Help, there’s a Mac on my network (6): the Mac that never shuts down

Episode 6 of the series Help, there’s a Mac on my network.

What happened

It started innocently enough. Marieke walked over to Ruud’s desk with her MacBook Air under her arm. “Teams is acting a bit odd. The audio stutters when I share my screen.”

Ruud put down his coffee. On the mug, as it had said for fifteen years, in large letters: “Have you tried turning it off and on again?”. He didn’t even need to speak. He just pointed at the mug.

“Turning it off?” said Marieke. “I never do that. I just close the lid. Then it works straight away the next morning.”

Ruud opened Terminal, something he could now do without sighing, and typed uptime. The answer: 47 days. He read it twice. Forty-seven days. In that same period his own laptop had restarted about twenty times, at least five of them at half past eight in the morning, right when he had a meeting.

“Forty-seven days,” he said. “A Windows laptop would develop a personality after that long.”

Sam, who was standing by the coffee machine, came over. “Can I just?” He clicked the Apple menu, opened System Settings and went to Software Update. “Look, there’s an update ready here. It’s been waiting two weeks for a restart. That’s your actual problem, not the 47 days.”

“So I do have to turn it off,” said Marieke.

“Restart it,” said Sam. “Once. After that you can go back to just closing the lid.”

Ruud looked at his mug. The mug looked back. For the first time in years he felt slightly misunderstood by his own crockery.

What’s really going on

As a Windows admin you have a healthy suspicion of long uptimes. Memory leaks, drivers that get stuck, Windows Update hanging halfway: a restart fixes a lot. That reflex isn’t wrong, but on a Mac with Apple silicon things work a little differently.

Sleep on a Mac is actual sleep

A MacBook with an M-series chip is built much like an iPhone. Lid closed means sleep: memory stays powered, almost everything else switches off, and power use is minimal. You never turn your iPhone off either, and it’s fine. While asleep the Mac can still do a few small jobs, like updating mail and iCloud, and it wakes instantly when you open the lid. By the way, you won’t find the old Power Nap setting on an Apple silicon Mac: it only exists on Intel Macs now. On Apple silicon that behaviour is simply built in.

So an uptime of several weeks is neither strange nor unhealthy on a Mac. macOS manages memory itself, compresses what isn’t actively used and keeps the system running smoothly.

But updates do need a restart

This is where the real risk is. A macOS update downloads quietly in the background and gets itself ready, but installing it needs a restart. A user who never restarts is running an old version with known vulnerabilities for weeks, while the fix is sitting right there. That’s exactly what was going on with Marieke’s Mac.

Apple does have something for small, urgent fixes. Since macOS Tahoe 26.1 these are called Background Security Improvements, the successor to the old Rapid Security Responses. They patch components like Safari and WebKit between the bigger updates, without needing a full macOS update, and are set to install automatically by default. You’ll find them in System Settings under Privacy & Security. But for regular updates, like 27.0.1 or 27.1, a restart is still required.

Enforcement goes through DDM

On Windows you handle this with update rings and deadlines in Intune. On the Mac the mechanism is declarative device management (DDM). You send the Mac a software update declaration: this version, by this date and time. The Mac handles the rest itself. It downloads the update, prepares it, shows the user notifications more and more often as the deadline approaches, and may even install early if it finds a quiet moment. Deadline reached and the user still hasn’t done anything? Then a short countdown appears and the Mac installs the update and restarts on its own. If the Mac is switched off at the deadline, the user gets one hour after powering on, then it happens anyway.

Apple has deprecated the old MDM software update policies and Microsoft advises against them too. For macOS 14 and newer, use DDM.

How to fix it

Enforcing updates in Intune

1. In the Intune admin center, go to Devices, Configuration, and create a new settings catalog policy for macOS.
2. Under Declarative Device Management, choose Software Update Enforce Latest if you always want the newest version. You set a number of days of delay and an install time, for example 12:30 over lunch.
3. If you want more control, use Software Update with a target version (Target OS Version) and a fixed deadline (Target Date Time). Handy for a phased rollout: IT first, then everyone else.
4. Also use Software Update Settings to decide whether users can defer updates, how long updates stay hidden, and whether Background Security Improvements install automatically.
5. Afterwards, don’t just check whether the policy says “succeeded”. Look at the macOS version of your devices in the update reports. A successful policy only means the Mac received it.

When a restart does help

Restarting isn’t a daily ritual on a Mac, but sometimes it really is the right answer. For example when:

• memory pressure in Activity Monitor stays yellow or red for a while;
• a process is stuck and doesn’t come back properly even after a force quit;
• Bluetooth, Wi-Fi or an external display misbehaves and toggling that feature off and on doesn’t help;
• there’s an update waiting.

Start with a single app. Press Option+Cmd+Esc for the Force Quit window, the Mac answer to Ctrl+Alt+Del. Pick the app that’s hanging and click Force Quit. If you want to dig deeper, open Activity Monitor (Applications, Utilities, or search with Cmd+Space). It’s Task Manager, but with a Memory tab that has a Memory Pressure graph at the bottom. Green is fine, even if memory looks “full”. Only yellow or red needs action.

And one tip for your users: when you choose Restart there’s a checkbox “Reopen windows when logging back in”. Everything comes back where it was afterwards. That saves a lot of grumbling.

Ruud’s lesson

Forty-seven days of uptime isn’t a problem. An update that has been waiting forty-seven days is. Ruud now sends the Macs a deadline and otherwise lets them sleep in peace. The mug is still on his desk. He just added a line underneath in marker: “…if there’s an update waiting.”

Read more: Apple Business, Entra ID and Intune for small businesses and a Mac in a Windows network.

This is episode 6 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.