--- title: "Mac not on the network until after login: FileVault, Wi-Fi and 802.1X · Kilobat Guides" url: "https://kilobat.app/guides/mac-no-network-before-login" description: "A Mac mini or other Mac is not reachable after a restart until someone logs in. Check FileVault, the network type and 802.1X profiles." --- # Mac has no network until someone logs in After a restart, some Macs stay off the network until a user logs in. Remote access then fails. FileVault, the network type and how a profile sets up 802.1X all change what happens before login. **Fix this with your agent**Copies a prompt for Claude Code, Codex or any agent that can use Terminal. My Mac has this problem: Mac has no network until someone logs in. Read https://kilobat.app/guides/mac-no-network-before-login.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting. Applies to: macOS 14 Sonoma and later. Unlocking FileVault over SSH needs a Mac with Apple silicon and macOS 26 or later. · Checked: 7 November 2026 ## Symptoms - After a restart or a power cut, SSH, Screen Sharing and file sharing to the Mac fail. - The router does not show the Mac until someone logs in at the Mac. - A headless Mac mini comes back online only after you connect a display and log in. - The Mac connects to Ethernet before login, but not to Wi-Fi. - On a company network, the Mac authenticates with 802.1X only after login. ## Likely causes - **FileVault is on.** The Mac waits at the FileVault unlock screen after a restart. Apple says that automatic login is not available when FileVault is on. - **An 802.1X profile for the user, not the system.** Apple's Ethernet settings for device management can start the connection after users log in. They can also make it a system setting that is active at all times. - **Login Window Mode needs a directory.** Apple says that 802.1X at the login window needs a bind to Active Directory or Open Directory and a profile from device management. - **Wi-Fi before login is not documented.** Users report that some Macs join Wi-Fi before login and others do not. Apple does not document when a personal Wi-Fi network joins before login. - **A network with a sign-in page.** A network that needs a browser sign-in cannot work until someone signs in. ## How to check 1. Restart the Mac. Do not log in. 2. From another computer, ping the Mac by its IP address. No reply means that the Mac is not on the network. ``` ping -c 5 192.168.1.20 ``` 3. Log in on the Mac. Make sure that FileVault is on or off in System Settings > Privacy & Security > FileVault. 4. Show which connection the Mac uses. Note if it is Wi-Fi or Ethernet. ``` route -n get default ``` Output The `interface:` line, for example `en0`. 5. Match the interface with its hardware port. ``` networksetup -listallhardwareports ``` 6. Show the configuration profiles on the Mac. Look for Wi-Fi or Ethernet payloads with 802.1X. ``` sudo profiles show -type configuration ``` Needs an administrator password. ## How to fix it 1. For a Mac that must be on the network after each restart, connect it with Ethernet if you can. 2. On a Mac with Apple silicon and macOS 26 or later, turn on Remote Login. Then you can unlock FileVault over SSH after a restart. 3. To turn on Remote Login, choose Apple menu > System Settings > General > Sharing. Turn on Remote Login. 4. After a restart, connect to the Mac with SSH to unlock FileVault. 5. If you turn FileVault off, you can set automatic login. Choose System Settings > Users & Groups > Automatically log in as. 6. Know the risk of automatic login. Apple says that it lets anyone use the Mac after a restart. 7. On a managed Mac, ask your administrator for a device profile. The profile must make 802.1X a system setting, not a user setting. 8. For 802.1X at the login window, the Mac needs a directory bind and a Login Window Mode profile. ## With Kilobat 1. The Kilobat app starts after you log in, so it cannot see the time before login. 2. The drop history shows when the app lost and got back the connection while it ran. ``` kilobat outages ``` 3. A gap in the history means that the app did not run. After a restart, a gap until login is normal. 4. After you log in over SSH, find where traffic leaves the Mac. ``` kilobat ip ``` 5. Check the router, internet and DNS from the same SSH session. ``` kilobat diagnose ``` ## Questions **Does FileVault turn off the network before login?** Apple does not say this in general. Apple says that you can unlock FileVault over SSH when a network connection is available. That applies to Macs with Apple silicon and macOS 26 or later. **Is Ethernet better than Wi-Fi for a headless Mac?** Apple does not document a difference before login. Users report that Ethernet connects before login more often than Wi-Fi. Ethernet also does not need a saved password. **Can I set Wi-Fi to join before login on an unmanaged Mac?** Apple documents the System and Login Window modes only for profiles from device management. There is no documented setting in System Settings for this. ## Sources - [Apple Platform Security: Managing FileVault in macOS](https://support.apple.com/guide/security/sec8447f5049/web) - [Apple Support: How to log in automatically to a Mac user account](https://support.apple.com/en-us/102316) - [Apple Support: Allow a remote computer to access your Mac](https://support.apple.com/guide/mac-help/allow-a-remote-computer-to-access-your-mac-mchlp1066/mac) - [Apple Platform Deployment: Ethernet device management settings for Apple devices](https://support.apple.com/guide/deployment/depc13d374c3/web) - [Apple Support: Use Login Window Mode for 802.1X authentication to a network](https://support.apple.com/en-us/102001) - [Apple Developer: WiFi (Device Management), SetupModes](https://developer.apple.com/documentation/devicemanagement/wifi) - profiles(1), route(8) and networksetup(8), man pages installed with macOS 27.2 Checked on 7 November 2026. ## Related guides - [Use Wake for network access on a Mac](https://kilobat.app/guides/wake-for-network-access): Wake for network access lets a sleeping Mac wake when another computer uses its shared resources. - [ssh: connect to host port 22: Operation timed out on Mac](https://kilobat.app/guides/ssh-port-22-operation-timed-out): ssh sent a connection request to port 22 and got no answer. - [caffeinate on Mac: keep awake from Terminal](https://kilobat.app/guides/caffeinate-keep-mac-awake): Run caffeinate -i in Terminal to stop idle sleep on your Mac. - [Mac uses the wrong network connection](https://kilobat.app/guides/network-service-order): When more than one connection is active, the Mac tries the service at the top of the list first. - [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing): Public networks often hold all traffic until you sign in on a login page.