using step 4 of Verify the current configuration.
If it isn't, check that the policy is assigned to the Mac.

An Apple silicon Mac still shows the old unlock screen after a policy change

The Preboot volume hasn't been updated. Run sudo diskutil apfs updatePreboot /, then restart.

A user can't unlock FileVault, or doesn't appear on the unlock screen

Add the user to FileVault, using an admin account that's already FileVault-enabled:

sudo fdesetup add -usertoadd <username>

You're asked for the admin's credentials and the user's password. Run sudo fdesetup list to confirm the user was added. If the command fails, check that the admin has a Secure Token, with sysadminctl -secureTokenStatus <admin username>.

Users must sign in twice after every restart

Disable automatic login if FileVault is enabled is on, so this is expected. Turn it off if you prefer a single sign-in, and you don't use Platform SSO.

A guest can only use a web browser after a restart

This is expected on a FileVault Mac. Selecting Guest User restarts the Mac into a restricted, browser-only system. See Guest users on FileVault Macs above.

Related resources

Need help?

Contact Swif support at support@swif.ai. Include the device's serial number, the output of fdesetup status and sudo fdesetup list, and whether the issue appears after a restart, a logout, or both.

FileVault’s Effect on the macOS Login Window