Board Out Of Control Mac OS

Welcome to the Mac OS 2021 Desktops thread! Mac OS X Desktops are split into 4 threads over the course of a year to reduce clutter. 1Q - January through March. Tech and Science topics: phones, computers, gadgets, and the Internet, astronomy & earth science, climate & weather, environment & green living and much more. Ctrl+Alt+Delete is not a keyboard shortcut on macOS. Instead, ⌘ Command + ⌥ Option + Esc brings up the Force Quit panel. Control + ⌘ Command + Power restarts the computer. Choose Apple, System Preferences, Language & Text. Select the Input Sources pane and check the box next to Keyboard & Character Viewer. To use the onscreen keyboard, select the Keyboard & Character Viewer icon on the status menu and choose Show Keyboard Viewer.

  1. Mac Os Control Panel
  2. Mac Os Description

These key combinations apply only to Mac computers with an Intel processor, not Mac computers with Apple silicon.

To use any of these key combinations, press and hold the keys immediately after pressing the power button to turn on your Mac, or after your Mac begins to restart. Keep holding until the described behavior occurs.

  • Command (⌘)-R: Start up from the built-in macOS Recovery system. Or use Option-Command-R or Shift-Option-Command-R to start up from macOS Recovery over the Internet. macOS Recovery installs different versions of macOS, depending on the key combination you use while starting up. If your Mac is using a firmware password, you're prompted to enter the password.
  • Option (⌥) or Alt: Start up to Startup Manager, which allows you to choose other available startup disks or volumes. If your Mac is using a firmware password, you're prompted to enter the password.
  • Option-Command-P-R:Reset NVRAM or PRAM. If your Mac is using a firmware password, it ignores this key combination or starts up from macOS Recovery.
  • Shift (⇧): Start up in safe mode. Disabled when using a firmware password.
  • D: Start up to the Apple Diagnostics utility. Or use Option-Dto start up to this utility over the Internet. Disabled when using a firmware password.
  • N: Start up from a NetBoot server, if your Mac supports network startup volumes. To use the default boot image on the server, hold down Option-N instead. Disabled when using a firmware password.
  • Command-S: Start up in single-user mode. Disabled in macOS Mojave or later, or when using a firmware password.
  • T: Start up in target disk mode. Disabled when using a firmware password.
  • Command-V: Start up in verbose mode. Disabled when using a firmware password.
  • Eject (⏏) or F12 or mouse button or trackpad button: Eject removable media, such as an optical disc. Disabled when using a firmware password.

If a key combination doesn't work

If a key combination doesn't work at startup, one of these solutions might help:

  • Press and hold all keys in the combination together, not one at a time.
  • Shut down your Mac. Then press the power button to turn on your Mac. Then press and hold the keys as your Mac starts up.
  • Wait a few seconds before pressing the keys, to give your Mac more time to recognize the keyboard as it starts up. Some keyboards have a light that flashes briefly at startup, indicating that the keyboard is recognized and ready for use.
  • If you're using a wireless keyboard, plug it into your Mac, if possible. Or use your built-in keyboard or a wired keyboard. If you're using a keyboard made for a PC, such as a keyboard with a Windows logo, try a keyboard made for Mac.
  • If you're using Boot Camp to start up from Microsoft Windows, set Startup Disk preferences to start up from macOS instead. Then shut down or restart and try again.

Remember that some key combinations are disabled when your Mac is using a firmware password.

Learn more

Mac Os Control Panel

  • Keyboard shortcuts that you can use after your Mac has started up.
-->

Applies to:

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

Important

Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

Requirements

Device control for macOS has the following prerequisites:

  • Microsoft Defender for Endpoint entitlement (can be trial)

  • Minimum OS version: macOS 10.15.4 or higher

  • Minimum product version: 101.24.59

  • Your device must be running with system extensions (this is the default on macOS 11 Big Sur).

    You can check if your device is running on system extensions by running the following command and verify that it is printing endpoint_security_extension to the console:

  • Your device must be in Beta (previously called InsiderFast) Microsoft AutoUpdate update channel. For more information, see Deploy updates for Microsoft Defender for Endpoint on Mac.

    You can check the update channel using the following command:

    If the above command does not print either Beta or InsiderFast, execute the following command from the Terminal. The channel update takes effect next time the product starts (when the next product update is installed or when the device is rebooted).

    Alternatively, if you are in a managed environment (JAMF or Intune), you can configure the update channel remotely. For more information, see Deploy updates for Microsoft Defender for Endpoint on Mac.

Device control policy

To configure device control for macOS, you must create a policy that describes the restrictions you want to put in place within your organization.

Mac Os Description

The device control policy is included in the configuration profile used to configure all other product settings. For more information, see Configuration profile structure.

Within the configuration profile, the device control policy is defined in the following section:

SectionValue
Domaincom.microsoft.wdav
KeydeviceControl
Data typeDictionary (nested preference)
CommentsSee the following sections for a description of the dictionary contents.

The device control policy can be used to:

Customize URL target for notifications raised by device control

When the device control policy that you have put in place is enforced on a device (for example, access to a removable media device is restricted), a notification is displayed to the user.

When end users click this notification, a web page is opened in the default browser. You can configure the URL that is opened when end users click the notification.

SectionValue
Domaincom.microsoft.wdav
KeynavigationTarget
Data typeString
CommentsIf not defined, the product uses a default URL pointing to a generic page explaining the action taken by the product.

