AE-C (NBRC) cheat sheet

Local accounts live in the local directory node /Local/Default; network accounts resolve through an Active Directory or Open Directory node bound in Directory Utility or via dsconfigad.

dscl . -list /Users and dscl . -read /Users/shortname enumerate local records; dscl /Local/Default -read /Users/x AuthenticationAuthority shows the stored auth mechanism.

A UID of 501 is the first locally created user on macOS; system accounts occupy UIDs below 500, and duplicate UIDs cause permission collisions on shared files.

sysadminctl -addUser, -deleteUser, and -resetPassword operate on local accounts and are the supported replacement for editing user plists by hand.

Mobile (cached) accounts appear when a bound Mac authenticates a network user; the local home cache is created under /Users and the account persists if the network is unreachable.

dsconfigad -show reports the bound AD domain, computer account, and options such as -mobile and -ou; dsconfigad -remove unbinds and should precede rebinding after a domain change.

Password policy for local accounts is set with pwpolicy (legacy) or enforced via configuration profiles; AD password policy is enforced by the domain controller, not the Mac.

Secure token and FileVault: an account must hold a secure token to unlock a FileVault volume or approve kernel extensions; the first account created at setup holds one by default.

id -a username and dscl . -read /Users/x UniqueID, PrimaryGroupID, and NFSHomeDirectory are the fastest checks for UID/GID and home path mismatches.

networksetup -listallnetworkservices, -getinfo , and -setmanual script IPv4 changes; -setdnsservers and -setsearchdomains set resolver state.

Service order determines the default route preference: networksetup -listnetworkserviceorder prints the ranking, and -ordernetworkservices rewrites it.

Locations group interface configurations; scutil --location lists them and networksetup -switchtolocation applies one, useful for moving between static lab and DHCP office networks.

A self-assigned 169.254.x.x address means DHCP failed; check the interface is active, the DHCP server scope, and whether the service is first in order.

scutil --dns shows the resolver configuration actually in effect, including per-domain split DNS and scoped resolvers that override the global server list.

802.1X authentication is configured per network service; the profile or networksetup -set8021x... settings determine whether the supplicant uses EAP-TLS (certificate) or PEAP (credentials).

AirPort/Wi-Fi diagnostics: wireless diagnostics captures a Wi-Fi log; the preferred network list order is what determines automatic association.

ipconfig getpacket en0 displays the DHCP lease contents (server identifier, lease time, options), which distinguishes a bad lease from a link failure.

Proxies and PAC URLs are per-service; networksetup -getwebproxy and -setwebproxy report and change them, and stale PAC settings commonly break only browser traffic.

POSIX mode bits: read=4, write=2, execute=1 for owner, group, other; chmod 750 gives owner rwx, group r-x, others nothing.

ls -le shows ACLs alongside mode bits; chmod +a adds an ACE, chmod -N strips all ACLs, and ACLs are evaluated after POSIX bits and can only add permission.

The three permission layers on a shared item are POSIX mode, ACL, and the sharing protocol's own layer (SMB share permissions or AFP/NFS export settings); the most restrictive applicable layer wins.

SMB sharing is enabled per share point in Sharing preferences; the share point ACL and the SMB share permissions both apply, and guest access depends on the sharing account settings.

NFS exports are defined in /etc/exports with client, option pairs such as -maproot and -network; the export must also be enabled with nfsd enable.

Sticky bit on a directory (chmod +t, shown as t in the last position) prevents users deleting files they do not own inside a shared folder.

Inheritance: an ACL entry with the directory-inherit and file-inherit flags propagates to new items; chmod +a "group:staff allow read,file_inherit,directory_inherit" sets it.

AFP is deprecated in current macOS; plan migrations to SMB, and note SMB signing and dialect negotiation affect throughput and compatibility with older clients.

Disk Utility "Repair Permissions" no longer exists in recent macOS; use Disk Utility First Aid for volume structure and reset home ACLs with chmod -R or resetpassword for user-level issues.

CUPS is the print subsystem: lpstat -p lists queues, lpstat -o lists jobs, cancel -a clears a queue, and lpadmin -p -E -v -m adds a queue.

The web interface at http://localhost:631 exposes CUPS administration; cupsctl controls whether it is reachable and whether remote administration is allowed.

Driverless (AirPrint/IPP Everywhere) queues use the ipp:// or dnssd:// URI and need no vendor PPD; prefer them for current printers and fall back to a vendor PPD only when features are missing.

Printers are shared via System Settings > Printers & Scanners > Share this printer, which advertises the queue over Bonjour; clients add it as a Bonjour queue.

