Certopolis

CompTIA A+ Core 2

macOS Recovery, Gatekeeper and app installs for A+ Core 2

macOS Recovery reinstalls macOS without removing apps or personal data, and the startup method decides which version you get. Gatekeeper decides whether apps from outside the App Store may open. Apps from the internet are removed with their Uninstaller or by dragging them to the Trash, while apps macOS needs, such as Mail, cannot be removed.

Which macOS Recovery installs

Reinstalling macOS from Recovery does not remove apps or personal data, though Apple still advises a backup first.

On a Mac with Apple silicon, Recovery installs the current version of the most recently installed macOS.

On any other Mac, the key combination matters. Command-R starts the local Recovery system and reinstalls the current version of the most recently installed macOS. Option-Command-R starts Internet Recovery and might install the latest macOS compatible with the Mac. Shift-Option-Command-R starts Internet Recovery and might install the macOS that came with the Mac, or the closest version still available.

Worked example: a user's accounting app supports only the macOS already installed on an Intel Mac. Use Command-R, because Option-Command-R could move the Mac to a newer version.

Installing from Recovery needs a broadband connection using DHCP over Wi-Fi or Ethernet. A network that needs a captive-portal login, 802.1X or PPPoE (unless a router handles PPPoE) can stop the install.

Starting from a bootable installer

A bootable installer is a USB flash drive made with the createinstallmedia command. It is not needed for a normal upgrade or reinstall, but helps when those fail or when installing on several Macs.

On a Mac with Apple silicon, shut down, connect the drive, then press and hold the power button until startup options show the bootable volumes.

On any other Mac, turn it on and immediately hold the Option (Alt) key. On a Mac with the Apple T2 Security Chip that will not start from the drive, set Startup Security Utility to allow booting from external or removable media.

Gatekeeper and where apps come from

Apple calls the App Store the safest source. Apple reviews each app and signs it so it cannot be tampered with, and can remove a problem app from the store quickly.

For software from outside the App Store, macOS checks the Developer ID signature and, from macOS Catalina on, requires notarization by default. It also asks for approval the first time a downloaded app opens.

In System Settings > Privacy & Security, Allow apps downloaded from offers App Store only, or App Store and identified developers. If it is set to App Store only, macOS will not open an app from a developer's website. Change it to App Store and identified developers, or use Open Anyway for one trusted app.

Removing apps

For an app from the internet or a disc, open Applications in Finder. If the app sits in a folder, open the folder and run its Uninstaller if there is one. Otherwise, drag the app to the Trash. It is removed when the Trash is emptied.

Apps required by the Mac cannot be removed. This includes many apps installed by macOS, such as Mail, Music, Books, Notes, Maps and News.

Where the exam catches people

  • Believing Internet Recovery reinstalls the same macOS version: Option-Command-R might install the latest compatible macOS; local Recovery with Command-R keeps the current one.
  • Believing reinstalling macOS from Recovery erases the user's apps and files: Apple says it does not remove apps or personal data.
  • Believing Option starts every Mac from a bootable installer: Macs with Apple silicon use press and hold the power button.
  • Believing a T2 Mac that ignores the installer needs a new installer: Startup Security Utility must allow booting from external media.
  • Believing every built-in app can be deleted to free space: apps the Mac requires, such as Mail, cannot be removed.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A technician must reinstall macOS on a Mac without Apple silicon. The user's accounting app supports only the macOS version already installed, so the reinstall must not move the Mac to a newer macOS. Which of the following should the technician do?

    Right. In the game that’s Renown for your Operating Systems building.

    Not that one: B is right. In the game your Operating Systems building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Apple documents that Internet Recovery might instead install the latest macOS compatible with the Mac.

    Written from support.apple.com/en-us/102655

  2. A technician creates a macOS bootable installer on a USB flash drive and connects it to an Intel-based Mac with the Apple T2 Security Chip. Holding Option at startup, the technician cannot start the Mac from the installer. Which of the following should the technician do?

    Right. In the game that’s Renown for your Operating Systems building.

    Not that one: C is right. In the game your Operating Systems building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    By default a T2 Mac blocks starting from external media.

    Written from support.apple.com/en-us/101578

  3. A user downloads a trusted design tool from the maker's website onto a company Mac. macOS refuses to open it, saying it was not downloaded from the App Store. Which of the following should the technician do?

    Right. In the game that’s Renown for your Operating Systems building.

    Not that one: C is right. In the game your Operating Systems building would lose a little Renown, and this question would come back later.

    Written from support.apple.com/en-us/102445