7.1 macOS Support, Recovery, and System Utilities

7.1 macOS Support, Recovery, and System Utilities

Quick Summary: Enterprise macOS administration requires navigating modern System Settings and Finder preferences, managing Transparency, Consent, and Control (TCC) security permissions and Gatekeeper notarization, maintaining APFS storage volumes with Disk Utility, analyzing system performance and memory pressure in Activity Monitor, and deploying macOS Recovery tools across Apple Silicon and Intel architectures.

---

macOS Management Interfaces & System Preferences

IT support technicians working in enterprise and education environments frequently manage macOS workstations alongside Windows PCs. Understanding Apple's configuration hierarchy, system preferences, and desktop navigation is foundational for Tier 1 and Tier 2 support.

+-----------------------------------------------------------------------------------+
|                           MACOS CONFIGURATION TOPOLOGY                            |
+-----------------------------------------------------------------------------------+
|  System Settings (Ventura/Sonoma/Sequoia) | Vertical sidebar navigation (iOS-like)|
|  Legacy System Preferences (Monterey-)   | Grid of standalone icon applets        |
|  Finder Settings (Cmd + ,)               | File management, extensions, sidebar   |
|  Dock Configuration                      | Application launcher, positioning, auto-hide|
+-----------------------------------------------------------------------------------+

System Settings vs. Legacy System Preferences

Apple fundamentally overhauled the primary administrative portal in macOS 13 Ventura, continuing through macOS 14 Sonoma and macOS 15 Sequoia:

• Modern System Settings (macOS 13+): Replaced the legacy preference panes with an interface modeled directly on iPadOS and iOS. Settings are organized in a vertical navigation sidebar on the left with corresponding configuration panels on the right. Key administrative categories include Network, Displays, Privacy & Security, Lock Screen, and General (which houses Software Update, Storage, Time Machine, and Transfer or Reset).
• Legacy System Preferences (macOS 12 Monterey and earlier): Displayed a grid of individual applet icons (e.g., Network, Displays, Security & Privacy, Software Update). When supporting older corporate Mac deployments, technicians navigate this grid rather than the modern sidebar.

Finder Preferences & Configuration (Cmd + ,)

The Finder is the native file manager and graphical desktop shell in macOS. Technicians configure global Finder behavior by opening Finder and pressing Cmd + , (Command + Comma, the universal macOS shortcut for application settings):

Dock Configuration

The Dock provides quick access to frequently used applications, running processes, minimized windows, and the Trash. Accessible via System Settings > Desktop & Dock:

• Position on screen: Can be pinned to the Bottom, Left, or Right edge of the screen.
• Automatically hide and show the Dock: Maximizes usable screen real estate by sliding the Dock off-screen until the user hovers the cursor along the configured display edge.
• Minimization Effects: Genie Effect (fluid animated funneling into the Dock) vs. Scale Effect (faster, linear reduction, reducing GPU rendering overhead on resource-constrained hardware).
• Show recent applications in Dock: Displays recently launched apps on the right side of the divider bar. Disabling this helps prevent visual clutter in managed multi-user environments.

---

Display Configuration & External Displays

Configuring dual monitors, external conference room displays, and projector mirroring is a frequent IT support task.

[ MacBook / Mac Mini ] ──(USB-C / Thunderbolt / HDMI)──► [ External Monitor / Projector ]
                                                                │
                                      ┌─────────────────────────┴─────────────────────────┐
                                      ▼                                                   ▼
                               [ Mirror Mode ]                                     [ Extended Mode ]
                        Clones identical screen output                      Spans desktop across screens
                        (Lowest common resolution)                          (Independent resolutions/scaling)

Video Connections & Multi-Monitor Modes

macOS detects external displays connected via USB-C (DisplayPort Alternate Mode), Thunderbolt 3/4, or native HDMI. In System Settings > Displays:

• Extended Desktop: Spans the macOS workspace across multiple panels. Technicians arrange monitor orientation in the Arrange sub-window by dragging monitor graphics to match their physical desk positioning. The primary display (containing the default menu bar and Dock) is designated by dragging the white menu bar strip to the preferred monitor.
• Mirror Displays: Clones the identical desktop across all connected screens. When mirroring, macOS synchronizes both screens to the lowest common supported resolution.

Display Scaling & Native Resolution

Apple Retina displays pack high pixel densities requiring software scaling:

• Default for Display: Renders the desktop at Apple's optimal native 2x HiDPI scaling ratio (e.g., rendering four physical pixels for every one logical point), providing sharp text and UI elements.
• Scaled Resolutions: Offers options ranging from Larger Text (lower logical resolution) to More Space (higher logical resolution). Technicians should warn users that running extreme More Space scaling increases GPU rendering load and can slightly degrade gaming or rendering performance.

