MacOS locations for programs that start on boot – Daemons and Launchctl
By Vince
MacOS has a few locations that start programs up on boot (called agents and daemons in macOS). If your Mac seems slower, this might be a cause, a bunch of background services running for programs you don’t use often enough. There are also programs that install themselves everywhere and just deleting the application will not remove them. We will walk through all the directories that an application can hide in.
If you want more control on when programs install something on boot, install a program called BlockBlock. It will alert when a program is inserting something into the startup process and let you block it. There are so many programs that run boot agents that don’t need to.
The first place to check is: System Preferences > Users & Groups. Here is a list of the programs that start up for me.
Access this menu:
- Open System Preferences (from the apple icon)
- Click Users & Groups
- Click your name on the left
- Click the Login items tab
- Check which startup programs you want to remove
- Click the “–” sign and repeat for each item
- Close the window when you’re done
If you need to add an item back, press “+” and choose the app you’d like add, most likely anything you remove won’t effect the application.
To see this in action you have to reboot your Mac.
Advanced Level - Remove daemons and agents from the startup process
Many programs use a Daemon or Agent to start on boot. There are two methods, first using the program “launchctl” and second removing the actual daemon files. First we will walk through where all the directories are and then the two methods to remove processes.
Quick note beforehand, DO NOT DELETE anything with com.apple.X, these are systems processes and essential. You will break your mac and need to do a system restore, don’t blame me!
The directories are:
- /Library/StartUpItems
- /Library/LaunchDaemons
- /Library/LaunchAgents
- /Users/YOURUSERNAME/Library/LaunchAgents (alternate method is to use the ~, so ~/Library/LaunchAgents)
- /System/Library/LaunchDaemons (not recommended to touch)
- /System/Library/LaunchAgents (not recommended to touch)
- /Library/PrivilegedHelperTools (these are programs that can access data as a privileged user)
The best way to work on these is to open a command prompt and run the commands since the GUI will hide these directories:
cd /Library/StartUpItems
ls -al
#
# This is empty on my system
#
#############################################################
#
#
cd /Library/LaunchDaemons
ls -al
#
# This is the typical place for startup applications on boot
# Only remove things you know don't need to run all the time
# Below on my system, you can see I am using
# Little Snitch, Adobe, TunnelBlick, and Virtual Box.
# Since I don't really use TunnelBlick, I am going to remove it and reboot
#
-rw-r--r-- 1 root wheel 631 Feb 6 17:39 at.obdev.littlesnitchd.plist
-rw-r--r-- 1 root wheel 479 Feb 12 21:30 com.adobe.adobeupdatedaemon.plist
-rw-r--r-- 1 root wheel 642 Mar 7 18:13 com.adobe.agsservice.plist
-rw-r--r-- 1 root wheel 876 Feb 3 16:08 net.tunnelblick.tunnelblick.tunnelblickd.plist
lrwxr-xr-x 1 root wheel 76 Feb 1 17:14 org.virtualbox.startup.plist -> ../Application Support/VirtualBox/LaunchDaemons/org.virtualbox.startup.plist
#
#
#############################################################
#
#
cd /Library/LaunchAgents
ls -al
#
# This is where you user installed system processes will run on boot (before login)
# Things like Little Snitch, Adobe, Google Updater, and Mouse drivers
# These run when the user logs in instead of on boot
#
-rw-r--r-- 1 root wheel 464 Feb 6 17:39 at.obdev.LittleSnitchUIAgent.plist
-rw-r--r-- 1 root wheel 612 Mar 7 18:16 com.adobe.AAM.Updater-1.0.plist
-rw-r--r-- 1 root wheel 667 Feb 12 21:30 com.adobe.AdobeCreativeCloud.plist
-rw-r--r--@ 1 root wheel 792 Mar 1 20:21 com.google.keystone.agent.plist
-rw-r--r-- 1 root wheel 691 Jan 17 10:20 com.logitech.manager.daemon.plist
#
#
#############################################################
#
#
cd /Users/username/Library/LaunchAgents
ls -al
