macOS Essentials

macOS and the Mac

macOS is Apple's operating system for Mac computers, a Unix-based system that Apple develops together with the hardware and that runs only on Macs. That tight coupling is the main difference from Windows for a technician: there are few driver problems and few hardware variations, but also fewer ways to replace parts or install other systems.

A new macOS version appears every autumn and is free. Since macOS 26 Tahoe (2025), the version number follows the year, jumping from macOS 15 Sequoia; older versions carried names such as Sonoma (14) and Ventura (13). Apple typically provides security updates for the current version and the two before it, although it does not promise this formally. Apple menu > About This Mac shows the version and the processor.

Since 2020, Macs use Apple silicon: Apple's own ARM-based chips (ARM: Advanced RISC Machines, a family of reduced instruction set computer processor designs; M1 and later), with the CPU (central processing unit), graphics and memory in one package. Earlier Macs used Intel processors. Apps built for Intel still run on Apple silicon through Rosetta 2, a translation layer installed on first use. The difference matters for startup key combinations, recovery, Boot Camp (Windows on a Mac, Intel only) and memory upgrades (impossible on Apple silicon). Apple has announced that macOS 26 Tahoe is the last version for Intel Macs.

Finding your way around

The Finder

The Finder is the macOS file manager and desktop, always running, used to browse, open, move and delete files, like File Explorer on Windows. Its sidebar shows favorites (Applications, Documents, Downloads), iCloud Drive, connected disks and network locations. The Go menu jumps to folders; Go to Folder (Shift+Command+G) accepts a path. Two defaults to change when troubleshooting: Finder > Settings > Advanced > Show all filename extensions, and Shift+Command+. (period) to toggle hidden files. The user's Library folder, where apps keep settings and caches, is hidden; hold Option while opening the Go menu to reveal it.

The Dock and the menu bar

The Dock at the bottom of the screen holds app shortcuts, running apps (marked with a dot) and the Trash. The menu bar at the top always belongs to the active app: unlike Windows, apps have no menu inside their own window. The Apple menu on the left of the menu bar is always there, with About This Mac, System Settings, Force Quit, Restart and Shut Down. On the right are status icons, Control Center and the clock. Closing an app's last window usually does not quit the app; Command+Q does.

Spotlight

Spotlight is the macOS system-wide search, opened with Command+Space, that finds apps, files, settings, email and more from an index it keeps of the disk. It is also the quickest way to start anything: type "Disk Utility" or "Terminal" and press Return. When Spotlight stops finding files that exist, its index may be damaged; it can be rebuilt by adding the disk to the privacy list in Spotlight settings and removing it again.

Mission Control and Launchpad

Mission Control (Control+Up Arrow or a three- or four-finger swipe up on the trackpad) shows all open windows and Spaces, multiple virtual desktops. Trackpad gestures are a large part of how Mac users work; they are configured under Trackpad in System Settings. Launchpad showed all installed apps as an icon grid in older versions; in macOS 26 Tahoe, Apple replaced it with an Apps view in Spotlight.

System Settings

System Settings is where macOS is configured. Before macOS 13 Ventura (2022) it was called System Preferences, and older documentation and exam material still use that name. The sections a technician uses most:

• Network and Wi-Fi: interfaces, IP (Internet Protocol) addresses, DNS (Domain Name System), proxy and VPN (virtual private network) settings.
• Users & Groups: accounts, which can be Standard or Administrator. Installing software system-wide and changing security settings needs an administrator's name and password.
• Privacy & Security: app permissions for camera, microphone, files and screen recording, Gatekeeper, and FileVault.
• General: Software Update, Storage, Time Machine, Login Items (apps that start at sign-in) and Transfer or Reset.
• Displays, Printers & Scanners, Accessibility: as the names say.

iCloud and the Apple Account

The user's Apple Account (called Apple ID until 2024) connects the Mac to iCloud: iCloud Drive for files, Photos, iCloud Keychain for passwords, Messages and FaceTime, and Find My. Find My enables Activation Lock on current Macs, which prevents anyone else from erasing and reusing a lost Mac. Before a Mac is handed to someone else, the user must sign out of their Apple Account; then use General > Transfer or Reset > Erase All Content and Settings. A Mac that is still locked to a former employee's account is a common and hard problem. Organizations avoid it with an MDM (mobile device management) system and Apple Business Manager.

Installing and removing apps

Mac apps arrive in three ways:

• App Store: Apple's store, signed in with the Apple Account. Apps are reviewed by Apple, run in a sandbox, and update automatically.
• Disk image (.dmg): a file that mounts like a disk when opened, usually containing the app and a shortcut to Applications. Drag the app to the Applications folder, then eject the disk image in the Finder sidebar and delete the .dmg.
• Installer package (.pkg): opens the Installer app, which walks through steps and can place files anywhere on the system, so it asks for an administrator password. Drivers, security software and business applications usually come this way.

An app on macOS is a .app bundle: a folder that looks like a single file. To uninstall most apps, drag them from Applications to the Trash. Apps installed from a .pkg often come with their own uninstaller, which you should use, because they leave files and background services behind otherwise. Settings stay in the user's Library folder either way.

Gatekeeper and notarization

Gatekeeper is the macOS security feature that checks apps downloaded from the internet before they open, and blocks those that are not signed by an identified developer and notarized by Apple. Notarization means the developer submitted the app to Apple, which scanned it for known malware before issuing a ticket. Under Privacy & Security, the setting "Allow applications from" offers App Store, or App Store and known developers.

When Gatekeeper blocks an app the user trusts, the approval is under System Settings > Privacy & Security, Open Anyway (available for about an hour after the blocked attempt), then the user's login password. (Before macOS 15 Sequoia, Control-clicking the app and choosing Open did the same.) Macs also include XProtect, which scans for known malware and is updated by Apple in the background.

