# What Runs When Your Mac Starts? Managing Login and Background Items

> Login items, background items, LaunchAgents and LaunchDaemons start differently and come off differently. Learn to review, disable and safely remove each one.

- Canonical page: https://learnhubplay.nl/blog/mac-startup-login-items-guide
- Published: 2026-10-11
- By: LearnHubPlay, an independent software studio in Amsterdam
- Topic: Mac Care
- Tags: macOS, Troubleshooting, Privacy & security

Open System Settings > General > Login Items & Extensions on a Mac with a few years of apps behind it and you find a list you never wrote. Some entries are apps you meant to launch. Others are labelled "Item from unidentified developer" or belong to software you deleted last spring.

Those entries come from four mechanisms that share one pane: login items, background items, LaunchAgents and LaunchDaemons. They start at different moments and come off in different ways, so a switch that stops one does nothing about another.

After reading, you can name who owns any entry, tell a leftover from a threat, and switch it off at the layer that actually stops it, using only tools built into macOS 13 through 27.

## Four kinds of startup item, and who starts each one

Apple's WWDC22 session says the pane covers "agents, daemons, SMLoginItems, and apps that add themselves to open at login".

| Term | What it is and when it starts | Where you control it |
|---|---|---|
| Login item | An app, document, folder or server connection that opens in your session at login | Open at Login |
| Background item | Umbrella term for helpers that may run while the app is closed, such as updaters; usually at login, daemons at boot | Allow in the Background or App Background Activity, by version |
| LaunchAgent | A launchd job in a .plist file, for one user, started at that user's login | Listed as a background item |
| LaunchDaemon | A launchd job in a .plist file, for the system, started at boot before any login | Listed as a background item; enabling needs an administrator |

launchd, the macOS service manager, runs both kinds of job.

Before macOS 13 (Ventura), an installer simply copied a plist into a launchd folder. Ventura added the SMAppService API, which Apple's [documentation](https://developer.apple.com/documentation/servicemanagement/smappservice) says replaces that. Apps using it keep their plists [inside the app bundle](https://developer.apple.com/documentation/servicemanagement/updating-helper-executables-from-earlier-versions-of-macos), so an item can appear in System Settings with no file in any Library folder.

## Where to review them on each macOS version

This table follows Apple's Mac User Guide for each release:

| macOS | Path | Sections |
|---|---|---|
| Ventura 13, Sonoma 14 | System Settings > General > Login Items | Open at Login; Allow in the Background |
| Sequoia 15 | System Settings > General > Login Items & Extensions | Open at Login; Allow in the Background; Extensions |
| Tahoe 26, Golden Gate 27 | System Settings > General > Login Items & Extensions | Open at Login; App Background Activity; Extensions |

On macOS 27, Apple's Mac User Guide says "App Background Activity" and its [macOS 27 article](https://support.apple.com/en-us/125671) says "Background App Activity"; both put it under Login Items & Extensions.

Apple's [guide](https://support.apple.com/guide/mac-help/change-login-items-extensions-settings-mtusr003/mac) is written for administrators and does not say what standard users can do. In Open at Login, the plus button adds and the minus button removes; a yellow triangle marks an item that was moved or deleted and will not open. Removing an entry only stops it opening, and the app stays installed.

The background list is blunter. Howard Oakley of The Eclectic Light Company [reports](https://eclecticlight.co/2025/12/03/manage-login-and-background-items/) that you can only switch items on or off, that some re-enable themselves and that only some have an info button revealing the plist location.

> **Tip:** Hold Shift while clicking Log In until the Dock appears to skip login items for one session ([Apple](https://support.apple.com/guide/mac-help/mh15189/mac)); with automatic login, restart and hold Shift at the progress bar. Oakley says Safe mode blocks helper apps and services; our [slow-Mac guide](https://learnhubplay.nl/blog/mac-slow-after-update-troubleshooting) uses it as a test.

### What the notification means

An app that registers a login item is allowed by default and you are notified; a daemon that needs higher privileges requires administrator approval (WWDC22). From macOS 26, Apple's [deployment guide](https://support.apple.com/guide/deployment/manage-login-items-background-tasks-mac-depdca572563/web) adds that you are asked whether to allow background tasks that stay active after you quit the app. On macOS 27, Apple says you are notified the first time an app keeps running after you quit it; Control-click its Dock icon and choose Stop Running in Background to end it.

