Disable user's ability to change FileVault recovery key How can we disable user's ability to change FileVault recovery key using fdesetup changerecoverykey ?
Remove the user from the admin group would be the simplest method. The fdesetup needs sudo permissions or someone to re-enable the root user. Both of those options are possible when you have admin credentials.