Enterprise macOS Administration Cheatsheet

App Path & Context:

/Applications/Utilities/Activity Monitor.app

macOS equivalent of Task Manager. Monitor CPU spikes, inspect memory pressure graphs, locate unresponsive PIDs, send force kill signals (`SIGKILL`), and audit process network sockets.

App Path & Context:

/Applications/Utilities/Console.app

Centralized log reader. Stream live unified system logs, filter events by subsystem, inspect application crash reports (`/Library/Logs/DiagnosticReports`), and review spin logs.

App Path & Context:

/Applications/Utilities/Disk Utility.app

Manages APFS containers, volume partitions, and external drives. Run **First Aid** (`fsck_apfs`) to scan and repair file system corruption or format external storage drives.

App Path & Context:

/Applications/Utilities/Keychain Access.app

Stores saved Wi-Fi passwords, app passwords, enterprise S/MIME certificates, and SSL keys. Used by admins to inspect trusted Root CAs and clear corrupt login keychains.

App Path & Context:

Apple Menu  → System Settings → General → About → System Report

Generates complete hardware/software asset reports: Serial number, Apple Silicon processor chip details, battery cycle count, installed kernel extensions, and network MAC addresses.

Command Syntax & Usage:

networksetup -listallhardwareports
networksetup -getwebproxy Wi-Fi
sudo networksetup -setdhcp Ethernet

Lists physical network interface ports and MAC addresses, inspects configured corporate proxies, and resets network interfaces to dynamic DHCP configuration.

Command Syntax & Usage:

dscl . -read /Users/username
sudo dscl . -create /Users/adminuser
sudo dscl . -passwd /Users/username newpass

`dscl` (Directory Service Command Line) directly manages local macOS user accounts, groups, home directories, and user passwords without a GUI.

Command Syntax & Usage:

softwareupdate -l
sudo softwareupdate -i -a --restart

`softwareupdate -l` lists all available macOS OS patches and security updates. `-i -a --restart` installs all updates and reboots if required.

Command Syntax & Usage:

spctl --status
spctl --assess --type execute /Applications/App.app
sudo spctl --master-disable

Manages Gatekeeper security rules. Verifies whether an application is signed and notarized by Apple before allowing execution.

Command Syntax & Usage:

chflags hidden ~/Documents/Private
chflags nohidden ~/Library
sudo chflags uchg file.conf

Modifies macOS special file flags. `uchg` sets a system immutable flag, locking a file so it cannot be edited or deleted even by root until `-uchg` is run.

Command Syntax & Usage:

brew update && brew upgrade
brew install --cask google-chrome
brew list

De facto package manager for macOS. Installs CLI tools and GUI applications (`--cask`) silently across IT enterprise environments.

Command Syntax & Usage:

profiles status -type enrollment
sudo profiles renew -type enrollment
profiles list

`profiles status` displays active MDM enrollment state and Apple Automated Device Enrollment (ADE / ABM) details. `renew` forces an immediate re-sync with MDM (Intune / Jamf).

Command Syntax & Usage:

fdesetup status
sudo fdesetup enable
sudo fdesetup changerecovery -personal

Manages FileVault 2 XTS-AES 256-bit volume encryption. Verifies status and rotates personal recovery keys for escrow to Intune / Jamf.

Command Syntax & Usage:

csrutil status

Inspects System Integrity Protection (SIP) security status. Prevents unauthorized modification of protected system files. Must be managed via macOS Recovery mode.

Command Syntax & Usage:

sudo systemsetup -setremotelogin on
sudo systemsetup -getsleep
sudo systemsetup -setnetworktimeserver time.apple.com

Configures system-level hardware preferences, enables SSH remote terminal login, and configures NTP network time servers.

Command Syntax & Usage:

mdutil -s /
sudo mdutil -E /
sudo mdutil -i off /

`mdutil -s` checks Spotlight status. `mdutil -E` erases and forces a complete rebuild of the Spotlight search index across the root volume to fix broken searches.

Command Syntax & Usage:

log stream --predicate 'process == "sudo"'
log show --predicate 'eventMessage contains "failed"' --last 1h

Queries the macOS Unified Logging system directly via CLI. Filters live log streams by process name, subsystem, or message keywords over defined timeframes.

Command Syntax & Usage:

tccutil reset Microphone
tccutil reset ScreenCapture com.microsoft.teams

Resets Transparency, Consent, and Control (TCC) privacy prompts for specific services (Microphone, Camera, Screen Recording) when applications experience access blocks.

Command Syntax & Usage:

defaults read com.apple.finder AppleShowAllFiles
defaults write com.apple.dock autohide -bool true && killall Dock

Reads, writes, and modifies system and application `.plist` preference files directly from the command line.

Command Syntax & Usage:

launchctl list | grep company
sudo launchctl load -w /Library/LaunchDaemons/com.agent.plist
sudo launchctl unload -w /Library/LaunchDaemons/com.agent.plist

Interface to `launchd` (macOS init process). Controls background system services (LaunchDaemons) and user-session services (LaunchAgents).