The notification means something registered itself, not that something is wrong. Check the red-flags table before switching it off.

## The launchd folders and the plist keys that matter

Several folders hold launchd plists. Apple's [technical note on daemons and agents](https://developer.apple.com/library/archive/technotes/tn2083/_index.html) names the first three as homes for third-party software.

| Folder | Loaded | Put there by | Your move |
|---|---|---|---|
| `~/Library/LaunchAgents` | At your login; your account only | Apps you installed, your scripts | Yours to manage |
| `/Library/LaunchAgents` | At login, all users | Administrator-run installers | Manage with care |
| `/Library/LaunchDaemons` | At boot, no user needed | Administrator-run installers | Manage with care; needs `sudo` |
| Apple's `LaunchAgents` and `LaunchDaemons` under `/System/Library` and `/Library/Apple/System/Library` | At login or boot | macOS and Apple | Leave alone; [System Integrity Protection](https://support.apple.com/en-us/102149) covers `/System`, and `ls -ldO /Library/Apple` shows `restricted` |

A plist names a program but is not the program; a privileged helper's executable can sit in `/Library/PrivilegedHelperTools`, as the trace below shows.

The [launchd.plist manual page](https://keith.github.io/xcode-man-pages/launchd.plist.5.html) defines the keys worth reading:

- **Label** is the required, unique name of the job.
- **Program** or **ProgramArguments** is what runs.
- **RunAtLoad** launches the job once when loaded. The default is false, and Apple says to avoid the key.
- **KeepAlive**, when true, keeps the job running continuously. The default is false.
- **Disabled** is unreliable: Apple says that state is now kept outside the file and `launchctl enable` overrides it.

## Inspect what is loaded with launchctl and sfltool

We ran these on macOS 26.5.2, not macOS 27. Apple's man page says output from the newer `launchctl` subcommands is for people and may change between releases.

```bash
launchctl list                            # your session: PID, last exit status, label
launchctl print system | grep -i NAME     # system daemons; NAME = part of an app or vendor label
launchctl print system/LABEL              # one daemon: path, type, state, program
launchctl print gui/$(id -u)/LABEL        # one job in your session
launchctl print-disabled gui/$(id -u)     # stored enable/disable overrides; read the => value
```

In `launchctl list`, a dash in the PID column means the job is not running right now. Status 0 is a clean exit; a negative status is the signal that stopped the job, so -15 is SIGTERM. A dash with -9 (SIGKILL) showed on several Apple jobs on our healthy Mac, so a non-zero status alone is not a fault.

For plist-based jobs, a `path =` line in `launchctl print` output names the plist; items registered through SMAppService show `path = (submitted by smd.<number>)`, so name their owner from the dump or the app's own settings.

### Trace one item from label to signature

On a Mac with Docker Desktop installed, its privileged helper shows the whole chain (excerpts; yours may differ):

```bash
launchctl print system/com.docker.vmnetd
plutil -p /Library/LaunchDaemons/com.docker.vmnetd.plist
codesign -dv --verbose=2 /Library/PrivilegedHelperTools/com.docker.vmnetd 2>&1 | grep -E "Authority|TeamIdentifier|Signature=|not signed"
```

```text
path = /Library/LaunchDaemons/com.docker.vmnetd.plist
program = /Library/PrivilegedHelperTools/com.docker.vmnetd

"Label" => "com.docker.vmnetd"
"RunAtLoad" => true

Authority=Developer ID Application: Docker Inc (9BNSXJN65R)
TeamIdentifier=9BNSXJN65R
```

A helper from an identified third-party developer shows a Developer ID authority and a TeamIdentifier. Apple's own files show `Authority=Software Signing` and `TeamIdentifier=not set`, ad-hoc-signed tools show `Signature=adhoc`, and an unsigned file prints "code object is not signed at all".

### Dump the background-task database

```bash
sudo sfltool dumpbtm > ~/Documents/btmdump.txt
```

Apple's deployment guide describes `dumpbtm` as printing the current status of login and background items. Run it with `sudo`. The man page predates the subcommand, so treat the output format as unstable.

