macOS essentials: Settings, Finder, accounts

A user on a new Mac asks three things in the first five minutes of a call: where the printer settings went, why there is no Library folder in their home folder, and whether their own Apple Account can hold work files. Each has a precise answer, because macOS keeps every setting in one app with its own search field, the system on a sealed volume that nothing can change, and each app’s own files in a Library folder that Finder hides.

You will find a setting, an app and a path in seconds, read the two volumes a Mac runs from, open an app’s caches and settings in a practice home folder, tell a personal Apple Account from a Managed Apple Account, and pick the right kind of local account for each person on a Mac.

System Settings, Spotlight and one Terminal command answer the first questions

Most first questions on a Mac call are “where is it?”. Apple’s answer for settings is one app, System SettingsSystem Settings: The macOS app that holds the Mac's system options, opened from the Apple menu, with its options grouped in a sidebar and a search field that lists the settings matching a word. Older guides call it System Preferences., opened from the Apple menu, with its options grouped in a sidebar. Its search field is the quickest route: type a word such as “printer” and the settings that match are listed under the field. An app’s own settings are elsewhere, in the app’s menu in the menu bar, under Settings. Older guides, and CompTIA’s A+ Core 2 objectives, still call the system app System Preferences, so a ticket that quotes that name means the same place.

Apps and files are found with SpotlightSpotlight: The macOS search opened with Command-Space bar. It finds apps, files and other items by name as you type, and Return opens the top result.: press Command-Space bar, start typing, and press Return for the top result. Paths have their own shortcut in Finder, and the exact version of macOS comes from Terminal:

The session below read those facts on the Mac used for this lesson, without changing anything:

from session import run

# The first facts for a ticket on a Mac, read without changing anything: the exact version and build, where the
# settings and password apps live on this version of macOS, and which of the standard groups the signed-in account
# belongs to (admin means an administrator account).
run(
    """
sw_vers
ls -d "/System/Applications/System Settings.app" /System/Applications/Passwords.app
!ls -d "/System/Applications/Utilities/Keychain Access.app"
ls -d "/System/Library/CoreServices/Applications/Keychain Access.app"
id -Gn | tr " " "\\n" | grep -x -E "admin|staff|everyone"
"""
)

$ sw_vers
ProductName:		macOS
ProductVersion:		26.7.1
BuildVersion:		25G241
$ ls -d "/System/Applications/System Settings.app" /System/Applications/Passwords.app
/System/Applications/Passwords.app
/System/Applications/System Settings.app
$ ls -d "/System/Applications/Utilities/Keychain Access.app"
ls: /System/Applications/Utilities/Keychain Access.app: No such file or directory
[exit status 1]
$ ls -d "/System/Library/CoreServices/Applications/Keychain Access.app"
/System/Library/CoreServices/Applications/Keychain Access.app
$ id -Gn | tr " " "\n" | grep -x -E "admin|staff|everyone"
staff
everyone
admin

The Mac runs macOS 26.7.1, build 25G241, and the build is the number that belongs in the ticket, because Apple’s release notes and security pages quote builds. System Settings and Passwords sit in /System/Applications. Keychain Access, which older guides send you to in Utilities, is not there on this version: the session found it in /System/Library/CoreServices/Applications. That is why Spotlight beats a remembered path. The last line lists the groups of the account that ran the session; the last section explains why admin in that list matters.

Two volumes: a sealed system and a writable data volume

A user asks why they cannot drag a font into /System/Library, and a script from an old forum fails with “read-only file system”. Both run into the same design. Since macOS 10.15 the system has lived on its own read-only volume, and since macOS 11 that volume is a signed system volumesigned system volume: The read-only volume a current Mac starts from. Every file on it has a SHA-256 hash in a tree whose top hash, the seal, is checked against Apple's signature when macOS installs or updates and when an Apple silicon Mac starts.: every file has a SHA-256 hash, and the hash of the whole tree, which Apple calls the seal, is checked against Apple’s signature when macOS installs or updates, and by the bootloader of an Apple silicon Mac before the kernel starts. Everything that changes, from users’ files to the apps they install, lives on a second volume. Step through the two:

