filevaultd

executablemacOS178.9 KBx86_64, arm64

MDM profile manager — processes and applies device management configuration

Loads and enforces Mobile Device Management profiles that define security policies, restrictions, and device settings. Accesses MDM configuration data to retrieve enrollment status, permitted applications, and compliance requirements. Schedules background tasks to periodically validate policy compliance and refresh profile status. Communicates with MDM servers via network endpoints to report device state and receive policy updates. Sends telemetry about profile application and policy enforcement to Apple systems.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 178.9 KB
UUID: E05B0536-4FB1-3EE4-BBF0-6A41FDE339E4
Analyzed: 2026-04-09T09:49:12Z
CDHash: 26a15f305bef01b0016dc2ad5e8a6e3e28a1d1dd80d7b39a55890976a833ef74

Capabilities

SystemAccess MDM configuration profiles

com.apple.private.managedclient.configurationprofiles [object Object]

SystemBackground task scheduling

/System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasks

Frameworks16

FileVault Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation ArgumentParserInternal BackgroundSystemTasks libswiftCore.dylib libswiftCoreFoundation.dylib(weak)libswiftDispatch.dylib libswiftIOKit.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_DarwinFoundation3.dylib libswiftos.dylib

Entitlements8

com.apple.accounts.appleaccount.fullaccesstrue

com.apple.duet.activityscheduler.allowtrue

com.apple.private.AuthenticationServicesAgent.fileVaultRecoveryKeystrue

com.apple.private.managedclient.configurationprofilestrue

com.apple.private.octagontrue

com.apple.private.opendirectoryd.identitytrue

com.apple.private.opendirectoryd.securetokentrue

com.apple.security.temporary-exception.mach-lookup.global-name

com.apple.duetactivityscheduler com.apple.mdmclient.daemon com.apple.security.octagon com.apple.AuthenticationServices.AuthenticationServicesAgent.FileVaultRecoveryKeys

Interesting Strings

Bundle IDs(27)

&com.apple.duet.activityscheduler.allow )com.apple.private.opendirectoryd.identity *com.apple.accounts.appleaccount.fullaccess ,com.apple.private.opendirectoryd.securetoken 5com.apple.private.managedclient.configurationprofiles

File Paths(5)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/PrivateFrameworks/ArgumentParserInternal.framework/Versions/A/ArgumentParserInternal /System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasks /System/Library/PrivateFrameworks/FileVault.framework/Versions/A/FileVault

telemetry(14)

HealthAnalytics Background Task failed: %@HealthAnalyticsTask NOPAnalytics _$s9FileVault0aB7ManagerV4core9analytics7admUserAcA0aB12CoreProtocol_p_AA09AnalyticsI0_pSo7ADMUserCmtcfC _$s9FileVault0aB7ManagerV4core9analytics7admUserAcA0aB12CoreProtocol_p_AA09AnalyticsI0_pSo7ADMUserCmtcfcfA1_

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation libswiftCoreFoundation.dylib libswift_DarwinFoundation3.dylib

Endpoints(7)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

0

System

2

Behavioral Profile

URL Endpoints

4

Telemetry Strings

14

File Paths

5

Bundle IDs

27

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code50e2f5f725920a9ee6ba843362635ad38d9e59a0a78fd505d5d1db07ef528d68

Imports97a533bd56cd8ee24f24eb32df86d7563d1fba9ce8d0e8a5322ba0a069988f00

Frameworks95fb39471c3b85d941c9c3ce293ffd82d611425d2ceecb06ce72db12dc1fd919

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements77a4a72ec540644532d5568c71f60279a95bd94c2a24f8e40515f147a0d69820

Symbols97a533bd56cd8ee24f24eb32df86d7563d1fba9ce8d0e8a5322ba0a069988f00

Static Libraries0 / 89 functions identified

Functions(89)

0x100001298sub_100001298

0x10000133csub_10000133c

0x100001390sub_100001390

0x1000013a4sub_1000013a4

0x100001410sub_100001410

0x100001424sub_100001424

0x100001494sub_100001494

0x1000014e0sub_1000014e0

0x10000154csub_10000154c

0x1000015d0sub_1000015d0

0x100001fa8sub_100001fa8

0x100001facsub_100001fac

0x100001fc8sub_100001fc8

0x100001fecsub_100001fec

0x100002034sub_100002034

0x10000206csub_10000206c

0x100002074sub_100002074

0x1000020ccsub_1000020cc

0x100002120sub_100002120

0x100002180sub_100002180

Imports143 symbols from 11 dylibs

libswiftCore.dylib57 FileVault28 ArgumentParserInternal18 libSystem.B.dylib14 libobjc.A.dylib10

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

devicerecoverytool

diagnosticspushd

swtransparency-sysdiagnose

modelmanagerdump

audioanalyticsd

modelcatalogdump