To use a keyboard shortcut, press and hold one or more modifier keys and then press the last key of the shortcut. For example, to use Command-C (copy), press and hold the Command key, then the C key, then release both keys. Mac menus and keyboards often use symbols for certain keys, including modifier keys:
Control–Option–Command–Power button. or Control–Option–Command–Media Eject: Quit all apps, then shut down your Mac. If any open documents have unsaved changes, you will be asked whether you want to save them. Control-Command-Q: Immediately lock your screen. Shift-Command-Q: Log out of your macOS user account. You will be asked to. On Mac OS X, though, things are more complicated because the use of framework builds makes it common to encounter multiple instances of even the same major version of Python. I suggest you first understand and be comfortable with how to manage framework installs on Mac OS X.
Mac OS X & macOS names. As you can see from the list above, with the exception of the first OS X beta, all versions of the Mac operating system from 2001 to 2012 were all named after big cats. MacOS Catalina (version 10.15) is the sixteenth major release of macOS, Apple Inc.' S desktop operating system for Macintosh computers. It is the successor to macOS Mojave and was announced at WWDC 2019 on June 3, 2019 and released to the public on October 7, 2019. Catalina is the first version of macOS to support only 64-bit applications and the first to include Activation Lock. On the Menu Bar, click the Apple menu then select System Preferences Click Security & Privacy. Click the Privacy tab. Click the Unlock icon in the bottom-left, then enter your Mac username and password.
On keyboards made for Windows PCs, use the Alt key instead of Option, and the Windows logo key instead of Command.
Some keys on some Apple keyboards have special symbols and functions, such as for display brightness , keyboard brightness , Mission Control, and more. If these functions aren't available on your keyboard, you might be able to reproduce some of them by creating your own keyboard shortcuts. To use these keys as F1, F2, F3, or other standard function keys, combine them with the Fn key.
Cut, copy, paste, and other common shortcuts
- Command-X: Cut the selected item and copy it to the Clipboard.
- Command-C: Copy the selected item to the Clipboard. This also works for files in the Finder.
- Command-V: Paste the contents of the Clipboard into the current document or app. This also works for files in the Finder.
- Command-Z: Undo the previous command. You can then press Shift-Command-Z to Redo, reversing the undo command. In some apps, you can undo and redo multiple commands.
- Command-A: Select All items.
- Command-F: Find items in a document or open a Find window.
- Command-G: Find Again: Find the next occurrence of the item previously found. To find the previous occurrence, press Shift-Command-G.
- Command-H: Hide the windows of the front app. To view the front app but hide all other apps, press Option-Command-H.
- Command-M: Minimize the front window to the Dock. To minimize all windows of the front app, press Option-Command-M.
- Command-O: Open the selected item, or open a dialog to select a file to open.
- Command-P: Print the current document.
- Command-S: Save the current document.
- Command-T: Open a new tab.
- Command-W: Close the front window. To close all windows of the app, press Option-Command-W.
- Option-Command-Esc: Force quit an app.
- Command–Space bar: Show or hide the Spotlight search field. To perform a Spotlight search from a Finder window, press Command–Option–Space bar. (If you use multiple input sources to type in different languages, these shortcuts change input sources instead of showing Spotlight. Learn how to change a conflicting keyboard shortcut.)
- Control–Command–Space bar: Show the Character Viewer, from which you can choose emoji and other symbols.
- Control-Command-F: Use the app in full screen, if supported by the app.
- Space bar: Use Quick Look to preview the selected item.
- Command-Tab: Switch to the next most recently used app among your open apps.
- Shift-Command-5: In macOS Mojave or later, take a screenshot or make a screen recording. Or use Shift-Command-3 or Shift-Command-4 for screenshots. Learn more about screenshots.
- Shift-Command-N: Create a new folder in the Finder.
- Command-Comma (,): Open preferences for the front app.
Sleep, log out, and shut down shortcuts
You might need to press and hold some of these shortcuts for slightly longer than other shortcuts. This helps you to avoid using them unintentionally.
- Power button: Press to turn on your Mac or wake it from sleep. Press and hold for 1.5 seconds to put your Mac to sleep.* Continue holding to force your Mac to turn off.
- Option–Command–Power button* or Option–Command–Media Eject : Put your Mac to sleep.
- Control–Shift–Power button* or Control–Shift–Media Eject : Put your displays to sleep.
