Security settings to turn on with a new MacBook

MacUpdated

On a new MacBook, the security settings to check on day one are Touch ID, a password after sleep, FileVault, Find My Mac, automatic updates and who has administrator rights. Setup Assistant offers some of them, such as Touch ID. This page is what to confirm on the first day.

Quick answer

In System Settings, add fingerprints in Touch ID & Password, set "Require password after screen saver begins or display is turned off" in Lock Screen, check Privacy & Security > FileVault, turn on Find My Mac under your name > iCloud, and set Automatic Updates in General > Software Update.

The full checklist for any Mac is in the best Mac security settings.

What does this page cover, and what does it leave out?

It covers what's different on a new Mac: the fingerprints, password, encryption, Find My and administrator account you start with. The step-by-step menus for Touch ID, the lock screen, FileVault, automatic updates, the firewall, Sharing and camera access are in the best Mac security settings, so each section here gives one line and a link.

Add your fingerprints to Touch ID

Setup Assistant offers Touch ID, but you can add or change fingerprints at any time in System Settings > Touch ID & Password. Apple says you can add up to three fingerprints to your user account, and save up to five on the Mac.

You also choose what Touch ID is for: unlocking the Mac, Apple Pay, the iTunes Store, App Store and Apple Books, autofilling passwords, and fast user switching. Your password still matters. Apple says you enter it when you start your Mac, every 48 hours, and after five incorrect fingerprint attempts.

Lock the Mac when you step away

In System Settings > Lock Screen, set "Require password after screen saver begins or display is turned off" to a short time, so a login password is needed when the Mac wakes. The steps, the display timings and the lock shortcuts are in how to lock your Mac screen.

One option worth setting on a new Mac: "Show message when locked". Apple says the message can provide contact information for a lost Mac.

Check FileVault

Apple says a Mac with Apple silicon or an Apple T2 Security Chip encrypts your data automatically. FileVault adds an extra layer by keeping someone from getting at that data without your login password. Check it in System Settings > Privacy & Security > FileVault.

Apple warns that if you forget your login password and can't reset it, and you also forget your recovery key, your files and settings will be lost forever. Keep any key somewhere other than with the Mac. Steps and the recovery choices are in what is FileVault on Mac.

Turn on Find My Mac

Apple says that when you add your Mac to Find My, Activation Lock is turned on automatically. With Activation Lock, your Apple Account password or device passcode is needed before anyone can turn off Find My, erase the Mac, or reactivate and use it.

Turn it on in System Settings > your name > iCloud > See All > Find My Mac, and click Allow when asked to let it use the Mac's location. Apple describes the Find My network as an encrypted, anonymous network of Apple devices that can help locate your device even when it's offline. More in Mac Activation Lock and does Find My Mac take a photo.

Turn on automatic updates

Turn on Automatic Updates in System Settings > General > Software Update. Apple words the security toggle two ways: its current Mac guide calls it "Install Security Responses and system files", and its background updates article names it "Install system data files and security updates" on macOS Tahoe 26 or later. Turn on whichever your Mac shows. The full steps are in the best Mac security settings.

On macOS Tahoe 26 or later, Apple also says to go to System Settings > Privacy & Security > Background Security Improvements and make sure Automatically Install is on. Apple notes that laptops must be plugged in to download updates automatically.

Decide who is an administrator

Apple says the person who first sets up the Mac is its administrator by default, and administrators can install and remove software and change settings. Its advice is that an administrator should create a standard user account for when administrator rights aren't needed, and limit the number of administrators if several people use the Mac. If others will use the new Mac, Apple suggests a separate account for each person, with each one required to log in.

Activation Lock uses your Apple Account, and Apple lists two-factor authentication among its requirements, so check two-factor authentication is on too.

Where Failshot fits

Every setting above starts with your password. Your password is the first layer. Failshot is the second: second layer device security for your Mac, and day one with a new Mac is the natural moment to add it.

While it's on, Failshot photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With the Mac's built-in camera, the green light comes on. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. The Touch ID you've just set up does a second job here: switching Failshot off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot runs on macOS 14 or later. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. The trial is on failshot.app, for the Mac. iPhone, Android and Windows are coming soon.

More questions

Is a new MacBook encrypted out of the box?

Apple says a Mac with Apple silicon or an Apple T2 Security Chip encrypts your data automatically. Turning on FileVault adds the need for your login password before anyone can get at that data. Check System Settings > Privacy & Security > FileVault.

Is Activation Lock on by default on a new Mac?

Apple says Activation Lock turns on automatically when you add your Mac to Find My, and stays on as long as Find My is on. So it depends on turning on Find My Mac, which you can do in setup or afterwards.

How many fingerprints can I add to Touch ID on a Mac?

Apple says up to three fingerprints per user account, and up to five fingerprints saved on the Mac. You still need your password at startup, every 48 hours and after five incorrect fingerprint attempts.

Should I use a standard account instead of an admin account?

Apple's advice is that an administrator should create a standard user account for use when administrator rights aren't needed. If a standard account's security is compromised, Apple says the potential harm is far more limited.

Do I need antivirus on a new Mac?

That's covered in does a Mac need antivirus. On day one, Apple's own background updates matter: it says Background Security Improvements and security-configuration updates install automatically by default.

Sources