Lesson 2: macOS Features and Tools

A Windows technician can become a bad macOS technician very quickly by trying to translate every task into a Windows menu or command.

The support questions are familiar:

• Is the application installed correctly?
• Is the disk mounted?
• Does the user have permission?
• Is a credential stored incorrectly?
• Is management policy controlling the setting?
• Is the data backed up?

The tools and ownership model are different.

Support the platform that is actually in front of you.

Application distribution has several forms

.app

A macOS application often appears as an application bundle. Finder presents it like one item even though the bundle can contain many internal resources.

.dmg

A disk image is commonly used to distribute software. Opening it mounts a virtual volume containing the application or installer material.

Mounting the .dmg is not always the same thing as installing the app.

A common workflow is:

download approved .dmg
        ↓
mount image
        ↓
copy .app to /Applications
        ↓
unmount image

The vendor's current instructions still win.

.pkg

A .pkg uses the macOS installer framework and may place files or configure components in several locations.

It may require administrator approval or organization-managed deployment.

App Store and managed software

Applications may also arrive through the App Store or an organization-management system.

On a managed Mac, the correct path may be MDM deployment rather than a local installer.

Removing an application depends on what was installed

Some simple application bundles can be removed by moving the .app to Trash.

Other software installs background services, system extensions, launch agents, support files, or management components.

Follow vendor documentation.

Deleting random files from Library folders because they "look related" is how cleanup becomes a second incident.

macOS has system and user scopes

Important locations include:

/Applications
/Users
/Library
/System
~/Library

/Library and ~/Library are not the same scope.

The first is system-wide. The second belongs to the current user's home directory.

If an application works for one user but not another, that scope difference becomes useful evidence.

Finder is the normal file-management surface

Finder exposes mounted volumes, files and folders, applications, network locations, and user-accessible storage.

If Finder does not show an external drive, do not immediately conclude the drive is dead.

Ask whether Disk Utility sees the physical device, container, or volume first.

Disk Utility exposes the storage boundary underneath Finder

Disk Utility can inspect and manage supported disks, containers, volumes, mounting, formatting, and selected First Aid workflows.

Worked case:

USB storage device: detected
Disk Utility: physical disk visible
volume: present but not mounted
Finder: no usable volume displayed

The hardware is detected far enough for Disk Utility to see it.

The failure is at the volume, filesystem, or mount boundary.

Do not erase or initialize a disk that may contain important data simply because Finder does not show it.

Keychain is an identity and trust store

Keychain stores items such as passwords, certificates, cryptographic keys, and application or service credentials.

A user can know the correct account password while one application continues using an old stored credential.

Worked case:

website login: succeeds
same service in one macOS app: fails
account: active
Keychain entry: stale credential in supplied state

"User forgot password" is weak.

The stored application credential deserves inspection.

FileVault creates a recovery responsibility

FileVault provides full-volume encryption on supported Mac systems.

A complete support plan includes:

• recovery-key handling;
• organization escrow or management where applicable;
• user authentication dependencies;
• recovery workflow.

Encryption without managed recovery can turn a hardware repair into a data-access incident.

Time Machine is backup; iCloud Drive is synchronization

Time Machine supports backup and version-history workflows.

iCloud Drive synchronizes files and state across devices.

Those are different failure models.

If a user deletes a synchronized file and the deletion propagates, synchronization may be working perfectly.

Recovery depends on backup or version-history capability, not simply the existence of sync.

Apple services add identity and service dependencies

Apple cloud services can include:

• iCloud Drive;
• iMessage;
• FaceTime;
• device and account synchronization.

A failure can belong to:

local network
→ Apple ID
→ service availability
→ application configuration
→ sync state
→ device policy

Do not treat every iCloud symptom as a Wi-Fi problem.

Apple ID and corporate restrictions change authority

A personally owned Mac and an organization-managed Mac do not have the same authority model.

Management policy may restrict software installation, Apple ID use, privacy settings, security controls, updates, removable storage, or accounts.

If an approved .pkg requires administrator or MDM deployment, bypassing the restriction is not troubleshooting.

Identify who owns the setting.

System Settings is a responsibility map

At A+ depth, recognize areas for:

• Displays;
• Network;
• Printers & Scanners;
• Privacy & Security;
• Accessibility;
• Time Machine.

The exact layout can move between macOS releases.

The responsibility is the durable part.

If a camera works in one application but not another, Privacy & Security permissions become more relevant than replacing the camera.

Mission Control, multiple desktops, gestures, Finder, and Dock are user-state surfaces

Mission Control and multiple desktops organize application windows across spaces.

Trackpad or mouse gestures can move between desktops, reveal Mission Control, or trigger other navigation behavior.

The Dock exposes application launch and running-state cues.

A window that appears to "disappear" may be on another desktop. An application icon in the Dock may indicate a running app even when no window is visible.

Before killing a process, establish where the application actually is.

Spotlight is search plus indexing

Spotlight helps locate applications, files, and other indexed content.

If a file exists in Finder but Spotlight cannot find it, the file itself may be fine.

The indexing/search layer may be the failed boundary.

Continuity connects Apple devices into a larger system

Continuity features can let supported Apple devices share workflows across nearby devices and accounts.

Dependencies can include compatible hardware/software, Apple ID state, Bluetooth/Wi-Fi, and service settings.

A Continuity feature failing does not automatically mean the Mac's main network connection is broken.

Force Quit belongs to application state

Force Quit can terminate an unresponsive application when normal close behavior fails.

It is not a repair for every slow Mac.

If the whole system is under memory pressure, killing one random app may hide the larger problem.

Terminal is powerful because it exposes more state

Terminal provides shell access and Unix-like tools.

That does not mean a terminal command is automatically better than a graphical tool.

Use the smallest surface that answers the question.

Commands can change permissions, files, network state, and system configuration, so risky work belongs in supplied or disposable environments here.

Antivirus and security tooling depend on the environment

macOS includes built-in security mechanisms, and organizations may also deploy approved antivirus or endpoint-protection products.

A+ expects antivirus awareness, not the assumption that every Mac either needs no protection or must run the same Windows product.

Support the actual security stack and policy in the environment.

Updates, patches, and Rapid Security Response

macOS support includes keeping the operating system and applications within supported update and lifecycle policy.

Apple has used Rapid Security Response mechanisms on supported releases to deliver selected security fixes outside larger OS updates.

Availability can change by release.

The durable habit is checking current Apple documentation and actual update state rather than memorizing one patch mechanism forever.

Worked case: approved app will not install

Evidence:

package: approved vendor .pkg
macOS version: supported
hardware: supported
current user: standard user
organization management: requires admin/MDM install

The problem is not application compatibility.

The installation requires authority the current user does not have.

Follow the approved administrator or MDM path, then verify the required application function.

Build a macOS support map

For supplied cases, record:

user symptom
macOS responsibility
best feature / tool
system-wide or user-specific scope
managed-policy concern
state-changing or data risk
evidence supported
next action
verification

Include .app, .dmg, .pkg, App Store or managed deployment, Finder, Dock, Mission Control, gestures, Disk Utility, Keychain, FileVault, Time Machine, Spotlight, Privacy & Security, iCloud, iMessage or FaceTime, Force Quit, Terminal, updates, and security tooling.

Before you move on

macOS support becomes easier when you stop asking:

What is the Windows equivalent?

Ask instead:

Which macOS layer owns this state, and what evidence surface shows it?

Next we do the same with Linux, where many of the system boundaries are exposed directly.