Configure System Updates

Apple used to take the peculiar path of using the App Store to deliver system updates. For several releases, these have had their own, more sensible preference pane—which also, oddly enough, also has one preference related to the App Store.

To reduce complexity and confusion, Software Update is extremely stripped down, particularly compared to past versions. It also looks roughly the same from Catalina to Monterey. Even in Ventura, it’s only redesigned, not reinvented.

Software Update shows whether you’re up to date, and it notes if there are software updates available if you are not. If you’re a major system update behind (or further), it also shows an area at the top urging that installation a secondary area below, the pane may read “Another update is available” for Safari and security updates, and you have to click “More info” to discover which are and proceed to install them.

You can completely automate minor macOS, security, and other updates—in fact, that’s the default. (Major macOS updates require direct action.) However, in Monterey and earlier, you can click the Advanced button to see settings and make changes (Figure 1). In Ventura or later, click the info icon (Figure 2).

Here’s what macOS does without intervention:

• Check for updates: Whenever you open Software Update, it checks for new updates; it also checks in the background, and puts a red badge on System Preferences or System Settings indicating how many there are.

• Download new updates when available: This includes all the updates listed below. The advantage is that they are either installed automatically, or available for immediate installation if you install manually. Disable this if you’re bandwidth limited or pay for bandwidth, and want to plan downloads.

• Install macOS updates: This includes all “dot” updates, like moving from 13.0.0 to 13.0.1 and from 13.0.1 to 13.1.0.

• Install app updates from the App Store: Any app you purchased or acquired by the App Store is automatically updated. If disabled, launch the App Store as described below.

• Install system data files and security updates (Monterey and earlier): Apple has both standalone security updates, mentioned above, and certain data files that are used to block newly discovered malicious apps and for related security purposes. There’s really no reason to uncheck this.

• Install Security Responses and System files (Ventura): Apple has added Rapid Security Response updates in Ventura—exploit fixes that can be installed automatically and don’t require a reboot—and relabeled this entry to be more inclusive of them.

In most cases, you can view a list of available updates, deselect or select items in the list, select items to view their contents, and click Install Now to proceed towards installation. Updates that require restarting your Mac are noted with “Restart Required” after their title in the detail section, and you’re warned when you click Install Now that you will need to let the updater restart your Mac to complete it.

Configure App Store Updates

The App Store is where you buy apps and acquire free apps, including those with in-app purchases, that have gone through additional layers of vetting from Apple. Among certain advantages are that you don’t need to use the app or go to a website to find out if the latest version is installed.

The App Store has an Updates link in its navigation bar at left. Click that and you can see available updates and recently installed ones. You can also use App Store’s Preferences to control automatic updates (Figure 3): select or deselect Automatic Updates, and that modifies the same setting as in System Preferences > Software Update > Advanced (Monterey and earlier) or System Settings > General > Software Update > info icon (Ventura).

Update Other Apps

Software that didn’t come from the App Store must be updated separately. Fortunately, most apps include an automatic, configurable update check whenever you launch them, and also check for updates periodically. You can disable this in nearly all apps, though I recommend keeping the feature on, or enabling it if it’s turned off by default.

If you haven’t seen update notifications lately, or aren’t sure how your favorite apps have automatic updates configured, now is the time to check. Launch each app, select its option to check, and install updates.

I have found that some apps say they will post an alert about an update whenever one appears, and then do not. The Zoom app for macOS was particularly bad for over a year until the developers finally started to alert users properly to new versions.

General Security Preferences

The General tab in Monterey and earlier offers two distinct sections that are effectively unrelated. At the top, you can set a number of password preferences. In Ventura, these preferences have been relocated into Settings > Touch ID & Password and Lock Screen.

Control Which Apps Launch

Apple hides its powerful Gatekeeper technology behind a radio button selection. Gatekeeper prevents malicious software from easily taking root on a Mac, even on a naïve user’s computer (not you, to be sure). You can find the setting “Allows apps downloaded from” in System Preferences > Security & Privacy > General (Monterey or earlier) or System Settings > Privacy & Security (Ventura).

You have two options:

• App Store

• App Store and identified developers

I recommend the second option, unless you’re setting up a computer for someone who needs more handholding and protection. For a full explanation of how Gatekeeper works, see a couple chapters ahead in Apple Protects with Gatekeeper.