Night Shift & True Tone

• Night Shift: Automatically shifts the display color balance toward the warmer amber end of the spectrum during evening hours or based on custom sunset-to-sunrise scheduling, reducing blue-light exposure that disrupts sleep patterns.
• True Tone: Utilizes multichannel ambient light sensors embedded in the Mac bezel to dynamically adjust the white point and color intensity of the display to match ambient lighting conditions. Support Note: True Tone should be disabled by graphic designers, video editors, and prepress technicians requiring color-accurate proofs.

---

Application Permissions, Privacy & Security

macOS enforces stringent application sandboxing and access controls to prevent malware and unauthorized utilities from harvesting user data.

+-----------------------------------------------------------------------------------+
|                 TRANSPARENCY, CONSENT, AND CONTROL (TCC) ENGINE                   |
+-----------------------------------------------------------------------------------+
| Applications Request Access ──► TCC Daemon (tccd) ──► Evaluates Local TCC.db      |
|                                                             │                     |
|                                     ┌───────────────────────┴────────────────────┐|
|                                     ▼                                            ▼|
|                           User Approval Dialog                         System Settings     |
|                           "Allow" / "Don't Allow"                      Privacy & Security  |
+-----------------------------------------------------------------------------------+

The Transparency, Consent, and Control (TCC) Framework

The TCC framework manages application access to sensitive hardware components and user personal data. Permissions are tracked in localized SQLite databases (com.apple.TCC/TCC.db). Applications cannot grant themselves TCC permissions; they must be explicitly authorized by a local administrator or pushed via Mobile Device Management (MDM) configuration profiles.

Command-Line Troubleshooting: Technicians can reset corrupted TCC permission states for an application using the tccutil terminal command:

# Reset screen capture permissions for a specific app (e.g., Microsoft Teams)
tccutil reset ScreenCapture com.microsoft.teams

# Reset microphone permissions globally across all applications
tccutil reset Microphone

Gatekeeper & Unidentified Developers

Gatekeeper protects macOS against malicious software by enforcing cryptographic signature validation and Apple notarization:

1. When an application is downloaded from the internet, the browser attaches the com.apple.quarantine extended file attribute.
2. Upon execution, Gatekeeper checks the developer's digital signature against Apple's Developer ID database and verifies that Apple has scanned and notarized the code against known malware.
3. Handling Blocked Apps: If an in-house or legacy corporate application fails notarization, macOS blocks execution with an alert: "App can't be opened because it is from an unidentified developer."
   • GUI Remediation: Open System Settings > Privacy & Security, scroll to Security, locate the blocked app notification, and click Open Anyway (requires admin authentication).
   • CLI Remediation: Strip the quarantine extended attribute manually:

# View extended attributes on the target application
xattr -l /Applications/InternalTool.app

# Remove the quarantine flag
xattr -d com.apple.quarantine /Applications/InternalTool.app

---

Storage Management, Filesystems & Disk Utility

Managing internal storage volumes, formatting external drives, and verifying filesystem integrity are routine macOS support tasks.

Filesystem Comparison: APFS vs. HFS+ vs. exFAT vs. FAT32

Disk Utility Operations

Disk Utility (/Applications/Utilities/Disk Utility.app) provides centralized disk and volume management:

Physical Internal SSD (Apple SSD Controller)
  └── Apple Fabric / NVMe Controller
        └── Container disk3 (APFS Container - Dynamic Space Sharing)
              ├── Macintosh HD (System Volume - Cryptographically Sealed / Read-Only)
              ├── Macintosh HD - Data (User Data, Apps, Home Folders)
              ├── Preboot (Bootloader assets)
              ├── Recovery (macOS Recovery Environment)
              └── VM (Virtual Memory Swapfile Paging)

• First Aid: Executes filesystem integrity checks using fsck_apfs. First Aid verifies the container superblock, checkpoint map, object map, volume records, and snapshot metadata. Technicians run First Aid when storage exhibits input/output (I/O) errors, file corruption, or fails to mount.
• Erase (Format): Allows technicians to format drives, select partition schemes (GUID Partition Table / GPT for all modern systems; Master Boot Record / MBR for legacy FAT32 drives), and assign filesystems.
• APFS Containers & Volumes: Unlike traditional partitions that reserve rigid, fixed block ranges, APFS introduces Containers. Multiple APFS volumes within the same container share the free pool of storage dynamically. Adding an APFS volume takes seconds and requires no disk re-partitioning.

