Question: I need to do remote checks to verify OSX has filevault enabled. When you enable filevault, does it create / change something on the HDD that I can check for on VPN login using my posture assessment tools?

Answer: 
Can you run a command line tool, such as `fdesetup`?

```
$ sudo fdesetup status
FileVault is On.

```

`fdesetup` also accepts the verb `isactive`, which returns 0 if FileVault is enabled (checking a return value is arguably more reliable than reading the text):

```
$ sudo fdesetup isactive
$ echo $?
0

```

`fdesetup` does require root access, which might be a problem.

You could also run `diskutil cs list` and check for the encryption status. The exact wording you're looking for is a bit complicated because of all the different possible combinations, [this script](https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/filevault_2_encryption_check) might be a good start.
The rtrouton script mentioned previously seems needlessly complicated (I ended up there first, but after reading half of it came here).
I'm probably going to start with the below and wrap a little more logic around it.

```
diskutil cs list | grep "Fully Secure"

```