- Control–Power button* or Control–Media Eject : Display a dialog asking whether you want to restart, sleep, or shut down.
- Control–Command–Power button:* Force your Mac to restart, without prompting to save any open and unsaved documents.
- Control–Command–Media Eject : Quit all apps, then restart your Mac. If any open documents have unsaved changes, you will be asked whether you want to save them.
- Control–Option–Command–Power button* or Control–Option–Command–Media Eject : Quit all apps, then shut down your Mac. If any open documents have unsaved changes, you will be asked whether you want to save them.
- Control-Command-Q: Immediately lock your screen.
- Shift-Command-Q: Log out of your macOS user account. You will be asked to confirm. To log out immediately without confirming, press Option-Shift-Command-Q.
* Does not apply to the Touch ID sensor.
Finder and system shortcuts
- Command-D: Duplicate the selected files.
- Command-E: Eject the selected disk or volume.
- Command-F: Start a Spotlight search in the Finder window.
- Command-I: Show the Get Info window for a selected file.
- Command-R: (1) When an alias is selected in the Finder: show the original file for the selected alias. (2) In some apps, such as Calendar or Safari, refresh or reload the page. (3) In Software Update preferences, check for software updates again.
- Shift-Command-C: Open the Computer window.
- Shift-Command-D: Open the desktop folder.
- Shift-Command-F: Open the Recents window, showing all of the files you viewed or changed recently.
- Shift-Command-G: Open a Go to Folder window.
- Shift-Command-H: Open the Home folder of the current macOS user account.
- Shift-Command-I: Open iCloud Drive.
- Shift-Command-K: Open the Network window.
- Option-Command-L: Open the Downloads folder.
- Shift-Command-N: Create a new folder.
- Shift-Command-O: Open the Documents folder.
- Shift-Command-P: Show or hide the Preview pane in Finder windows.
- Shift-Command-R: Open the AirDrop window.
- Shift-Command-T: Show or hide the tab bar in Finder windows.
- Control-Shift-Command-T: Add selected Finder item to the Dock (OS X Mavericks or later)
- Shift-Command-U: Open the Utilities folder.
- Option-Command-D: Show or hide the Dock.
- Control-Command-T: Add the selected item to the sidebar (OS X Mavericks or later).
- Option-Command-P: Hide or show the path bar in Finder windows.
- Option-Command-S: Hide or show the Sidebar in Finder windows.
- Command–Slash (/): Hide or show the status bar in Finder windows.
- Command-J: Show View Options.
- Command-K: Open the Connect to Server window.
- Control-Command-A: Make an alias of the selected item.
- Command-N: Open a new Finder window.
- Option-Command-N: Create a new Smart Folder.
- Command-T: Show or hide the tab bar when a single tab is open in the current Finder window.
- Option-Command-T: Show or hide the toolbar when a single tab is open in the current Finder window.
- Option-Command-V: Move the files in the Clipboard from their original location to the current location.
- Command-Y: Use Quick Look to preview the selected files.
- Option-Command-Y: View a Quick Look slideshow of the selected files.
- Command-1: View the items in the Finder window as icons.
- Command-2: View the items in a Finder window as a list.
- Command-3: View the items in a Finder window in columns.
- Command-4: View the items in a Finder window in a gallery.
- Command–Left Bracket ([): Go to the previous folder.
- Command–Right Bracket (]): Go to the next folder.
- Command–Up Arrow: Open the folder that contains the current folder.
- Command–Control–Up Arrow: Open the folder that contains the current folder in a new window.
- Command–Down Arrow: Open the selected item.
- Right Arrow: Open the selected folder. This works only when in list view.
- Left Arrow: Close the selected folder. This works only when in list view.
- Command-Delete: Move the selected item to the Trash.
- Shift-Command-Delete: Empty the Trash.
- Option-Shift-Command-Delete: Empty the Trash without confirmation dialog.
- Command–Brightness Down: Turn video mirroring on or off when your Mac is connected to more than one display.
- Option–Brightness Up: Open Displays preferences. This works with either Brightness key.
- Control–Brightness Up or Control–Brightness Down: Change the brightness of your external display, if supported by your display.
- Option–Shift–Brightness Up or Option–Shift–Brightness Down: Adjust the display brightness in smaller steps. Add the Control key to this shortcut to make the adjustment on your external display, if supported by your display.