You can select a different option whenever you like, but it only affects apps launching after that point. Switch from “App Store and identified developers” to App Store, and you can still launch any third-party apps you had previously run, but macOS prevents new non-App Store apps from being validated.

Apple added a helpful prompt in Big Sur: if you have the launch option set to App Store and attempt to open a third-party app, macOS first tells you why it can’t launch (Figure 5).

However, if you then return to the “Allow apps downloaded from” location in your version of macOS, you see a helpful Open Anyway button (Figure 6). That’s a little informal, but makes sense: you made this choice, so why not?

Manage System Extensions

If you’re a long-time Mac user like me, you remember “system extensions” from System 7 or Mac OS 9 or the like: these were files you put into a special folder that would get invoked at launch to modify basic system behavior, sometimes at a very low level.

Well, we may be 20 to 35 years past that earlier generation of Mac software, but they’re back, baby! For most of the lifetime of OS X and macOS, Apple let developers add low-level functions through kernel extensions, which have a lot of privileges and can cause huge problems if handled wrong. But some software, particularly anti-malware apps and drivers for input devices like Wacom graphics tablets, had no choice but to patch in at that low level.

In their ongoing battle of limiting user exposure to malicious or disruptive anything, Apple told developers in 2019 they would eventually not allow kernel extensions, replacing them with system extensions, which run with substantially fewer privileges, but actually give developers a lot more carefully controlled capabilities.

Apple mediates access to “legacy” kernel extensions and new system extensions through the General tab in Security & Privacy (Monterey and earlier) or System Settings > Privacy & Security in Ventura.

For instance, I have a Wacom tablet, and the way it used to capture input required a kernel-level shunt to route data to its drivers. When I installed the software back in Mojave, a message appeared in the Finder that explained “System Extension Blocked” with an OK button. macOS told me to go to System Preferences > Security & Privacy (while running Monterey).

On the General tab a note appeared that said, “System software from developer ‘Wacom’ was blocked from loading.” An Allow button let me install it. (This message disappears after 30 minutes if you take no action, and you have to run the installer again.) Some extensions require a restart and you’re given a button for that as in Figure 6.

However, once approved, if the extensions have trouble loading or need new permission—which can happen if you upgrade macOS—a Details button appears near the message (Figure 7). Click it and you can find extensions available to add (Figure 8).

Some extensions require a restart. If you select any box and click OK and a restart is required, macOS won’t let you exit System Preferences (Monterey and earlier) or System Settings (Ventura) without initiating a restart.

Automatic Login Option

When you set up a new Mac, one of the first things you are prompted to do is create a user account for yourself by picking a username and a password. (Your Mac can have many such accounts, but it must have at least one.) By default, macOS logs in that initial user account automatically when you turn on or restart your Mac. That means you can get right to work without entering a password, and it’s the most convenient arrangement for Macs with a single user—especially if the Mac is kept in a secure place.

However, if anyone else (including a thief!) can get to your Mac, that automatic login becomes a problem, because your Keychain unlocks automatically (see Keychain Security, next) and all the files on your Mac are readily available.

If there’s a risk of someone gaining access to your Mac, you should disable this option by selecting Off. It’s found in Monterey and earlier in System Preferences > Users & Groups > Login Options as the “Automatic login” menu, or in Ventura at System Settings > Users & Groups as a popup menu next to “Automatically log in as.”

Launch Items

Many apps have startup activities you can manage. This includes launching an app when you log in and components of apps launching to run in the background continuously. From a security perspective, you should know what’s launching and occasionally check to see whether anything new has appeared that you’re unaware of.

Login Items

Apps can add themselves to a list of items that open when you log in to your account. You can also add items manually. This Login Items list is unique to the current user logged in.

In Monterey and earlier, Apple located it with user settings in System Preferences > Users & Groups > Your User Entry > Login Items (Figure 9). In Ventura, it’s a bit more logically located in System Settings > General > Login Items (Figure 10).

Starting in Ventura, Apple steps up on the disclosure and security front. macOS alerts you when an app adds itself or a component to the Login Items list (Figure 11).

You can take several actions on the items in this list:

• Hide (Monterey and earlier): Check the app’s box in the Hide column so its windows hide themselves after launch.

• Remove: Select one or more apps and click the minus icon to remove them. There’s no prompt—it just happens.

• Add: Click the plus icon and then select one or more apps, documents, or network servers to open or mount at launch.

If you want to prevent all login items from launching, you can do so temporarily in one of two ways:

• At a login screen, hold down the Shift key when clicking the login icon. Keep holding down shift until you see the Dock appear.

