Inhibit File Vault creation

[Henties]

Hi @all I would appreciate that somebody help me "low down" on how to disable the creation of automatic encryption of Tahoe volumes during or after initial installation or upgrade from say Sonoma or Sequoia.

The upgrade works well and I can get into Tahoe immediately after completion of an upgrade however once I restart the machine I am locked out with a screen requiring a password to access Tahoe's file vault encrypted volume(s)

The recommended method of recovering that password, via the recovery volume does not work as I have no access to the Tahoe recovery volume.

In my config.plist under Misc --> SecureBootModel is disabled and Vault is Optional, guessing that something else needs to be assigned to Vault in order to prevent automatic volume encryption during or after Tahoe installation.

 

Your help will be most appreciated.

 

Greetings Henties

 

[Henties]

@verdazilWeird things are happening my end. 

From another "source" I learned that after installation or upgrade to Tahoe one must traverse into System Settings --> Privacy & Security --> File Vault to disable volume encryption, there it also provides a lengthy recovery key which one can use if one wants to recover ones password etc.

 

Excerpt from my other source:

 

Und ganz wichtig: FileVault ist jetzt automatisch nach jedem Full-Installer-Update wieder aktiv, wenn es nicht schnell genug direkt oder vorher in der Config abgeschaltet wird.

 

Translation of above:

 

Very importatnt: File Vault is now automatically, after every full-installer-Update active if one does not deactivate it quickly enough directly or before in the Config file.

 

End translation

 

It also does not make sense to me, unless SecureBootModel and Vault needs to be something else than "disabled" and "optional" as that is how my respective entries in my config.plist have always been configured with File Vault never activating "itself" automatically.

 

Greetings Henties.  

[kgp]

@Henties, here are two options for disabling File Vault encryption:

 

 

There is a third option with https://github.com/acidanthera/OcBinaryData/blob/master/Drivers/apfs_aligned.efi and disabling "EnableJumpstart" in config.plist.

 

To prevent automatic File Vault encryption during the update/clean-install of Tahoe (if you have no option to disable File Vault), there was a keyboard command to quit the setup dialogue in the final step of the installation before File Vault would be enabled automatically. Unfortunately I don't remember, which one. Maybe somebody else remembers?

 

Cheers,

 

KGP 

 

 

Edited October 19, 2025 by KGP-iMacPro

[Anto65]

Unfortunately, I also got locked out at login because the volume had been encrypted. Obviously, I then rebooted without checking.
Just today, I was reading that the way to avoid this , is to not log in with your ID during installation. ( not tested )

 

I don't know how to avoid this nice service offered by Apple  🤷‍♂️ . I have the same configuration regarding SBModel and Vault

but if it's not possible to unlock it from Recovery because it's not accessible, you can operate from another volume

 

I followed this  removing-file-vault  and it worked

 

Another thing that works is to mount the EFI from another Volume and disable the "EnableJumpstart" quirk in UEFI -> APFS and add the " apfs_aligned.efi "  driver. Then log in with your password and type

 

" sudo fdesetup disable "    in the terminal.

 

Or, disable FileVault from the System Settings... even if it seems to always be active, it's actually decrypting... so wait.
You can check the decryption status by typing " diskutil apfs list "  in the terminal.

 

 

 

Another check verifies that the volume has been decrypted is that automatic login can be enabled in Users and Groups.

[XanthraX]

43 minutes ago, KGP-iMacPro said:

@Henties, here are two options for disabling File Vault encryption:

 

 

There is a third option with https://github.com/acidanthera/OcBinaryData/blob/master/Drivers/apfs_aligned.efi and disabling "EnableJumpstart" in config.plist.

 

To prevent automatic File Vault encryption during the update/clean-install of Tahoe (if you have no option to disable File Vault), there is a keyboard command to quite the setup dialogue in the final step of the installation before File Vault would be enabled automatically. Unfortunately I don't remember, which one. Maybe somebody else remembers?

 

Cheers,

 

KGP 

 

 

If I do the third option, all my apfs volumes are not visible in the OC picker, only the EFI volumes. If I keep the apfs_aligned.efi in Drivers but not disable "EnableJumpstart" in config.plist, my system reboots continuously. Probably this method is not for all configurations. After install or upgrade, when you configure your user, don't hurry, pay attention. Will have a dialog if you want to encrypt your volume and by default the checkbox is activated. Just click on it and deactivate. Will be warned how advanced is to have your drive encrypted, continue with not encryption and this is all. The method from recovery drive is really a pain in the ass. I preferred to erase the disk and reinstall. Just pay attention of every step after installing or upgrading, when you are invited to configure your user. Sorry but this is the best option for now. I hope in the next future someone to make an option in OC.

Edited October 18, 2025 by XanthraX

[mnfesq]

This is how I dealt with the problem.

 

 

[Slice]

I checked many ways and methods how to not fall into encryption. No way!

Someone claims he got a question enable or not but there was real Mac.