- Option–Mission Control: Open Mission Control preferences.
- Command–Mission Control: Show the desktop.
- Control–Down Arrow: Show all windows of the front app.
- Option–Volume Up: Open Sound preferences. This works with any of the volume keys.
- Option–Shift–Volume Up or Option–Shift–Volume Down: Adjust the sound volume in smaller steps.
- Option–Keyboard Brightness Up: Open Keyboard preferences. This works with either Keyboard Brightness key.
- Option–Shift–Keyboard Brightness Up or Option–Shift–Keyboard Brightness Down: Adjust the keyboard brightness in smaller steps.
- Option key while double-clicking: Open the item in a separate window, then close the original window.
- Command key while double-clicking: Open a folder in a separate tab or window.
- Command key while dragging to another volume: Move the dragged item to the other volume, instead of copying it.
- Option key while dragging: Copy the dragged item. The pointer changes while you drag the item.
- Option-Command while dragging: Make an alias of the dragged item. The pointer changes while you drag the item.
- Option-click a disclosure triangle: Open all folders within the selected folder. This works only when in list view.
- Command-click a window title: See the folders that contain the current folder.
- Learn how to use Command or Shift to select multiple items in the Finder.
- Click the Go menu in the Finder menu bar to see shortcuts for opening many commonly used folders, such as Applications, Documents, Downloads, Utilities, and iCloud Drive.
Document shortcuts
The behavior of these shortcuts may vary with the app you're using.
- Command-B: Boldface the selected text, or turn boldfacing on or off.
- Command-I: Italicize the selected text, or turn italics on or off.
- Command-K: Add a web link.
- Command-U: Underline the selected text, or turn underlining on or off.
- Command-T: Show or hide the Fonts window.
- Command-D: Select the Desktop folder from within an Open dialog or Save dialog.
- Control-Command-D: Show or hide the definition of the selected word.
- Shift-Command-Colon (:): Display the Spelling and Grammar window.
- Command-Semicolon (;): Find misspelled words in the document.
- Option-Delete: Delete the word to the left of the insertion point.
- Control-H: Delete the character to the left of the insertion point. Or use Delete.
- Control-D: Delete the character to the right of the insertion point. Or use Fn-Delete.
- Fn-Delete: Forward delete on keyboards that don't have a Forward Delete key. Or use Control-D.
- Control-K: Delete the text between the insertion point and the end of the line or paragraph.
- Fn–Up Arrow: Page Up: Scroll up one page.
- Fn–Down Arrow: Page Down: Scroll down one page.
- Fn–Left Arrow: Home: Scroll to the beginning of a document.
- Fn–Right Arrow: End: Scroll to the end of a document.
- Command–Up Arrow: Move the insertion point to the beginning of the document.
- Command–Down Arrow: Move the insertion point to the end of the document.
- Command–Left Arrow: Move the insertion point to the beginning of the current line.
- Command–Right Arrow: Move the insertion point to the end of the current line.
- Option–Left Arrow: Move the insertion point to the beginning of the previous word.
- Option–Right Arrow: Move the insertion point to the end of the next word.
- Shift–Command–Up Arrow: Select the text between the insertion point and the beginning of the document.
- Shift–Command–Down Arrow: Select the text between the insertion point and the end of the document.
- Shift–Command–Left Arrow: Select the text between the insertion point and the beginning of the current line.
- Shift–Command–Right Arrow: Select the text between the insertion point and the end of the current line.
- Shift–Up Arrow: Extend text selection to the nearest character at the same horizontal location on the line above.
- Shift–Down Arrow: Extend text selection to the nearest character at the same horizontal location on the line below.
- Shift–Left Arrow: Extend text selection one character to the left.
- Shift–Right Arrow: Extend text selection one character to the right.
- Option–Shift–Up Arrow: Extend text selection to the beginning of the current paragraph, then to the beginning of the following paragraph if pressed again.
- Option–Shift–Down Arrow: Extend text selection to the end of the current paragraph, then to the end of the following paragraph if pressed again.
- Option–Shift–Left Arrow: Extend text selection to the beginning of the current word, then to the beginning of the following word if pressed again.
- Option–Shift–Right Arrow: Extend text selection to the end of the current word, then to the end of the following word if pressed again.
- Control-A: Move to the beginning of the line or paragraph.
- Control-E: Move to the end of a line or paragraph.
- Control-F: Move one character forward.
- Control-B: Move one character backward.
- Control-L: Center the cursor or selection in the visible area.
- Control-P: Move up one line.
- Control-N: Move down one line.
- Control-O: Insert a new line after the insertion point.
- Control-T: Swap the character behind the insertion point with the character in front of the insertion point.
- Command–Left Curly Bracket ({): Left align.
- Command–Right Curly Bracket (}): Right align.
- Shift–Command–Vertical bar ( ): Center align.
- Option-Command-F: Go to the search field.
- Option-Command-T: Show or hide a toolbar in the app.
- Option-Command-C: Copy Style: Copy the formatting settings of the selected item to the Clipboard.
- Option-Command-V: Paste Style: Apply the copied style to the selected item.
- Option-Shift-Command-V: Paste and Match Style: Apply the style of the surrounding content to the item pasted within that content.
- Option-Command-I: Show or hide the inspector window.
- Shift-Command-P: Page setup: Display a window for selecting document settings.
- Shift-Command-S: Display the Save As dialog, or duplicate the current document.
- Shift–Command–Minus sign (-): Decrease the size of the selected item.
- Shift–Command–Plus sign (+): Increase the size of the selected item. Command–Equal sign (=) performs the same function.
- Shift–Command–Question mark (?): Open the Help menu.
Other shortcuts
For more shortcuts, check the shortcut abbreviations shown in the menus of your apps. Every app can have its own shortcuts, and shortcuts that work in one app might not work in another.
- Apple Music shortcuts: Choose Help > Keyboard shortcuts from the menu bar in the Music app.
- Other shortcuts: Choose Apple menu > System Preferences, click Keyboard, then click Shortcuts.
Learn more
- Create your own shortcuts and resolve conflicts between shortcuts
- Change the behavior of the function keys or modifier keys
-->
Applies to:
Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.
Important
Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Requirements
Device control for macOS has the following prerequisites:
Microsoft Defender for Endpoint entitlement (can be trial)
Minimum OS version: macOS 10.15.4 or higher
Minimum product version: 101.24.59
Your device must be running with system extensions (this is the default on macOS 11 Big Sur).
You can check if your device is running on system extensions by running the following command and verify that it is printing endpoint_security_extension to the console:
Your device must be in Beta (previously called InsiderFast) Microsoft AutoUpdate update channel. For more information, see Deploy updates for Microsoft Defender for Endpoint on Mac.
You can check the update channel using the following command:
If the above command does not print either Beta or InsiderFast, execute the following command from the Terminal. The channel update takes effect next time the product starts (when the next product update is installed or when the device is rebooted).
Alternatively, if you are in a managed environment (JAMF or Intune), you can configure the update channel remotely. For more information, see Deploy updates for Microsoft Defender for Endpoint on Mac.
Device control policy
To configure device control for macOS, you must create a policy that describes the restrictions you want to put in place within your organization.
The device control policy is included in the configuration profile used to configure all other product settings. For more information, see Configuration profile structure.
Within the configuration profile, the device control policy is defined in the following section:
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | deviceControl |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
The device control policy can be used to:
Customize URL target for notifications raised by device control
When the device control policy that you have put in place is enforced on a device (for example, access to a removable media device is restricted), a notification is displayed to the user.
When end users click this notification, a web page is opened in the default browser. You can configure the URL that is opened when end users click the notification.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | navigationTarget |
| Data type | String |
| Comments | If not defined, the product uses a default URL pointing to a generic page explaining the action taken by the product. |
Allow or block removable devices
The removable media section of the device control policy is used to restrict access to removable media.
Note
The following types of removable media are currently supported and can be included in the policy: USB storage devices.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | removableMediaPolicy |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
This section of the policy is hierarchical, allowing for maximum flexibility and covering a wide range of use cases. At the top level are vendors, identified by a vendor ID. For each vendor, there are products, identified by a product ID. Finally, for each product there are serial numbers denoting specific devices.
For information on how to find the device identifiers, see Look up device identifiers.
The policy is evaluated from the most specific entry to the most general one. Meaning, when a device is plugged in, the product tries to find the most specific match in the policy for each removable media device and apply the permissions at that level. If there is no match, then the next best match is applied, all the way to the permission specified at the top level, which is the default when a device does not match any other entry in the policy.