The session reads the same facts from the Mac itself:

from session import run

# Two volumes, read from the Mac itself: the system volume the Mac starts from, mounted read-only and sealed, and the
# data volume beside it, which holds the users, their files and the apps they install.
run(
    """
diskutil info / | grep -E "Volume Name|Mount Point|File System Personality|Volume Read-Only|Sealed"
csrutil authenticated-root status
diskutil info /System/Volumes/Data | grep -E "Volume Name|Mount Point|Volume Read-Only|Sealed"
ls -d /System /System/Applications /Library /Users /Applications
"""
)

$ diskutil info / | grep -E "Volume Name|Mount Point|File System Personality|Volume Read-Only|Sealed"
   Volume Name:               Macintosh HD
   Mount Point:               /
   File System Personality:   APFS
   Volume Read-Only:          Yes (read-only mount flag set)
   Sealed:                    Yes
$ csrutil authenticated-root status
Authenticated Root status: enabled
$ diskutil info /System/Volumes/Data | grep -E "Volume Name|Mount Point|Volume Read-Only|Sealed"
   Volume Name:               Data
   Mount Point:               /System/Volumes/Data
   Volume Read-Only:          No
   Sealed:                    No
$ ls -d /System /System/Applications /Library /Users /Applications
/Applications
/Library
/System
/System/Applications
/Users

/ is Macintosh HD, mounted read-only and sealed, and Authenticated Root is enabled. The data volume is mounted at /System/Volumes/Data and is neither read-only nor sealed, which is where /Users, /Applications and /Library keep their contents. Apple’s file-system guide adds one more rule: /System/Library is reserved for Apple, and /Library holds what apps share between all the users of a Mac.

For support work the design has two consequences. A damaged system file is fixed by a macOS update or a reinstall, which the install lesson covers, never by editing /System. And the protection that keeps even administrators out of those folders, System Integrity Protection, is read in the macOS security lesson.

An app’s settings and caches live in a Library folder Finder hides

The user from the opening is right that their Library folder seems to be missing: Apple’s file-system guide says the user Libraryuser Library: The Library folder in a person's home folder, ~/Library, where apps keep that person's caches, preference files and support files. Finder hides it; holding Option in the Go menu, or Go to Folder, opens it. has been hidden since macOS 10.7. It is still there, at ~/Library. In Finder, hold Option and open the Go menu, and Library appears in it; or use Go to Folder and type ~/Library/. Terminal lists it with a plain ls, because the hidden flag only hides an item from the graphical interface.

Inside, an app’s files are named after its bundle IDbundle ID: The reverse-DNS name, such as com.example.notes, that identifies one app throughout macOS. It uses only letters, digits, hyphens and periods, and an app's caches, preferences file and support folder are named after it., the reverse-DNS name that Apple’s documentation says identifies one app throughout the system, written with letters, digits, hyphens and periods, such as com.example.notes. Apple’s guide gives each of three folders its own job:

• Caches/<bundle ID> holds data the app can rebuild: Apple says an app does not require its cache data to work properly, and the system may delete Caches to make room on the disk.
• Preferences/<bundle ID>.plist holds the app’s settings, written through Apple’s preferences interface rather than by hand.
• Application Support/<bundle ID or company> holds files the app needs in order to run, often the user’s data.

The session builds a home folder in that layout for an example app and reads it:

from session import run

MIB = 1024 * 1024

# A home folder laid out the way macOS lays one out, for an example app whose bundle ID is com.example.notes. The
# commands only read: the hidden Library folder, the app's three places in it, its settings file and two sizes.
PREFS = """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>AutosaveMinutes</key>
	<integer>10</integer>
	<key>ShowSidebar</key>
	<true/>
	<key>SyncFolder</key>
	<string>Documents/Notes</string>
</dict>
</plist>
"""