On the hackintosh there is only way:

1. Install Tahoe. Yes FileFault will be enabled no matter what you do. Prepare apfs_aligned.efi and all FileVaults drivers before the installation. In the case of Clover there wiil be AppleImageCodec.efi and UsbKbDxe.efi (and apfs_aligned.efi instead of ApfsDriverLoader.efi)

2. Enter desktop and do nothing until system is in encrypting state. Wait for 100%. Do not allow system to sleep!

3. Enter system preferences and disable file vault. Again wait for 100% decryption.

4. You are ready to use the system.

[Anto65]

I think OC or Clover has little to do with all this.

Found

Slice
Look at the images. It was suggested to me too. Honestly, because sometimes it happens and sometimes it doesn't. I don't quite understand the mechanism 🤭

Maybe in the first betas ?... it probably doesn't happen via Software Update !?.

Edited October 18, 2025 by Anto65

[Slice]

8 minutes ago, Anto65 said:

Slice
Look at the images. It was suggested to me too. Honestly, because sometimes it happens and sometimes it doesn't. I don't quite understand the mechanism 🤭

Maybe in the first betas ?... it probably doesn't happen via Software Update !?.

No, I tested on first beta but it not worked with Polaris. I tested on second beta same result.

Then I formatted the volume and install release 26.0. Same issue.

I was checked all users reports (excluding verdazil) and I saw many attempts to explain. 

The only successful attempt I saw was an installation in the same container with Sequoia may be because one container for two systems.

[Anto65]

50 minutes ago, eSaF said:

It seems like it is a random thing, so strange.

Strange indeed... a Russian roulette 🤭

 

.... ...just to remember I have Tahoe installed on nvme  from there the images in my post , with the proposal of wanting or not wanting to encrypt the disk , the ssd is reserved for Win 

Edited October 18, 2025 by Anto65

[jlrycm]

49 minutes ago, eSaF said:

Bro, if I may jump in, remember yesterday I did a clean install with the latest Tahoe Beta release.

After the install I did a reboot and believe or not I was locked out because of File Vault.

 

The previous clean install of an earlier Beta, I was offered the choice during the installation but not this time.

I couldn't be bother to go through the process to unlock so I wiped the disk and started again.

 

Again it locked the disk automatically, but this time before I rebooted, I had to unlock the disk.

It seems like it is a random thing, so strange.

I did a clean Tahoe install on Wednesday and I didn’t have the encryption issue but I chose to install it as a new Mac without transferring data from Time Machine or signing in iCloud. I disabled the "EnableJumpstart" quirk in UEFI -> APFS and added the "apfs_aligned.efi" driver back in summer when testing the DB2.

[Anto65]

 

 

 

 

 

 

 

[Anto65]

eSaF maybe they sold us NVMe but in reality they are SSDs ... I'd better go to sleep  👋

[scypher]

I found by logging out of my Apple account before installing Tahoe, that it prompted me when installed if I wanted file vault on or off. I didn’t have to change any of my opencore settings. Just logged out before installing, and logged back in when installed. 

[Anto65]

Oops ! It asked me again whether I wanted to enable FileVault or not.

 

Spoiler

 

 

 

 

... just completed a clean install of Tahoe 26.1  beta 3... I'd like to remind you that I'm still at NVMe ! not SSD  

 

As I reported here

https://www.insanelymac.com/forum/topic/361856-inhibit-file-vault-creation/#findComment-2842454

 

"I was reading that the way to avoid this is to not log in with your ID during installation. (Not tested)"

 

No tricks were used in the quirks (EnableJumpstart) or the "apfs_aligned.efi" driver was added.

 

Simply disable it here during installation

 

" Allow your computer's account password to be reset with your Apple Account. You must sign in to your Apple Account in the next step to use this feature. "

 

Obviously, if disabled, you won't even be prompted to enter your ID.

 

Result  No FileVaut activated

 

Spoiler

 

 

Edited October 19, 2025 by Anto65

[Anto65]

And here we are, I repeated the clean install.
This time, during account creation, I logged in with my Apple ID 

 

enabled :

" Allow your computer's account password to be reset with your Apple Account. You must sign in to your Apple Account in the next step to use this feature. "

 

Spoiler

 

 

 

.... And 

 

Spoiler

 

 

FileVault had been activated

 

At this point I think I can confirm, as confirmed by scypher, that simply not logging in to your ID is enough to not have FileVault enabled.

 

Edited October 19, 2025 by Anto65

[Henties]

@Anto65 I can confirm that I was also able to get Tahoe 26.1 Beta (25B5062e) working on my Comet Lake hack with an AMD Radeon RX 580 GDU by merely signing out from my Apple account prior to starting upgrading Sonoma to Tahoe.

 

@all Thanks to everyone for your inputs that finally got me going with Tahoe, much appreciated.

