AE-C (NBRC) key terms

An account created and owned by an organization through Apple Business Manager rather than by the user, with role-based privileges and no ability to make personal purchases. It is used for device enrollment and shared services.

An account stored in the directory node of a single Mac, usable only on that machine. Credentials and home folder live on the local volume unless the account is bound to a network directory.

A directory account that caches its credentials and home folder locally so a user can log in when the network directory server is unreachable. Changes sync back when connectivity returns.

A macOS utility for configuring directory service connections, binding a Mac to an LDAP or Active Directory server, and editing search policies and authentication paths.

The process of joining a Mac to a network directory domain so the machine can authenticate directory users and resolve directory groups. It stores the server address and trust credentials in the system configuration.

A ticket-based network authentication protocol that lets a user prove identity once and access multiple services without resending a password. macOS uses it for single sign-on to directory resources.

A macOS attribute granted to a user who authenticates at login, authorizing that account to unlock FileVault and to create or modify other secure tokens. It is required for many administrative and cryptographic operations.

A cryptographic token escrowed to a management service or held on the Mac that automatically grants Secure Tokens to users at login. It removes the need for an administrator to manually issue tokens.

A configuration on a DHCP server that always assigns the same IP address to a specific hardware address. It gives a device a stable address without the manual work of static configuration.

The time window during which a client may use an address assigned by a DHCP server. When the lease expires the client must renew or request a new address.

An address configured manually on an interface rather than obtained automatically. Servers and printers typically use one so clients can reach them at a predictable location.

A value that identifies which portion of an IP address refers to the network and which portion refers to the host. It determines whether a destination is local or must be reached through a router.

The router address a device sends traffic to when the destination is outside its own subnet. Without a correct gateway, local traffic works but internet and remote access fail.

A service that translates host names into IP addresses. Misconfigured or unreachable DNS commonly causes name resolution failures even when raw connectivity is fine.

Apple's zero-configuration networking technology that advertises and discovers services such as printers and file shares on the local network using multicast DNS, requiring no manual server configuration.

A file or URL that supplies JavaScript logic telling a client which proxy to use for a given destination. It lets organizations route some traffic through a proxy while bypassing others.

A script served to clients that evaluates destination URLs and returns the appropriate proxy server. Administrators distribute it by URL so proxy rules can change without touching each device.

A set of entries attached to a file or folder specifying which users or groups may read, write, or execute it. ACLs supplement traditional POSIX permissions and allow finer, per-identity rules.

The classic Unix permission model of owner, group, and other read/write/execute bits. It is the baseline every file uses, and ACLs layer additional rules on top.

The behavior in which a folder passes permissions down to items created inside it. Correct inheritance prevents new files from being created with unintended access.

A directory attribute that restricts deletion so only a file's owner, the directory's owner, or root may remove it. It is commonly set on shared writable folders to protect each user's files.

A folder exported over the Server Message Block protocol for access by Windows and macOS clients. Effective access is the intersection of share-level settings and file system permissions.

The macOS service that publishes folders over SMB, AFP, or NFS. Administrators control which protocols are enabled, which users may connect, and which folders are exported.

Apple's driverless printing standard that lets devices discover and print to compatible printers over the network without installing vendor software. It relies on Bonjour for discovery.

The holding area where jobs wait to be sent to a printer. A stalled queue is a common cause of documents that appear to print but never reach the device.

The open-source printing system macOS uses to manage printers, queues, and job processing. Its web interface and command-line tools are useful for diagnosing stuck jobs.

A PostScript printer description that tells the system a printer's capabilities and options. Missing or incorrect PPDs cause wrong paper sizes or unavailable features.

macOS full-volume encryption that protects data at rest. It requires a recovery key or institutional key escrow, and unlocking it depends on Secure Tokens for user accounts.

A macOS security feature that checks whether downloaded apps are signed and notarized before allowing them to launch. Administrators can adjust its policy to control allowed software sources.

Apple's automated scan of signed software for malicious content, after which the app receives a ticket that Gatekeeper accepts. It lets users run trusted software without weakening security settings.

A macOS protection that prevents even root from modifying critical system files and directories. It limits what management tools and malware can change without disabling protection.

Attaching a cryptographic signature to software so its origin and integrity can be verified. Invalid signatures cause launch failures and are checked by Gatekeeper.

macOS storage for passwords, certificates, and keys, encrypted and unlocked with a login or keychain password. Items are scoped to a keychain and controlled by access settings.

The setting that determines whether a certificate is accepted as an anchor for validating other certificates. Trust settings are managed per user or system and can silently break authentication when wrong.

A configuration block delivered by a mobile device management service that sets policies, installs certificates, or configures services on a device. Payloads can be installed only on enrolled devices.

A signed file containing one or more payloads that configure a device's settings and restrictions. Profiles can be installed manually or pushed by a management service.

A web portal for organizations to manage device purchases, create Managed Apple Accounts, and assign devices to a management service. It is the source of automated device enrollment.

A process that assigns purchased devices to an organization's management service so they enroll automatically at setup. It prevents users from removing management during initial configuration.

Apple's program for purchasing apps and books in volume and distributing them to devices or users through a management service. It supports app assignment without sharing personal Apple Accounts.

The macOS log viewer that displays system, kernel, and application messages. Filtering by process or subsystem is a primary way to trace the cause of a failure.

A collected bundle of system logs exported for later analysis or support escalation. It preserves messages that would otherwise rotate out of the live log store.

A boot environment that provides Disk Utility, terminal access, and reinstallation tools without starting the normal system. It is used to repair volumes or reset passwords.

A minimal boot environment that starts the system to a root shell with most services disabled. It is used for low-level repair such as checking or repairing the startup volume.

The macOS tool for partitioning, erasing, and repairing disks and volumes. First Aid verifies and repairs file system structures that cause mount or boot failures.