Mounting & Unmounting Drives

• GUI: To safely eject an external volume, drag the desktop disk icon to the Trash (which transforms into an Eject icon), click the Eject symbol next to the drive in the Finder sidebar, or select Eject in Disk Utility.
• CLI (diskutil):

# List all connected disks, containers, and partition identifiers
diskutil list

# Unmount a specific volume safely
diskutil unmount /dev/disk4s1

# Force unmount a locked or busy volume
diskutil unmount force /dev/disk4s1

# Mount an unmounted volume
diskutil mount /dev/disk4s1

---

Web Browser Troubleshooting & AirDrop Diagnostics

Safari Maintenance & Extension Management

When Safari displays web pages incorrectly, hangs, or experiences credential loops:

• Clear History & Website Data: Go to Safari > Clear History... to wipe browsing history, cache, and all cookies across all visited sites. To remove cookies selectively without wiping general history, navigate to Safari > Settings > Privacy > Manage Website Data..., search for the domain (e.g., office.com), and click Remove.
• Empty Caches via Developer Menu: Enable the Develop menu in Safari > Settings > Advanced > Show features for web developers. Then select Develop > Empty Caches (shortcut: Option + Cmd + E). This purges cached assets without deleting stored cookies or session logins.
• Managing Safari Extensions: Open Safari > Settings > Extensions. Rogue or outdated extensions can hijack search providers, inject adware, or break enterprise portals. Uncheck extensions to disable them, or click Uninstall to delete them completely.
• Private Browsing: Press Shift + Cmd + N to launch a Private Browsing window, which isolates cookies, suppresses history, and disables non-essential extensions to test site functionality.

AirDrop Architecture & Troubleshooting

AirDrop enables peer-to-peer file transfers between Apple devices without an intermediary network server or internet access.

[ Device A (Mac) ] ──(Bluetooth Low Energy - BLE)──► [ Device B (iPhone/Mac) ]
       │             Discovery & Identity Verification              │
       │                                                            │
       └──────────(Apple Wireless Direct Link - AWDL)──────────────┘
                   High-Speed Peer-to-Peer Wi-Fi Transfer

• Technical Requirements: Both Bluetooth (used for low-power device discovery and identity exchange) and Wi-Fi (used for establishing a high-speed point-to-point Wi-Fi Direct connection via Apple Wireless Direct Link / AWDL) must be powered ON. Active internet access is not required.
• Discoverability Modes (Control Center > AirDrop):
  1. Receiving Off: The device rejects all incoming AirDrop transfer attempts.
  2. Contacts Only: Only individuals saved in the recipient's Contacts with a validated Apple Account phone number or email address can discover the device.
  3. Everyone for 10 Minutes: Makes the device visible to all nearby Apple hardware. After 10 minutes, macOS automatically reverts discoverability to Contacts Only to protect user privacy.
• Troubleshooting AirDrop Failures:
  • Personal Hotspot: If either device has Personal Hotspot active, AirDrop is automatically disabled because the Wi-Fi chip is dedicated to hotspot routing.
  • Firewall Blocking: If the macOS Application Firewall is configured to "Block all incoming connections," AirDrop daemon processes (sharingd) cannot receive files.
  • Focus / Do Not Disturb: Suppresses incoming transfer notification banners.

---

Activity Monitor & Process Management

Located in /Applications/Utilities/Activity Monitor.app, Activity Monitor is macOS's primary real-time performance diagnostic console.

+-----------------------------------------------------------------------------------+
|                         ACTIVITY MONITOR DIAGNOSTIC TABS                          |
+-----------------------------------------------------------------------------------+
| CPU     | % CPU, CPU Time, Threads, Idle Wakeups, Runaway process identification  |
| Memory  | Memory Used, Cached Files, Swap Used, Color-Coded Memory Pressure Graph |
| Energy  | Energy Impact, 12-hour power consumption, App Nap state                 |
| Disk    | Read/Write IOPS, Bytes Read/Written, physical drive throughput          |
| Network | Packets In/Out, Data Received/Sent, bandwidth utilization               |
+-----------------------------------------------------------------------------------+

The Memory Pressure Metric

Unlike legacy systems that measure available RAM in pure megabytes, macOS utilizes advanced memory compression. The Memory Pressure graph at the bottom of the Memory tab reflects true RAM health:

• Green: Physical RAM is sufficient. The kernel has adequate memory for active processes and file system caches.
• Yellow: Memory pressure is elevated. The kernel is compressing inactive memory pages in RAM to avoid swapping to disk. Performance remains acceptable, but additional heavy workloads may degrade responsiveness.
• Red: Critical memory exhaustion. Physical RAM and compression buffers are saturated. The kernel is actively thrashing, reading and writing memory pages to the SSD swapfile (/private/var/vm/swapfile). The system will exhibit severe stuttering and spinning wait cursors ("beachballs"). Technicians must close applications or terminate high-memory processes.

