Question: I need to do remote checks to verify OSX has filevault enabled. When you enable filevault, does it create / change something on the HDD that I can check for on VPN login using my posture assessment tools?

Answer: 
Can you run a command line tool, such as `fdesetup`?

```
$ sudo fdesetup status
FileVault is On.

```

`fdesetup` also accepts the verb `isactive`, which returns 0 if FileVault is enabled (checking a return value is arguably more reliable than reading the text):

```
$ sudo fdesetup isactive
$ echo $?
0

```

`fdesetup` does require root access, which might be a problem.

You could also run `diskutil cs list` and check for the encryption status. The exact wording you're looking for is a bit complicated because of all the different possible combinations, [this script](https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/filevault_2_encryption_check) might be a good start.
`fdesetup` seems only avaliable on Mountain Lion.

Try this script on Lion: <https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/filevault_2_encryption_check/filevault_2_status_check.sh> 

The basic idea is: `diskutil cs list`