Launch Agents: What Runs Before You Log In
Every app that updates itself, syncs in the background, or starts with your Mac installed something in one of three folders. So does most malware that survives a reboot. Reading them is a skill worth having.
macOS starts background processes through launchd, driven by small property list files. Where a file lives determines when it runs and with what privileges.
The three locations
~/Library/LaunchAgentsruns when you log in, with your privileges. Most third-party helpers live here./Library/LaunchAgentsruns when any user logs in. Installed by something with administrator rights./Library/LaunchDaemonsruns at boot, before login, as root. The most powerful and the most worth scrutinising.
There is also /System/Library/, which belongs to Apple and is protected by System Integrity Protection. Leave it alone.
Reading one
List what's there:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemonsThen read one:
cat ~/Library/LaunchAgents/com.example.helper.plistThree keys tell you nearly everything. Label is the identifier, usually reverse-domain style. ProgramArguments is the actual binary being run, which is the important part. RunAtLoad or StartInterval tells you when.
The name means nothing on its own. Anyone can call a file com.apple.something.plist. The path in ProgramArguments is what matters.
Judging what's safe
Normal
- The label matches software you recognise and the binary sits inside that app's bundle or in
/Library/Application Support/under the vendor's name. - Updaters from known vendors, such as Google, Microsoft, Adobe or Dropbox.
- Homebrew services you set up yourself.
Worth investigating
- The binary lives in
/tmp,/var/tmp, or a hidden folder in your home directory. - The label imitates Apple but the file isn't in
/System/. Genuine Apple agents live in the protected system paths. ProgramArgumentsinvokescurl,python,osascriptor a shell script rather than a normal application binary.- The agent belongs to an app you uninstalled months ago, which is clutter rather than danger.
- Random character strings in the label, which is a common pattern in adware.
launchctl unload ~/Library/LaunchAgents/name.plist, use your Mac normally for a day, then delete the file if nothing broke. Moving it to the Trash instead of deleting keeps the option open.
Seeing what's loaded
A plist on disk isn't necessarily running. To see what launchd has loaded:
launchctl listThe first column is the process ID if it is currently running, the second is the last exit code. An entry with a PID is live right now.
The uninstall problem
Dragging an app to the Trash almost never removes its launch agents. They stay, they keep trying to run, and they fail silently against a binary that no longer exists. Years of this accumulates into a startup process full of dead entries.
Harmless individually. Collectively it is one reason a Mac feels slower to log in than it did when new, and it is covered further in why Macs slow down.
See every launch agent with its real target
CleanMachine lists every agent and daemon across all three locations, shows whether each is currently loaded, and flags orphans whose binary no longer exists. Free to scan.
↓ Download Free & ScanConfiguration profiles, the other persistence trick
Worth checking at the same time. Look in System Settings under Privacy and Security for Profiles. If a profile exists that you didn't install, treat it seriously. Browser hijackers use profiles because they survive ordinary cleanup and can lock browser settings in place.
On a personal Mac that has never been enrolled with an employer or a school, the correct number of configuration profiles is usually zero.