Allow or block removable devices

The removable media section of the device control policy is used to restrict access to removable media.

Note

The following types of removable media are currently supported and can be included in the policy: USB storage devices.

SectionValue
Domaincom.microsoft.wdav
KeyremovableMediaPolicy
Data typeDictionary (nested preference)
CommentsSee the following sections for a description of the dictionary contents.

This section of the policy is hierarchical, allowing for maximum flexibility and covering a wide range of use cases. At the top level are vendors, identified by a vendor ID. For each vendor, there are products, identified by a product ID. Finally, for each product there are serial numbers denoting specific devices.

For information on how to find the device identifiers, see Look up device identifiers.

The policy is evaluated from the most specific entry to the most general one. Meaning, when a device is plugged in, the product tries to find the most specific match in the policy for each removable media device and apply the permissions at that level. If there is no match, then the next best match is applied, all the way to the permission specified at the top level, which is the default when a device does not match any other entry in the policy.

Policy enforcement level

Under the removable media section, there is an option to set the enforcement level, which can take one of the following values:

  • audit - Under this enforcement level, if access to a device is restricted, a notification is displayed to the user, however the device can still be used. This enforcement level can be useful to evaluate the effectiveness of a policy.
  • block - Under this enforcement level, the operations that the user can perform on the device are limited to what is defined in the policy. Furthermore, a notification is raised to the user.
SectionValue
Domaincom.microsoft.wdav
KeyenforcementLevel
Data typeString
Possible valuesaudit (default)
block

Default permission level

At the top level of the removable media section, you can configure the default permission level for devices that do not match anything else in the policy.

This setting can be set to:

  • none - No operations can be performed on the device
  • A combination of the following values:
    • read - Read operations are permitted on the device
    • write - Write operations are permitted on the device
    • execute - Execute operations are permitted on the device

Note

If none is present in the permission level, any other permissions (read, write, or execute) will be ignored.

Note

The execute permission only refers to execution of Mach-O binaries. It does not include execution of scripts or other types of payloads.

SectionValue
Domaincom.microsoft.wdav
Keypermission
Data typeArray of strings
Possible valuesnone
read
write
execute

Restrict removable media by vendor, product, and serial number

As described in Allow or block removable devices, removable media such as USB devices can be identified by the vendor ID, product ID, and serial number.

At the top level of the removable media policy, you can optionally define more granular restrictions at the vendor level.

The vendors dictionary contains one or more entries, with each entry being identified by the vendor ID.

SectionValue
Domaincom.microsoft.wdav
Keyvendors
Data typeDictionary (nested preference)

For each vendor, you can specify the desired permission level for devices from that vendor.

SectionValue
Domaincom.microsoft.wdav
Keypermission
Data typeArray of strings
Possible valuesSame as Default permission level

Furthermore, you can optionally specify the set of products belonging to that vendor for which more granular permissions are defined. The products dictionary contains one or more entries, with each entry being identified by the product ID.

SectionValue
Domaincom.microsoft.wdav
Keyproducts
Data typeDictionary (nested preference)

For each product, you can specify the desired permission level for that product.

SectionValue
Domaincom.microsoft.wdav
Keypermission
Data typeArray of strings
Possible valuesSame as Default permission level

Furthermore, you can specify an optional set of serial numbers for which more granular permissions are defined.

The serialNumbers dictionary contains one or more entries, with each entry being identified by the serial number.

SectionValue
Domaincom.microsoft.wdav
KeyserialNumbers
Data typeDictionary (nested preference)

For each serial number, you can specify the desired permission level.

SectionValue
Domaincom.microsoft.wdav
Keypermission
Data typeArray of strings
Possible valuesSame as Default permission level

Example device control policy

Mac

The following example shows how all of the above concepts can be combined into a device control policy. In the following example, note the hierarchical nature of the removable media policy.

We have included more examples of device control policies in the following documents:

Look up device identifiers

To find the vendor ID, product ID, and serial number of a USB device:

  1. Log into a Mac device.

  2. Plug in the USB device for which you want to look up the identifiers.

  3. In the top-level menu of macOS, select About This Mac.

  4. Select System Report.

  5. From the left column, select USB.

  6. Under USB Device Tree, navigate to the USB device that you plugged in.

  7. The vendor ID, product ID, and serial number are displayed. When adding the vendor ID and product ID to the removable media policy, you must only add the part after 0x. For example, in the below image, vendor ID is 1000 and product ID is 090c.

Discover USB devices in your organization

You can view mount, unmount, and volume change events originating from USB devices in Microsoft Defender for Endpoint advanced hunting. These events can be helpful to identify suspicious usage activity or perform internal investigations.

Device control policy deployment

The device control policy must be included next to the other product settings, as described in Set preferences for Microsoft Defender for Endpoint on macOS.

This profile can be deployed using the instructions listed in Configuration profile deployment.

Troubleshooting tips

After pushing the configuration profile through Intune or JAMF, you can check if it was successfully picked up by the product by running the following command from the Terminal:

This command will print to standard output the device control policy that the product is using. In case this prints Policy is empty, make sure that (a) the configuration profile has indeed been pushed to your device from the management console, and (b) it is a valid device control policy, as described in this document.

On a device where the policy has been delivered successfully and where there are one or more devices plugged in, you can run the following command to list all devices and the effective permissions applied to them.

Board

Example of output:

In the above example, there is only one removable media device plugged in and it has read and execute permissions, according to the device control policy that was delivered to the device.

Related topics