Terminating Unresponsive Applications

When an application freezes and fails to respond to window events:

1. Force Quit Applications Dialog: Press Cmd + Option + Esc, select the application tagged (Not Responding), and click Force Quit.
2. Activity Monitor GUI: Select the runaway process, click the Stop (X) button in the toolbar, and choose Force Quit (sends SIGKILL / -9) or Quit (sends SIGTERM / -15).
3. Terminal CLI:

# Find the Process ID (PID) of a runaway process
pgrep -l "Safari"

# Gracefully terminate the process (SIGTERM)
kill 4821

# Unconditionally kill the process immediately (SIGKILL)
kill -9 4821

# Terminate all processes matching an exact name
killall -9 "Microsoft Word"

---

Backup & Restoration: Time Machine

Time Machine is Apple's automated continuous backup architecture, capable of capturing full system states and granular historical file versions.

[ Internal Storage Drive (APFS) ]
       │
       ├─► Local APFS Snapshots (Hourly, retained locally up to 24 hours)
       │
       └─► External Backup Target / NAS (APFS Formatted Volume)
             ├── Hourly backups for the past 24 hours
             ├── Daily backups for the past month
             └── Weekly backups for all previous months (Until target disk is full)

• Local APFS Snapshots: Even when an external backup drive is unplugged, Time Machine leverages APFS copy-on-write capabilities to generate lightweight, point-in-time local snapshots on the internal drive every hour. These allow mobile users to recover deleted files from earlier in the workday without connecting their external backup drive.
• Backup Storage Format: Modern macOS requires the backup destination disk to be formatted as APFS or APFS (Encrypted). Older HFS+ backup drives are supported for legacy reads, but new backup volumes are automatically converted to APFS.
• Restoring Data:
  • Granular File Restore: Technicians launch the Time Machine interface, navigate the historical visual timeline along the right edge of the screen, select the desired file or folder version, and click Restore.
  • Complete System Restore: Performed via macOS Recovery or Migration Assistant, allowing technicians to restore an entire user profile, system configurations, and applications to a new or repaired Mac.

---

macOS Recovery Environment: Apple Silicon vs. Intel

The macOS Recovery environment provides low-level diagnostic and recovery utilities isolated on a dedicated APFS volume.

+-----------------------------------------------------------------------------------+
|                       MACOS RECOVERY LAUNCH PROCEDURES                            |
+-----------------------------------------------------------------------------------+
| Apple Silicon (M1 / M2 / M3 / M4) | Press and hold Power button until             |
|                                   | "Loading startup options" appears -> Options  |
| Intel-Based Architecture          | Restart, hold Cmd + R until Apple logo shows  |
|                                   | (Option + Cmd + R for Internet Recovery)      |
+-----------------------------------------------------------------------------------+

Launching macOS Recovery

• Apple Silicon (M1, M2, M3, M4 Macs):
  1. Shut down the Mac completely.
  2. Press and hold the Power button (or Touch ID sensor).
  3. Continue holding until the screen displays "Loading startup options".
  4. Select the Options gear icon and click Continue.
  5. Select an administrator account and enter the credentials to decrypt FileVault.
• Intel-Based Macs:
  1. Power on or restart the Mac.
  2. Immediately press and hold Cmd + R until the Apple logo or spinning globe appears to boot into the local recovery partition.
  3. Alternatively, hold Option + Cmd + R to trigger Internet Recovery, which downloads the latest compatible macOS recovery environment directly from Apple's servers over Wi-Fi/Ethernet.

Recovery Utilities

Once loaded into the Recovery console, technicians have access to four core tools:

1. Restore from Time Machine: Connects to a local backup drive or network share to restore a prior full system image.
2. Reinstall macOS: Downloads a clean copy of the macOS installer from Apple and reinstalls the operating system. Critical Support Fact: Reinstalling macOS over an existing installation does not erase personal user data, documents, or applications; it refreshes the cryptographically sealed system volume (Macintosh HD).
3. Safari: A stripped-down, sandboxed web browser used to research troubleshooting articles, access Apple Support documentation, or check service status.
4. Disk Utility: Used to run First Aid, format corrupted volumes, erase drives prior to clean deployment, or configure APFS containers.
5. Terminal (via Utilities Menu): Provides low-level command-line access to disk partitioning (diskutil), network utilities, and the resetpassword utility to reset local administrator accounts.