run(
    """
ls
ls -a
ls -lgoOd Library Documents
ls Library
ls Library/Preferences
plutil -p Library/Preferences/com.example.notes.plist
du -sh Library/Caches/com.example.notes "Library/Application Support/com.example.notes"
""",
    files={
        "Library/Preferences/com.example.notes.plist": PREFS,
        "Library/Preferences/com.apple.finder.plist": "<plist version=\"1.0\"><dict/></plist>\n",
        "Documents/Notes/team-meeting.txt": "Agenda: printer move, new joiner laptops\n",
        ".zshrc": "# shell settings for this account\n",
    },
    blobs={
        "Library/Caches/com.example.notes/thumbnails.db": 18 * MIB,
        "Library/Caches/com.example.notes/web/page-cache.bin": 6 * MIB,
        "Library/Application Support/com.example.notes/notes.sqlite": 3 * MIB,
    },
    dirs=["Desktop", "Downloads", "Library/Logs"],
    hidden=["Library"],
)

$ ls
Desktop
Documents
Downloads
Library
$ ls -a
.
..
.zshrc
Desktop
Documents
Downloads
Library
$ ls -lgoOd Library Documents
drwxr-xr-x@ 3   -       96 Sep  1 09:00 Documents
drwxr-xr-x@ 6   hidden 192 Sep  1 09:00 Library
$ ls Library
Application Support
Caches
Logs
Preferences
$ ls Library/Preferences
com.apple.finder.plist
com.example.notes.plist
$ plutil -p Library/Preferences/com.example.notes.plist
{
  "AutosaveMinutes" => 10
  "ShowSidebar" => true
  "SyncFolder" => "Documents/Notes"
}
$ du -sh Library/Caches/com.example.notes "Library/Application Support/com.example.notes"
 24M	Library/Caches/com.example.notes
3.0M	Library/Application Support/com.example.notes

ls -lgoOd shows the hidden flag on Library, the flag Finder reads, while plain ls still lists the folder. plutil -p prints the preferences file as keys and values, such as AutosaveMinutes => 10. And du -sh makes the difference between the folders concrete: the caches hold 24M, the support folder 3.0M, and the support folder is the one with the notes in it.

A Library also exists at the top of the disk. /Library serves every user of the Mac, and an app installed for all users keeps its shared files there, while ~/Library is one person’s. The data storage converter turns sizes such as 24M into the units a user’s storage screen shows.

Apple Account, Managed Apple Account and where passwords live

The third question from the opening, whether a personal Apple Account can hold work files, has two layers. An Apple AccountApple Account: A person's own sign-in for iCloud, the App Store and Apple's other services. Apple advises against sharing it, so a technician guides the user through signing in rather than taking the password. is the person’s own sign-in for iCloud, the App Store and Apple’s other services, and Apple’s support pages say it should not be shared with others. So a technician never asks for that password or types it for a user; a user who has forgotten it resets it through Apple’s own recovery, which starts from a trusted device or a trusted phone number.

Organisations that want work data under their own control give staff a Managed Apple AccountManaged Apple Account: An Apple Account that an organisation designs, owns and manages for its staff, separate from their personal accounts, created by hand or synchronised from the organisation's identity provider. instead. Apple’s deployment guide describes these as owned and managed by the organisation, separate from personal accounts, and created by hand or synchronised from Google Workspace, Microsoft Entra ID or another identity provider. Apple Business Manager, where a business creates them, is now called Apple Business.

The table’s last row is the support answer: on a company Mac, work files belong in what the organisation provides, not in a personal iCloud Drive. A user signs in to either kind of account from the Apple Account item at the top of System Settings, typing the password themselves.

Passwords have their own app now. The Passwords appPasswords app: The macOS app that shows a user's passwords, passkeys and verification codes in one place. Keychain Access remains for managing certificates. shows a user’s passwords, passkeys and verification codes in one place, and Keychain Access remains for certificates, the ones macOS uses to check the identity of websites and servers. Neither is something to open on a user’s behalf without them watching.

Three kinds of local account decide what a person may change

Every Mac also has local accounts, set in Users & Groups in System Settings. Apple names three types a person can be given. An administrator can add and manage other users, install apps and change settings, and the first account made when a Mac is set up is one; Apple warns never to set an administrator to log in automatically. A standard user can install apps and change their own settings, but cannot add users or change other users’ settings. A Sharing Only user reaches shared files over the network and cannot log in at the Mac at all.