• Restart your Mac. Hold down the Shift key when the progress bar starts and release after you see the desktop appear.

Allow in the Background

Starting in Ventura, macOS also gives you insight and control over components of apps that are set to run in the background. First, you’re alerted when app installs them (Figure 12).

Then, you can find a list of these items in System Settings > General > Login Items under the Allow in the Background heading (Figure 13).

While you can’t remove them via this interface, you can enable and disable them. When you disable background items, you’re prompted to authenticate with Touch ID or your password.

Items that are installed without the full information required by Apple are shown with an info icon. Click it, and it opens the component in the system or user Library folder it lives in.

Keychain Security

Your Mac’s Keychain contains passwords for lots of different things that need to be both available on demand and secured against unwanted access. This includes passwords to log in to apps and Wi-Fi networks, passkeys for websites at which you’ve enrolled to use them, credentials for local network servers, encryption certificates, and other important information your Mac needs to function securely.

If you use iCloud Keychain and use the Safari browser, Keychain also contains credentials for websites where you have accounts, and may have your credit card details, too, separate from stored Apple Pay credit card information on Macs with Touch ID or an M-series Mac paired with a Magic Keyboard with Touch ID.

Because this information is valuable and potentially sensitive, macOS encrypts the contents of your Keychain. However, whenever your Keychain is unlocked, your credentials can be passed to apps, websites, and network services without any intervention on your part.

And how do you unlock your Keychain? That’s the crazy part: all you have to do is log in to your Mac’s user account. And—as we saw in Automatic Login Option—another default setting is to log you in to your account automatically.

In other words, unless you take steps to change the defaults, merely turning on your Mac might unlock your Keychain!

Anyone else who might have physical access to your Mac could then log in to all the web accounts (like your bank, Amazon, or PayPal), file servers, and other resources for which you’ve saved credentials (like Music or the App Store).

There are a few bright spots:

• No one can see the actual Keychain entry’s secure text without knowing your macOS account login password.

• Within Safari, an unwanted party can’t get a list of all the sites at which you have passwords stored from Safari, Keychain, or System Preferences/System Settings > Passwords (in Monterey or Ventura) without your password.

• Even when a password is autofilled in Safari or in an app, there’s typically no way to copy the password to view it as text.

• Macs with active Touch ID hardware and password autofill enabled will drop your password in only if you use a valid fingerprint or enter your password (System Preferences > Touch ID > Password AutoFill in Monterey and earlier or System Settings > Touch ID & Password > “Use Touch ID for autofilling passwords” in Ventura).

Yet the storm cloud lingers: someone can use all your passwords when the conditions above aren’t true. These actions will help prevent that:

• Turn on FileVault: Because FileVault is a high-value way to prevent power-up access to your computer, many people should turn it on; see FileVault Protection. However, some people may find it more trouble than the potential of losing access to their files in certain cases; see Decide on Using FileVault.

• Turn off automatic login, if you don’t have FileVault enabled: I explain just above, in Automatic Login Option, how to disable automatic login.

• Enable Touch ID and AutoFill: This blocks access to autofilled passwords without your fingerprint or password.

• Lock your Mac after a duration: As noted in Adjust Password Preferences.

Set Up a Standard Account for Others

A standard account has permission mostly to affect files and applications installed within the Home > Username folder. It’s the right kind of account to set up for people using a Mac who aren’t sophisticated users, don’t need system-level access or the ability to install apps for all users, or shouldn’t be given the same level of trust on a shared computer as its owner or administrator.

If your main account is currently an administrator account but you want to make it a standard account, you can create a new administrator account (for occasional use only) and then remove the administrative privileges from your main account. To do so, start with these steps in Monterey or earlier:

1. Go to System Preferences > Users & Groups.

2. Unlock the pane with your current administrator password.

3. Click the plus icon to add a new account.

Start with these steps in Ventura:

1. Go to System Settings > Users & Groups.

2. Click the Add Account button.

3. Enter your password if prompted.

Now in all versions of macOS:

1. Choose Administrator from the New Account pop-up menu.

2. Fill in the fields for Full Name and Account Name (that is, a short username, such as your initials).

3. Create a strong password and enter it in the Password and Verify fields; optionally enter a password hint.

4. Click Create User. If you had automatic login enabled, an alert appears, asking if you want to keep it on or turn it off. Click Turn Off Automatic Login. (This won’t appear with FileVault enabled.)