#
# These are user specific programs/agents ran on launch
#
-rw-r--r-- 1 vincenttocco staff 697 Feb 13 06:39 com.adobe.AAM.Updater-1.0.plist
-rw-r--r-- 1 vincenttocco staff 448 Jan 15 12:32 com.amazon.music.plist
-rw-r--r-- 1 vincenttocco staff 692 Mar 24 13:16 com.dropbox.DropboxMacUpdate.agent.plist
-rw-r--r-- 1 root staff 497 Mar 15 10:36 com.objectiveSee.blockblock.plist
-rw-r--r-- 1 vincenttocco staff 520 Jan 15 12:46 com.pia.pia_manager.plist
-rw-r--r--@ 1 vincenttocco staff 588 Jan 30 08:41 net.tunnelblick.tunnelblick.LaunchAtLogin.plist
-rw-r--r--@ 1 vincenttocco staff 677 Feb 1 17:15 org.virtualbox.vboxwebsrv.plist
#
#
#############################################################
#
#
cd /System/Library/LaunchDaemons
ls -al
#
# System processes that run at boot
#
-rw-r--r-- 1 root wheel 631 Feb 6 17:39 at.obdev.littlesnitchd.plist
-rw-r--r-- 1 root wheel 479 Feb 12 21:30 com.adobe.adobeupdatedaemon.plist
-rw-r--r-- 1 root wheel 642 Mar 7 18:13 com.adobe.agsservice.plist
-rw-r--r-- 1 root wheel 859 Jan 15 12:14 com.boxcryptor.BCFS.Mounter.Helper.plist
-rw-r--r-- 1 root wheel 600 Jan 15 12:14 com.boxcryptor.osx.PrivilegedHelper.plist
-rw-r--r-- 1 root wheel 564 Mar 15 10:40 com.funkensturm.LinkHelper.plist
-rw-r--r--@ 1 root wheel 818 Mar 1 20:21 com.google.keystone.daemon.plist
-rw-r--r-- 1 root wheel 499 Mar 15 10:36 com.objectiveSee.blockblock.plist
-rw-r--r-- 1 root wheel 704 Jan 26 21:21 com.prey.agent.plist
lrwxr-xr-x 1 root wheel 76 Feb 1 17:14 org.virtualbox.startup.plist -> ../Application Support/VirtualBox/LaunchDaemons/org.virtualbox.startup.plist
#
# These files are typically needed
# I wouldn't recommend deleting unless you need to
# Always backup!
#
#############################################################
#
#
cd /System/Library/LaunchAgents
ls -al
#
-rw-r--r-- 1 root wheel 869 Jul 30 2016 com.apple.AOSHeartbeat.plist
......long list
#
# There are a bunch of com.apple processes here,
# don't delete anything in this directory, you will most likely break things
# Only delete if you have an application that is causing system issues
#
#############################################################
#
#
cd /Library/PrivilegedHelperTools
ls -al
#
-r-xr--r--@ 1 root wheel 106672 Jan 15 12:14 com.boxcryptor.BCFS.Mounter.Helper
-r-xr--r--@ 1 root wheel 72240 Jan 15 12:14 com.boxcryptor.osx.PrivilegedHelper
-r-xr--r--@ 1 root wheel 40192 Mar 15 10:40 com.funkensturm.LinkHelper
#
# These are programs that can access data as a privileged user
# (basically root so they can do anything)
# So make sure you know what these programs are and research them if not
Those are the directories where you can find just about every program that is ran on startup.
The next step is to see what’s running on your system currently. MacOS uses a program called “launchctl” to list and control the running processes. The easiest way to see what non-apple programs are running is to grep them away!
#
launchctl list | grep -iv com.apple
PID Status Label
1172 0 org.mozilla.firefox.14932
- 0 at.obdev.MicroSnitchOpenAtLoginHelper
1073 0 com.adobe.CCXProcess.15260
9703 0 com.amazon.music
# ....long list
# If there is a process you want to stop right now, you can issue:
#
launchctl stop com.amazon.music
#
#
# You can also use this program to load and unload processes that we found above
# you need the full path to the file.
# The syntax is:
#
launchctl unload ~/Library/LaunchAgents/com.amazon.music.plist
#
#
# In theory this should remove it from the boot process.
# If you find that it doesn't, proceed to the more fun method 2.
# The reverse of unload is load, so use load to add the process back
launchctl load ~/Library/LaunchAgents/com.amazon.music.plist
#
Method 2 - remove the files manually (make sure to back them up first)
# Always back up things first in case something goes wrong
sudo cp net.tunnelblick.tunnelblick.tunnelblickd.plist ~/Downloads
#
# Then you can remove it (this doesn't stop the process,
# it just delete the startup file)
sudo rm net.tunnelblick.tunnelblick.tunnelblickd.plist
#
# You most likely need to use sudo to remove these
# After reboot, make sure nothing is amiss