A print job stuck in "paused" usually means the queue is stopped: cupsenable restarts it, and cupsaccept re-enables job acceptance.

Bluetooth peripherals pair per user session; removing the device from Bluetooth settings and re-pairing clears stale link keys, and some input devices need re-pairing after an OS upgrade.

Kernel extensions for older peripherals require reduced security and user approval in Privacy & Security; on Apple silicon, third-party kexts need explicit consent after restart.

Scanner access goes through Image Capture or ICA; a scanner missing from the list but present on the network can be added by IP with the same lpadmin/bonjour discovery path.

Keychain types: login (unlocked at login), System (system-wide, unlocked at boot), and System Roots (trusted anchors, read-only); security list-keychains shows search order.

security find-certificate -a -c "name" -Z searches certificates and prints SHA-1 hashes; security verify-cert -c file.pem checks a certificate against current trust settings.

Trust settings are per-user or system-wide and edited in Keychain Access > certificate > Trust; a certificate trusted for SSL but not for code signing still fails notarization checks.

Gatekeeper assessment: spctl --assess --type execute reports whether an app is allowed; spctl --master-disable is not a supported fix and weakens the machine.

FileVault 2 encrypts the volume with XTS-AES-128; recovery keys are institutional, personal, or iCloud escrowed, and a lost key with no escrow means data loss.

SIP protects /System, /usr, and /bin; csrutil status reports it, and disabling it requires booting to Recovery. It is independent of FileVault and Gatekeeper.

XProtect and notarization: notarized apps carry a stapled ticket checked offline; an app that fails to launch on a machine with no network is often unnotarized and unstapled.

Secure enclave-backed keys and Touch ID: the login keychain can be unlocked by biometrics only when the account has a secure token and the keychain password matches the login password.

Firewall (socketfilterfw) is application-based; socketfilterfw --getglobalstate reports it, and stealth mode blocks unsolicited probes but does not filter outbound traffic.

Apple silicon and T2 Macs boot only from signed, sealed system volumes; legacy block-level imaging is replaced by DFU restore (Apple Configurator) plus MDM enrollment.

Startup Security Utility (Recovery) sets security policy: Full Security requires a signed OS and prevents booting an external or older unsigned system; Permissive allows it.

MDM enrollment requires user approval on modern macOS (Device Enrollment or profile installation); the MDM payload can then push profiles, install apps, and issue Bootstrap tokens.

A configuration profile is a signed plist (.mobileconfig) applied via MDM, Profiles preferences, or profiles install; profiles command lists, installs, and removes them.

Automated Device Enrollment (ADE) assigns devices to an MDM at purchase or via Apple Configurator; Supervision enables restricted commands such as erase and non-removable profiles.

Volume ownership: on Apple silicon every bootable volume needs its own set of local users with secure tokens; a second macOS install does not share accounts with the first.

softwareupdate --list and --install with --all --restart drive OS updates; MDM can defer or force updates, and major upgrades may need a full installer rather than a delta.

Package deployment: installer -pkg file.pkg -target / runs a flat package; pkgutil --expand and --payload inspect contents, and receipts are queried with pkgutil --pkgs.

Startup disk selection: bless --mount /Volumes/X --setBoot sets the next boot volume; NVRAM boot-args and Startup Disk settings are the classic alternatives.

Logs: log show --predicate 'process == "x"' --last 1h queries the unified log; log stream follows live. Console.app is the GUI over the same data.

Safe mode loads only Apple-signed kernel extensions, clears font and system caches, and is entered by holding Shift at boot on Intel; on Apple silicon, hold the power button to reach startup options.

Verbose boot (Command-V on Intel) shows kernel messages; single-user mode (Command-S) is unavailable on Apple silicon and T2 Macs with FileVault.

Disk Utility First Aid verifies and repairs volume structure; for APFS containers it repairs the container and each volume, and snapshots may need thinning with diskutil apfs deleteSnapshot.

NVRAM reset (Option-Command-P-R) applies to Intel Macs; Apple silicon has no NVRAM reset command and instead uses DFU revive/restore.

SMC reset (Shift-Control-Option + power on Intel) addresses power and fan symptoms; Apple silicon has no SMC to reset, so the equivalent is a full shutdown or DFU revive.

Network diagnostics: ping, traceroute, dig, and scutil --dns isolate name resolution from routing; nc -z host port tests TCP reachability.

Activity Monitor's sample and spindump (sample 10 -file out.txt) capture a stuck process; sysdiagnose collects logs, spindumps, and system state into a single archive.

Recovery (Command-R Intel; power button on Apple silicon) provides Disk Utility, Terminal, reinstall, and restore-from-Time Machine without booting the installed OS.