This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.
A Mac is a computer with a profile, not a Linux host
macOS is administered with accounts, configuration profiles, and often an MDM your organisation already chose. A profile is a signed or trusted payload of settings. The mobileconfig generator on this site drafts a payload. It does not enrol a fleet. You still install it through the channel you already use, on one test Mac first.
The Terminal is a normal admin tool. The command explainer on this site decodes a line. It does not run it. Homebrew and other user-level package tools are a choice for a lab Mac and a problem for a managed Mac if people install two copies of everything. Prefer the managed path for a fleet. Write down when a lab Mac is allowed to differ.
FileVault encrypts the disk. It is a control you turn on with a recovery method you have tested, not a nuisance you disable so a script can read the disk. This guide does not describe how to get around it. If a Mac cannot boot, you use the recovery key process you already stored, or you reinstall and restore from backup.
A Mac that is also a server for the office is a decision, not a default. The fundamentals still apply: a purpose, separate admin accounts, and a backup. The rest of this desk's Linux distro guides are the wrong file format.
One test Mac, one profile, one setting
Pick a setting you can see, such as a login window banner or a screen lock, and put only that setting in a profile. Install it on the test Mac through your test method. Confirm the setting applied. Remove the profile and confirm the setting went away, if the payload allows removal in the lab. That removal is the rollback rehearsal.
Create an admin account for the person who will administer this Mac, not a shared local admin password taped under the keyboard. The password is not in the ticket. A second standard user is how you confirm the setting hit the user and not only the admin.
If FileVault is on, confirm you have the recovery method stored in the place your organisation uses, and do not put the recovery key in the ticket. If FileVault is off on a portable Mac that leaves the building, the decision to leave it off is written down, not assumed.
A Terminal command you needed goes through the explainer and then onto the Mac. A command that disables a security control to make a profile install is the wrong command.
A change you can finish
The fleet change is the same profile through MDM, after the test Mac, to a pilot group, then wider. You do not email a mobileconfig to everyone as the distribution method.
Rollback is to remove the profile from the pilot, which you have done on the test Mac.
- Name the one setting.
- Generate or write a profile that contains only that setting.
- Install it on the test Mac.
- Confirm it as a standard user.
- Remove it in the lab and confirm the rollback.
- Store any FileVault recovery material outside the ticket.
- Pilot through MDM before the rest of the fleet.
Mistakes that outlive the command
macOS administration fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.
- A shared local admin password.
- Emailing an unsigned profile to the whole company.
- Disabling FileVault to make a copy, with no plan to turn it back on.
- Putting a recovery key in the ticket or the chat.
- Two package managers and no owner for updates.
- Treating the Mac as a Linux server and following a distro guide.
- A profile with twenty settings when you have not seen one apply.
- A command that turns off a security tool so the profile will install.
Decisions to write down before the window
One decision for macOS administration: One setting in the test profile. More settings are a later profile. Distribution is your MDM or your tested method, not a mail blast. Admin accounts are individual. The password is not in the ticket. FileVault stays on for a portable Mac unless the exception is written. The recovery key is stored and not pasted into the ticket. The test Mac can roll the profile off. A pilot group exists before the fleet. Terminal commands were explained and do not disable a control. Backups exist for a Mac that holds the only copy of something. Linux distro steps were not used. And a second person saw the setting on the standard user.
macOS checks before the profile reaches the fleet
Confirm this before you call the change done: The profile contains the setting you named and little else. The test Mac shows the setting for a standard user. Removal worked in the lab. MDM or the approved channel is the distribution. No shared admin password is in use or in the ticket. FileVault state matches the decision. No recovery key is in the ticket. The command explainer's reading matches the command you ran. A pilot list exists and is not the whole company. Backup is true for any unique data on the test Mac. A second person saw the setting. Rollback is removal of the profile. The Mac's purpose is written if it is serving other people. The hostname in the prompt matches the hostname in the ticket for macOS administration. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for macOS administration happened, and the next host is not started early. If one of those fails, stop.
Tools for this guide
These tools run in the browser on this site. They do not log into your machines.
Related pillar guides
Guides in this cluster
These supporting pages belong to this pillar.