Oakley says records are grouped by user ID: -2 appears to be a composite of most background items, 0 is root and 501 the primary admin user. An entry looks like this (values invented):

```text
Name: Example Sync Helper
Developer Name: Example Software BV
Team Identifier: ABCDE12345
Type: legacy daemon (0x10010)
Disposition: [enabled, allowed, visible, notified] (11)
Identifier: com.example.sync.helper
URL: file:///Library/LaunchDaemons/com.example.sync.helper.plist
```

Oakley's example shows `app (0x2)` as a Type. A [vendor's guide](https://dssw.co.uk/powermanager/guide/finding-and-fixing/macos-login-items/) shows legacy agent and legacy daemon types for plist-based jobs, with URL pointing at the plist. Apple does not document Disposition; the same guide reads "disabled" or "disallowed" as an entry that will not work.

If an entry gives no usable path, find the plist by its Identifier:

```bash
grep -rl com.example.sync.helper ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
```

## Remove an item in five steps, least invasive first

Stop at the first step that works. Steps 1 to 4 are reversible if you move files instead of deleting them; step 5 is not.

1. **Name the owner.** Use the info button, the dump's Name, Developer Name and URL lines, or the plist path followed by `codesign`. If it matches nothing you installed, see the red-flags table.
2. **Use the app's own setting or uninstaller.** Most apps offer "Launch at login", and the vendor knows which helpers depend on it. [Apple's uninstall page](https://support.apple.com/en-us/102610) calls an uninstaller the best way to remove an app along with its login items and other data.
3. **Switch it off in System Settings, then restart.** If it flips back on, the app is probably re-registering it; return to step 2.
4. **Remove a leftover plist** when the app is gone but the item remains. Unload it, then move the file rather than deleting it:

   ```bash
   # Per-user agent
   launchctl bootout gui/$(id -u)/com.example.helper
   mkdir -p ~/Desktop/launchd-removed
   mv ~/Library/LaunchAgents/com.example.helper.plist ~/Desktop/launchd-removed/

   # System daemon (administrator password)
   sudo launchctl bootout system/com.example.daemon
   sudo mv /Library/LaunchDaemons/com.example.daemon.plist ~/Desktop/launchd-removed/
   ```

   To undo, move the file back and run `launchctl bootstrap gui/$(id -u) <plist>` for an agent or `sudo launchctl bootstrap system <plist>` for a daemon. If the plist's `Program` points into `/Library/PrivilegedHelperTools` and the app is gone, move that executable out too, after the plist. Leftovers under `~/Library` are a storage question, covered in [what is using space and what is safe to delete](https://learnhubplay.nl/blog/mac-storage-full-what-to-delete).

5. **Reset the database, last.** Run `sudo sfltool resetbtm` and restart. Oakley says this removes all third-party login items and restores installation defaults, and that many items return unless old apps and their support files are deleted. Save a dump first. It clears Open at Login too, so expect to re-check everything you rely on, and do not run it on a Mac managed by an employer or school.

To stop a job loading without touching its file, `launchctl disable gui/$(id -u)/com.example.helper` persists across boots and `enable` reverses it. The man page lists `unload` as legacy.

> **Warning:** Do not edit anything under `/System` or `/Library/Apple`, and do not empty a whole LaunchAgents folder; other apps' components live there.

## Judging an unfamiliar item: red flags and a decision table

### Red flags that separate a leftover from a threat

Most unfamiliar entries are ordinary updaters, helpers or leftovers; that is our judgment, not a measured figure. Persistence is also a standard malware technique: MITRE's entry on [Launch Agents](https://attack.mitre.org/techniques/T1543/001/) describes adversaries placing a plist with `RunAtLoad` or `KeepAlive` set to true so an agent runs at login, and its detection notes point to suspicious `ProgramArguments` and unsigned binaries.

| What you see | Why it matters | Next step |
|---|---|---|
| No Team Identifier in the dump, or `codesign` says "code object is not signed at all" | You cannot trace the maker, but Apple's own files and ad-hoc-signed tools such as Homebrew services also lack one; check the path and Authority line | Suspect, unless it is Apple's or a tool you installed yourself |
| Executable in `/tmp`, Downloads or a hidden dot-folder | Helpers usually point into `/Applications`, `/Library` or a tool's own folder | Do not run it; move the plist out |
| A `com.apple.*` label outside `/System/Library` and `/Library/Apple` | Apple keeps its own items in those SIP-protected folders, and a label is only a string | Check the signature, not the name |
| It returns after removal | Another process is re-creating it | Find the parent in the dump; if none, suspect |
| It appeared with no install of yours, after a download from an unofficial source | Timing links it to what you ran | Suspect |

If an item fits the last two rows, keep the dump and the plist, move the plist out (step 4), restart and scan with a reputable security tool. Apple's [Platform Security guide](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web) describes XProtect as built-in signature-based detection and removal plus a behavioural engine: a safety net, not a clearance.