5. Choose Apple  > Log Out Username to log out of your old administrator account.

6. Select or enter the name of the new administrator account you just created, enter its password, and click the arrow button or press Return.

   At this point, you may be prompted to enter the Apple ID for the new account. Since this administrator account will be for occasional use only, I suggest selecting the Don’t Sign In radio button, clicking Continue, and then confirming by clicking Skip again. If it turns out you need iCloud services with your new administrator account, you can always set them up later.

7. Once again, go to System Preferences > Users & Groups (Monterey and earlier) or System Settings > Users & Groups (Ventura).

8. Next, either:

   • In Monterey or earlier, click the lock icon, and authenticate, this time with your new administrator credentials. In the list on the left, select your old administrator account.

   • In Ventura, click the info icon next to the old administrator account, then use the credentials for your new administrator account to authenticate (Figure 15).

   

9. Deselect or disable “Allow user to administer this computer”; this turns your erstwhile administrator account into a standard account. An alert appears, claiming that you must restart for the changes to take effect. That’s not entirely true (you need only log out), but click OK anyway.

10. Choose Apple  > Log Out username to log out of your new administrator account.

11. Select or enter the name of your old (previously administrator, now standard) account, enter your password, and click Log In.

Having done all this, you’ll find that almost everything about using your Mac is exactly as it was before. But there’s one exception: when a dialog prompts you for an administrator’s credentials, you won’t enter the username and password for your everyday account but instead enter the credentials for your new administrator account.

Set Up a Guest User Account

As long as you’re making changes in Users & Groups, you should think about whether you want to have a guest user account. It’s enabled by default starting way back in Yosemite. That’s usually a good idea, but if it doesn’t suit your needs, you can disable it.

With a guest user account enabled, you have a spare—and, importantly, non-administrator—account that anyone can log in to without a password. When logged in, they can run apps installed for all users, browse the web, or perform any other task that doesn’t require saving private information to disk permanently. (Guest users can, however, save data to publicly shared locations.)

As soon as the guest logs out, macOS deletes the guest’s temporary home folder, leaving everything just as it was beforehand. If you ever need to give someone temporary access to your computer, using the guest account is simpler than having to set up and later delete a conventional account for that person, and more secure than letting them use your account.

To turn guest access on or off in Monterey or earlier:

1. Go to System Preferences > Users & Groups.

2. Enter your administrator password if prompted.

3. Select Guest User in the list on the left. Then select or deselect “Allow guests to log in to this computer.”

To turn guest access on or off in Ventura:

1. Go to System Settings > Users & Groups.

2. Click the info icon to the right of the Guest User entry.

3. Enter your administrator password if prompted.

4. Enable or disable “Allow guests to log in to this computer.”

With guest access enabled in any version of macOS, you can optionally select either or both of the following checkboxes in the Guest User settings:

• Limit Adult Websites: Apple used to offer more expansive limitations, but now just blacklists risqué-and-beyond sites.

• Allow guest users to connect to shared folders: This doesn’t affect the way someone logged in as a guest can access shared folders on this Mac, as you might expect. Rather, when selected, people on other devices on the network can connect to this Mac’s shared folders without supplying a username and password.

Make Sure Regular Users Have Accounts

If you’re the only person who uses your Mac, you can skip this topic. But if you share your Mac with family members, coworkers, or friends, do yourself—and them—a favor and create a separate (standard) account for each person. And then, insist that everyone log in to their user-specific accounts when using the Mac. That way, any damage (accidentally deleted files, changed preferences, and so on) will be restricted to that user’s space and not affect the entire Mac.

To enable switching from one user to another without having to log out (and thus quit all your apps):

• In Monterey or earlier: Go to System Preferences > Users & Groups > Login Options and select “Show fast user switching menu As,” choosing from the pop-up menu Full Name, Account Name, or Icon. A menu appears on the system menu bar.

• In Ventura: Go to System Settings > Users & Groups > Control Center. In the Fast User Switching section, choose Don’t Show, Full Name, Account Name or Icon from the Show in Menu Bar pop-up menu. You can also opt to have an icon appear in Control Center by enabling that option.

To switch users, choose the name of the user you want to log in as from that menu, which appears near the right side of your menu bar, and enter that user’s password. With the Control Center option turned on in Ventura, you can click the account icon to reveal the same menu.

That menu (and Control Center item) also lets you drop into the Login Window screen by selecting that item.