 

From what I have seen so far, Tahoe does not impress me at all, especially the disappearance of Launchpad, leading to the total dependence on Spotlight, imitating Windows 11 in trying to find stuff, well lets see where this finally leads to, AppleWin or perhaps WinApple.

 

I am however quite happy that Tahoe stretches the longevity of my present Intel based hardware at least enabling me to stay in an Apple environment for some time to com.

 

Will now have to discover some means to enable sound.

 

That should not be too much of a problem because my monitors support HDMI audio out. 

 

Another option could be airplay because all my computing stations have JBL soundbars nearby which are all accessible via airplay, be it built in to the sound bar or by using phased out Apple TV 3 modules for getting airplay to work to these devices.

 

Would be interesting to learn what the community is doing to properly get sound working on Tahoe.

 

Greetings Henties

 

 

[Anto65]

I'm using this as a launchpad; Spotlight also works.

https://apps.apple.com/us/app/appgrid-launcher/id6748853585?mt=12

 

For audio, I think MyKextInstaller or OCLP-MOD is the only solution to restore AppleHda , or VoodooHda. 🤷‍♂️

Edited October 19, 2025 by Anto65

[Henties]

@Anto65Thanks for the link to the Launchpad replacer.

 

I would appreciate if you would provide me some more info as to how one could activate AppleHDA on Tahoe, because if I could get that working again I would not require any modifications to the other opsysyes that I am multitasking to. This applies to all my Intel platforms. This MyKextinstaller hint of yours sounds very interesting to me.

I actually need AppleHDA functionality because on all my opsyses I grab digital audio and route that to output devices that can handle digital inputs, providing the best quality audio one can hope for in a computer environment.

 

Hoping you can help me getting AppleHDA  going on Tahoe.

 

Greetings Henties

[Anto65]

https://github.com/Mirone/MyKextInstaller  (Download the necessary from here, it is more up to date)

 

 

Here's the relevant topic.

 

 

Know that this involves disabling SIP, downloading the  Kdk ( depending on the installed version of Tahoe ) , restore the snapshot to get incremental updates and reapply the patch.... 

 

Anyway, read a few pages... have fun 😁

Edited October 19, 2025 by Anto65

[verdazil]

@Henties, the Tahoe's audio is only available through OCLP (or as @Anto65 wrote) or VoodooHDA.
Neither option is ideal. OCLP compromises the system's integrity, interfering with updates for both the system itself and individual applications, such as Microsoft Office.
VoodooHDA is difficult to set up, offers lower sound quality, and offers reduced functionality. The choice depends on the user's needs and personal preferences...

Edited October 19, 2025 by verdazil

[Henties]

@Anto65Thanks for providing the links to the information that I requested, will indeed have a good look at that.

I agree with @verdazil's comment on this topic and in particular the downside of:

 

activation via some or other OLCP mechanism 

or

quality considerations using VoodooHDA.

 

I believe that I will be able to solve this audio related problem with what I have available hardware wise, and at the same time preserve the security integrity as well as audio output quality that I have gotten used to over the years, all within the confines of my Apple environments.

 

Presently preparing another Comet Lake hack of mine to be upgradeable from Sonoma to Tahoe but this one uses an AMD RX6800TX  GPU.

Will proceed the same way that I successfully mastered the Comet Lake hack with an AMD RX580, cross fingers that it will actually work.

 

I am trying to prepare Tahoe to one day become my daily driver. At present I am however relying entirely on released versions of Sequoia to 

cater for my computational needs. 

 

Greetings Henties

 

 

 

Edited October 19, 2025 by Henties

[scypher]

I’ll do a backup anyway before the next upgrade. But I’m curious if I need to Log out on each Tahoe update, or was it just for the jump from Sequoia to Tahoe. 

I did the Log out of my account on an NVMe system and an SSD system. Both provided the same File Vault enable / decline option. I currently have to do SecureBootModel = Disabled for every update, hoping the Log Out of Apple account isn’t also a requirement. 

[Henties]

@scypherDoing a backup before any mayor "incision" on your daily driver is totally essential and considered to be a life saving measure, say no more.

It must also always be tested whether that backup is indeed restorable and functional should the need ever arise.

From what I understand the way you wish to proceed I see no problems because after everything is done and dusted you just login to your Apple account and everything is normal again and as it was before, provided of cause your environment is suitable for an upgrade from "whatever" to Tahoe.

In my case it all centers around Comet Lake with the hardware that I deployed, for anything else I cannot vouch. 

 

Just my 2 cents.

 

Greetings Henties

 

 

 

[cfmwan]

Use the https://bbs.pcbeta.com/viewthread-2046170-1-1.html post to modify and add apfs_align.ef. Enter the system and can't close the safe, and then enter https in recovery mode: //Bbs.pcbeta.com/viewthread-2045745-1-1.html This post is modified and closed. After logging in to the system, log in to the terminal with the root user and perform another operation. I got the prompt that it has been closed. After entering the system, it will be normal, which is as convenient as 15.6.