### Keep, disable or remove

| Situation | Decision | Reason |
|---|---|---|
| Sync client, VPN, password manager or backup agent you rely on | Keep | The product stops working without its helper |
| App you open occasionally that launches itself at login | Disable the login item or the app's setting | It runs for no benefit |
| Helper left behind by a deleted app | Remove (step 4) | Nothing uses it |
| Security agent, filter or VPN from your employer or school | Keep and ask IT | Removal can cut off access |
| Unknown, but signed by a developer you recognise | Identify first, then apply the rows above | A helper can have a different name from its app |
| Unknown, unsigned or in an odd location | Isolate | See the red-flags table |

Apple's deployment guide says items matching a Service Management profile rule, such as a team identifier or service label, are approved automatically. A work or school Mac can therefore carry items you did not choose; if one keeps coming back there, ask IT before assuming malware.

## Where to start this week

1. Open the pane for your macOS version and turn off every login item you did not choose.
2. Run the dump and read the Name, Developer Name, Type and URL lines of entries you do not recognise.
3. Move leftovers from deleted apps out (step 4), keeping the files for now.

*[Tend](https://tend.learnhubplay.nl/) is a free macOS app from LearnHubPlay whose Background Items review lists legacy startup items and Background Task Management records. Everything above works with the tools built into macOS.*

## Frequently asked questions

### I dragged the app to the Trash. Why is it still in the list?

Deleting the app removes the bundle, not what an installer copied elsewhere. Helpers in `/Library/LaunchDaemons` or `/Library/PrivilegedHelperTools` sit outside the bundle and stay until you remove them (step 4). Apple's uninstall page calls an app's own uninstaller the best way to delete an app with its login items. The dump shows what is still registered.

### Why does a background item switch itself back on?

Oakley writes that if you disable some of them, "you may see that they're automatically re-enabled". A likely reason, which we have not confirmed for any app, is that the app registers the item again when it runs. Turn off the setting inside the app, or uninstall it.

### Will turning off background activity break an app?

You lose whatever it did while closed. Apple's Mac User Guide gives checking for software updates or syncing data as examples, so a sync client may stop working.

## Sources and further reading

- [Change Login Items & Extensions settings on Mac](https://support.apple.com/guide/mac-help/change-login-items-extensions-settings-mtusr003/mac) — Apple Mac User Guide, macOS 13 to 27. Paths and section names.
- [Manage login items and background tasks on Mac](https://support.apple.com/guide/deployment/manage-login-items-background-tasks-mac-depdca572563/web) — Apple Platform Deployment guide. `sfltool`, macOS 26 prompt, Service Management.
- [If an app continues running in the background after you quit it](https://support.apple.com/en-us/125671) — Apple Support, macOS 27. Dock label, Stop Running in Background.
- [What's new in privacy](https://developer.apple.com/videos/play/wwdc2022/10096/) — Apple, WWDC22. Notification, defaults, daemon approval.
- [Technical Note TN2083: Daemons and Agents](https://developer.apple.com/library/archive/technotes/tn2083/_index.html) — Apple, archived. Daemons, agents, plist folders.
- [launchctl(1) manual page](https://keith.github.io/xcode-man-pages/launchctl.1.html) — Apple man page, xcode-man-pages mirror. Subcommands.
- [Manage login and background items](https://eclecticlight.co/2025/12/03/manage-login-and-background-items/) — Howard Oakley, The Eclectic Light Company, 2025. `dumpbtm`, `resetbtm`.
- [Launch Agent (T1543.001)](https://attack.mitre.org/techniques/T1543/001/) — MITRE ATT&CK, modified May 2026. LaunchAgent persistence.