Keychain and FileVault

Keychain

Keychain is the macOS encrypted store for passwords, keys and certificates, unlocked by the user's login password, so that apps and Safari can fill in credentials without asking each time. It holds website and Wi-Fi passwords, server credentials, and the certificates and private keys used for email signing, VPNs and 802.1X network access. iCloud Keychain syncs passwords between the user's Apple devices.

Since macOS 15 Sequoia, the Passwords app shows saved passwords and passkeys. The older Keychain Access app, still available and easiest to open with Spotlight, is the tool for certificates and for troubleshooting. A classic ticket: after an administrator resets a user's password, macOS asks repeatedly for the old keychain password, because the login keychain is still encrypted with it. If the old password is known, it can be updated; if not, a new keychain has to be created and saved passwords are lost.

FileVault

FileVault is the macOS full-disk encryption feature, which encrypts the startup disk so that its data cannot be read without a user password or the recovery key. It is the Mac counterpart of BitLocker. A stolen Mac with FileVault on is a lost device, not a data breach. Turn it on in Privacy & Security; on Macs with Apple silicon or a T2 security chip, the disk is already hardware-encrypted, and FileVault adds the requirement that a password unlocks it at startup.

When FileVault is enabled, macOS lets the user either allow their iCloud account to unlock the disk, or create a recovery key: a long code that unlocks the disk if the password is forgotten.

Time Machine

Time Machine is the backup feature built into macOS, which automatically backs up the whole Mac (apps, settings and files) to an external disk or network storage, keeping older versions. Connect an external disk, choose it under General > Time Machine, and the rest is automatic. It can also use a network-attached storage (NAS) device that supports Time Machine over SMB (Server Message Block), or another Mac sharing a disk. New backup disks are formatted with APFS (Apple File System), and the backups can be encrypted.

Time Machine keeps hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. When the disk is full, it deletes the oldest backups. A simplified model of that thinning, for a Mac that has been backed up every hour for 90 days:

DAYS = 90
NOW = DAYS * 24                   # hours since the first backup
backups = list(range(0, NOW))     # one backup every hour, as hour numbers

kept = {"hourly": [], "daily": [], "weekly": []}
seen_days, seen_weeks = set(), set()
for hour in backups:
    age = NOW - hour              # hours ago
    day, week = hour // 24, hour // (24 * 7)
    if age <= 24:
        kept["hourly"].append(hour)
    elif age <= 30 * 24:
        if day not in seen_days:          # first backup of each day
            seen_days.add(day)
            kept["daily"].append(hour)
    elif week not in seen_weeks:          # first backup of each week
        seen_weeks.add(week)
        kept["weekly"].append(hour)

for kind, hours in kept.items():
    print(f"{kind:<7} {len(hours):>3} backups")
print(f"total   {sum(len(h) for h in kept.values()):>3} of {len(backups)} made")

hourly   24 backups
daily    29 backups
weekly    9 backups
total    62 of 2160 made

The result: fine-grained versions of recent work, and a long history at low cost. Files can be restored from the Time Machine browser (open the folder, then Time Machine from the menu bar), a whole Mac with Migration Assistant, or a failed disk from macOS Recovery. A single external disk in the same bag as the laptop is not a complete backup strategy, though; see Backup and Recovery.

Disk Utility and macOS Recovery

Disk Utility (in Applications > Utilities) is the Mac counterpart of Disk Management and chkdsk in one: it erases and formats disks, creates APFS volumes and partitions, and checks and repairs file systems with First Aid. Run First Aid when a disk behaves oddly or apps report file errors; to repair the startup disk fully, run it from macOS Recovery, where the disk is not in use.

macOS Recovery

macOS Recovery is a separate, minimal system on the Mac for repairs and reinstallation, the counterpart of the Windows Recovery Environment. How to start it depends on the processor:

• Apple silicon: shut down, then press and hold the power button until "Loading startup options" appears. Click Options, then Continue.
• Intel: turn on the Mac and immediately hold Command+R. Option+Command+R starts Internet Recovery, which downloads recovery from Apple, for example when the disk has been replaced.

Recovery offers four main options: Restore from Time Machine, Reinstall macOS (downloads the system and keeps user data), Safari to look up help, and Disk Utility. The Utilities menu adds Terminal and, depending on the Mac, security settings for startup. For a problem caused by third-party software, start in safe mode first: on Apple silicon, from the same startup options, select the disk while holding Shift; on Intel, hold Shift at startup.

The Terminal

Terminal (Applications > Utilities) gives the Unix command line under macOS. Since macOS 10.15 Catalina (2019), the default shell for new accounts is zsh (Z shell); before that it was bash (Bourne Again Shell). Most Linux commands work the same way (ls, cd, cp, grep, sudo), and some are Mac-specific. A few that answer common support questions:

sw_vers
fdesetup status
spctl --status

ProductName:		macOS
ProductVersion:		26.0.1
BuildVersion:		25A362
FileVault is On.
assessments enabled

• sw_vers: the macOS version and build.
• fdesetup status: whether FileVault is on.
• spctl --status: whether Gatekeeper's assessments are enabled.
• diskutil list shows disks and volumes, tmutil latestbackup the most recent Time Machine backup, and softwareupdate --list available updates.

The Linux command line is covered in its own topic, Linux & Command Line; almost all of it applies to the Mac Terminal too.

Shortcuts for Windows users

The key that does most of the work on a Mac is Command (⌘), where Windows uses Ctrl. Option (⌥) is roughly the Alt key. The combinations a technician needs on day one: