Capstone: Setting Up and Securing a New Mac

The out-of-box setup assistant walks Elena through language, Wi-Fi, and her first Administrator account. Once the desktop appears, she spends a few minutes on the interface tour itself — the Dock, the Menu Bar following whichever app is active, Spotlight for launching her first few apps. Out of curiosity, she opens Terminal and runs uname -a, seeing "Darwin" reported directly — the same proof Chapter 1 walked through, now confirmed on her own machine rather than as an abstract claim.

Rather than working daily from the Administrator account created during setup, Elena creates a Standard account for herself and reserves the Admin account for actual administrative tasks — the same least-privilege habit Chapter 3 argued for. She sets up Touch ID, and the first time she installs something requiring elevation, she notices the authentication dialog demanding her actual password rather than a single consent click — exactly the stricter default Chapter 3 named.

Opening Terminal again, she confirms her shell with echo $SHELL — zsh, as expected since Catalina. She installs Homebrew from brew.sh, then runs brew --prefix to confirm the install path on her Apple Silicon machine is /opt/homebrew, not the /usr/local path an older tutorial she'd bookmarked assumed.

Through Homebrew, she installs a couple of command-line Formulas (git, wget) and one Cask, a design tool distributed outside the Mac App Store. Before trusting it with client files, she runs codesign -dv --verbose=4 and spctl -a -vv against it, confirming a valid Developer ID signature and a passed Gatekeeper assessment — turning Chapter 6's abstract three-tier trust model into an actual five-second check.

Curious how her storage is actually laid out, Elena runs diskutil apfs list and sees her Data and system volumes sharing one APFS container's free space, rather than sitting in fixed, separately-sized partitions — Chapter 7's container model, visible on her own drive.

In System Settings, she turns on FileVault, storing the recovery key with her Apple ID rather than only locally. From Terminal, csrutil status confirms System Integrity Protection is enabled — she never touches Recovery to disable it, since there's no reason to, but knowing where that door is (and how deliberately inconvenient it is to open) is itself part of Chapter 8's own point.

She connects an external drive for Time Machine. When the setup dialog offers to encrypt the backup disk, she nearly skips it to save a step — then remembers Chapter 9's own warning directly: an unencrypted backup would quietly undermine the FileVault protection she'd just turned on in Step 6. She enables backup encryption.

She joins her home Wi-Fi and saves it as a "Home" Location. To move a folder of old files from her previous Windows laptop, she briefly turns on File Sharing — over SMB, meaning the Windows machine sees it natively with no extra software — then turns it back off once the transfer finishes. She sets AirDrop to Contacts Only rather than leaving it on Everyone, a direct application of Chapter 10's own warning about forgetting to turn that setting back down.

Before calling the setup finished, Elena opens Activity Monitor to confirm nothing is unexpectedly consuming CPU or memory after a fresh install, and Console.app to skim for any early errors using log show --predicate 'eventMessage contains "error"' --last 1h. Everything's clean — a five-minute check using Chapter 11's own toolkit, confirming the setup actually succeeded rather than just assuming it did.