Organisations add a fourth. A device management service can create a managed administrator account while a Mac is enrolled through Automated Device Enrollment, hide it from Users & Groups and change its password remotely, so the IT team keeps a way in without sharing a password. The session’s last line showed admin among the groups of the account that ran it, which is how id -Gn marks an administrator. Answer two questions about a person to choose:

In short: daily work on a company Mac fits a standard account, the IT team’s own access a managed administrator account where device management exists, and file sharing alone a Sharing Only user. Windows draws the same line between standard users and administrators, as the Windows accounts lesson shows.

Practise: name an app’s three places

A ticket about an app that misbehaves usually needs its folders before anything else. Write the function that turns a bundle ID into the app’s caches folder, preferences file and support folder, for one user or for the whole Mac, and make it refuse a name that cannot be a bundle ID. The self-check after it covers all five sections.

def library_paths(bundle_id, scope="user"):
    """Return the caches folder, preferences file and support folder of an app, as a dict of three paths."""
    return {"caches": "", "preferences": "", "support": ""}

from library_paths import library_paths


def raises_value_error(*args):
    try:
        library_paths(*args)
    except ValueError:
        return True
    return False


def test_user_paths_for_the_lesson_app():
    assert library_paths("com.example.notes") == {
        "caches": "~/Library/Caches/com.example.notes",
        "preferences": "~/Library/Preferences/com.example.notes.plist",
        "support": "~/Library/Application Support/com.example.notes",
    }


def test_computer_scope_uses_the_shared_library():
    assert library_paths("com.example.notes", "computer") == {
        "caches": "/Library/Caches/com.example.notes",
        "preferences": "/Library/Preferences/com.example.notes.plist",
        "support": "/Library/Application Support/com.example.notes",
    }


def test_hyphens_and_digits_are_allowed():
    paths = library_paths("org.example.backup-agent2")
    assert paths["preferences"] == "~/Library/Preferences/org.example.backup-agent2.plist"


def test_one_part_is_refused():
    assert raises_value_error("notes")


def test_empty_parts_are_refused():
    assert raises_value_error("com..notes")
    assert raises_value_error(".com.notes")
    assert raises_value_error("com.notes.")


def test_other_characters_are_refused():
    assert raises_value_error("com.example.my notes")
    assert raises_value_error("com.example.notes_app")


def test_unknown_scope_is_refused():
    assert raises_value_error("com.example.notes", "system")

Interview questions

Warm-up (fresher): where does a Mac app keep one person’s settings, caches and support files, and why can they not see them in Finder?

In that person’s Library folder, ~/Library, in three places named after the app’s bundle ID, such as com.example.notes: Caches for data the app can rebuild, Preferences for its settings file, a .plist named after the bundle ID, and Application Support for files the app needs to run, which often include the person’s own data. Finder does not show the folder because macOS has hidden the user Library since 10.7, to keep people away from files they rarely need. It is still there: hold Option and open Finder’s Go menu, or use Go to Folder with ~/Library/, and Terminal lists it with ls. Before touching anything, quit the app; caches can be cleared, but Application Support is backed up first.

Two harder calls come next: moving a new joiner from a personal Apple Account to a Managed Apple Account, and a standard user who asks for the administrator password to install an app. Settle what you would say in the first ten seconds of each, then check it against the first step on its page:

Key takeaways

• System Settings’ search field finds a setting by name, Spotlight finds apps and files with Command-Space bar, and sw_vers gives the version and build a ticket needs.
• macOS runs from a sealed, read-only system volume and keeps everything that changes on a writable data volume, so fixes go into /Library or a user’s Library, never into /System.
• An app’s files are named after its bundle ID: caches it can rebuild, a preferences .plist, and an Application Support folder that often holds the user’s data.
• A personal Apple Account is never shared, not even with the help desk, and a Managed Apple Account is owned by the organisation, which decides what it can reach.
• Administrator, standard and Sharing Only accounts give different rights, and a managed administrator account lets IT keep its own access without sharing a password.