---

macOS Power Management

Exam topic 4.2 names power management as a macOS support area in its own right. The controls moved in recent releases: on portables the pane is System Settings > Battery, on desktops it is System Settings > Energy Saver, and both replaced the older unified Energy Saver preference pane.

Key Settings and What They Do

Battery Health and the Service Recommendation

Open System Settings > Battery > Battery Health, or hold Option and click the Apple menu to reach System Information > Power. Two values matter: cycle count (one full charge-equivalent, not one plug-in) and condition. A condition of Normal is healthy; Service Recommended means capacity or performance has degraded enough to warrant replacement. Users frequently report "my Mac shuts down at 30%" — that is the signature of a battery that can no longer deliver peak current, and the battery health pane confirms it in seconds.

Diagnosing Power Problems from the Command Line

# Full power and battery detail, including cycle count and condition
pmset -g batt
system_profiler SPPowerDataType

# Show what is currently preventing sleep - the answer to "why won't it sleep?"
pmset -g assertions

# Review recent sleep and wake events with their causes
pmset -g log | grep -i "Wake from"

pmset -g assertions is the highest-value command here: it names the process holding a PreventUserIdleSystemSleep assertion, which is how you prove that a video conferencing app, a media player, or a stalled backup — not a hardware fault — is keeping a Mac awake and draining its battery in a bag.

Apple Silicon versus Intel resets. On Intel Macs, resetting the SMC (System Management Controller) addresses power, battery, fan, and sleep anomalies, and resetting NVRAM/PRAM addresses display resolution and startup disk oddities. On Apple Silicon Macs, neither reset exists — the equivalent is a simple shutdown and restart, which performs the same reinitialisation. Advising a user with an M-series Mac to "reset the SMC" is a common and confusing error.

macOS Accessibility Features

Accessibility is listed under exam topic 4.2 exactly as it is for Windows. The controls live in System Settings > Accessibility, and the universal shortcut Option + Command + F5 (or a triple-press of Touch ID) opens the Accessibility Shortcuts panel on any Mac.

Support-relevant point: accessibility features are a frequent source of tickets reported as faults. A user complaining that "my Mac reads everything out loud" has hit Cmd + F5 and enabled VoiceOver, and the same shortcut turns it off. A user reporting that "the keyboard beeps and won't type properly" has usually enabled Slow Keys or Sticky Keys, often via the five-times-Shift shortcut. Check the Accessibility pane before escalating either as a hardware problem.

Do not confuse this with the Accessibility permission. macOS also has a Privacy & Security > Accessibility list, which grants applications the right to control the computer through synthetic input. That is an application permission described earlier in this section, and it is a different thing from the accessibility features that assist the user.

---

Real-World macOS Support Scenarios

Scenario 1: Teams Screen Sharing Fails on macOS Sonoma

Incident: An enterprise user updates their MacBook to macOS Sonoma. During a client presentation in Microsoft Teams, the user attempts to share an Excel spreadsheet. The client sees only a black box with the mouse pointer, and Teams alerts: "Screen recording permissions required." Analysis: macOS Sonoma enforces strict TCC permissions. Teams lacks authorization in the Screen Recording privacy domain. Resolution: The technician navigates to System Settings > Privacy & Security > Screen Recording. The technician locates Microsoft Teams, toggles the switch to ON, and authenticates with local administrator credentials. When prompted "Quit & Reopen," the technician confirms, restarting Teams with active screen capture capabilities.

Scenario 2: Severe Lag and Spinning Beachball During Heavy Multitasking

Incident: A software developer reports their Mac Mini has slowed to a crawl. Typing has a 5-second lag, and switching applications displays the spinning rainbow wait cursor. Analysis: The technician launches Activity Monitor (Cmd + Space > Activity Monitor) and inspects the Memory tab. The Memory Pressure graph is solid Red, Physical Memory is 16 GB, Memory Used is 15.8 GB, and Swap Used is 18.4 GB. A runaway container process is consuming 22 GB of virtual memory, forcing the kernel into severe disk thrashing. Resolution: The technician selects the runaway process, clicks the Stop (X) icon, and selects Force Quit. Memory Pressure drops to Green, Swap usage flushes, and the workstation instantly recovers fluid responsiveness.