Policy enforcement level
Under the removable media section, there is an option to set the enforcement level, which can take one of the following values:
audit - Under this enforcement level, if access to a device is restricted, a notification is displayed to the user, however the device can still be used. This enforcement level can be useful to evaluate the effectiveness of a policy.block - Under this enforcement level, the operations that the user can perform on the device are limited to what is defined in the policy. Furthermore, a notification is raised to the user.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | enforcementLevel |
| Data type | String |
| Possible values | audit (default) block |
Default permission level
At the top level of the removable media section, you can configure the default permission level for devices that do not match anything else in the policy.
This setting can be set to:
none - No operations can be performed on the device- A combination of the following values:
read - Read operations are permitted on the devicewrite - Write operations are permitted on the deviceexecute - Execute operations are permitted on the device
Note
If none is present in the permission level, any other permissions (read, write, or execute) will be ignored.
Note
The execute permission only refers to execution of Mach-O binaries. It does not include execution of scripts or other types of payloads.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | permission |
| Data type | Array of strings |
| Possible values | none read write execute |
Restrict removable media by vendor, product, and serial number
As described in Allow or block removable devices, removable media such as USB devices can be identified by the vendor ID, product ID, and serial number.
At the top level of the removable media policy, you can optionally define more granular restrictions at the vendor level.
The vendors dictionary contains one or more entries, with each entry being identified by the vendor ID.
:no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/19949347/Screen_Shot_2020_05_06_at_6.32.33_PM.png)
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | vendors |
| Data type | Dictionary (nested preference) |
For each vendor, you can specify the desired permission level for devices from that vendor.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | permission |
| Data type | Array of strings |
| Possible values | Same as Default permission level |
Furthermore, you can optionally specify the set of products belonging to that vendor for which more granular permissions are defined. The products dictionary contains one or more entries, with each entry being identified by the product ID.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | products |
| Data type | Dictionary (nested preference) |
For each product, you can specify the desired permission level for that product.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | permission |
| Data type | Array of strings |
| Possible values | Same as Default permission level |
Furthermore, you can specify an optional set of serial numbers for which more granular permissions are defined.
The serialNumbers dictionary contains one or more entries, with each entry being identified by the serial number.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | serialNumbers |
| Data type | Dictionary (nested preference) |
For each serial number, you can specify the desired permission level.
| Section | Value |
|---|
| Domain | com.microsoft.wdav |
| Key | permission |
| Data type | Array of strings |
| Possible values | Same as Default permission level |
Example device control policy
The following example shows how all of the above concepts can be combined into a device control policy. In the following example, note the hierarchical nature of the removable media policy.
We have included more examples of device control policies in the following documents:
Look up device identifiers
To find the vendor ID, product ID, and serial number of a USB device:
Out Of Control (aalya) Mac Os Update
Log into a Mac device.
Plug in the USB device for which you want to look up the identifiers.
In the top-level menu of macOS, select About This Mac.
Select System Report.
From the left column, select USB.
Under USB Device Tree, navigate to the USB device that you plugged in.
The vendor ID, product ID, and serial number are displayed. When adding the vendor ID and product ID to the removable media policy, you must only add the part after 0x. For example, in the below image, vendor ID is 1000 and product ID is 090c.
Discover USB devices in your organization
You can view mount, unmount, and volume change events originating from USB devices in Microsoft Defender for Endpoint advanced hunting. These events can be helpful to identify suspicious usage activity or perform internal investigations.
Device control policy deployment
The device control policy must be included next to the other product settings, as described in Set preferences for Microsoft Defender for Endpoint on macOS.
Mac Aaliyah Line
This profile can be deployed using the instructions listed in Configuration profile deployment.
Troubleshooting tips
After pushing the configuration profile through Intune or JAMF, you can check if it was successfully picked up by the product by running the following command from the Terminal:
This command will print to standard output the device control policy that the product is using. In case this prints Policy is empty, make sure that (a) the configuration profile has indeed been pushed to your device from the management console, and (b) it is a valid device control policy, as described in this document.
On a device where the policy has been delivered successfully and where there are one or more devices plugged in, you can run the following command to list all devices and the effective permissions applied to them.
Example of output:
In the above example, there is only one removable media device plugged in and it has read and execute permissions, according to the device control policy that was delivered to the device.
Related topics