OS X autostart and autologin Agents and Daemons

So, those bloody autostart and autologins Angels and Daemons…
Where does OS X hides them?

1. User Agents

Executed by the currently logged in user: ~/Library/LaunchAgents/

ls /Users/your-username/Library/LaunchAgents/
ls /Users/master/Library/LaunchAgents/

2. Global Agents

Executed by the currently logged in user: /Library/LaunchAgents/

ls /Library/LaunchAgents/

3. Global Daemons

Executed by root (or a user specified with the UserName key): /Library/LaunchDaemons/

ls /Library/LaunchDaemons/

4. System Agents

Executed by the currently logged in user: /System/Library/LaunchAgents/

On OS X 10.10.2, there were 206 System Agents in that folder

ls /System/Library/LaunchAgents/
ls /System/Library/LaunchAgents | wc -l

5. System Daemons

Executed by root (or a user specified with the UserName key):
/System/Library/LaunchDaemons/

On OS X 10.10.2, there were 261 System Daemons in that folder

ls /System/Library/LaunchDaemons/
ls /System/Library/LaunchDaemons | wc -l

6. Legacy Startup Folders

Currently (2016) these are considered to be out-of-date (and should therefore be empty), but still worth checking if an old program placed anything in there:

ls /Library/StartupItems/
ls /System/Library/StartupItems/

Two more locations that are being mentioned on the internet:

ls /Users/master/Library/Preferences/com.apple.loginitems.plist
ls /private/var/db/launchd.db/com.apple.launchd.peruser.501/overrides.plist

Probably these are out of date, as I cannot find them on my machine, however, I discovered the following items:

ls /Users/master/Library/Preferences/com.apple.LaunchServices/
cat /Users/master/Library/Preferences/com.apple.LaunchServices.plist

7. launchd / launchctl Database

The most interesting bit (probably, this one replaced one of the lines above):

ls /private/var/db/com.apple.xpc.launchd/
cat /private/var/db/com.apple.xpc.launchd/overrides.plist

However, no point editing these files as after the next login they are re-created again. Great info on launchd can be found here, and here is some info on apple Agents and Daemons

Finally, to see what’s running

launchctl list
launchctl list | wc -l

Which is going to produce something similar to…
Want to disable some of these? Here is how

launchctl list | wc -l
     221
launchctl list        
PID	Status	Label
84	0	com.apple.coreservicesd
-	0	com.apple.FontWorker
169	0	com.apple.cvmsServ
-	0	com.apple.applessdstatistics
-	0	com.apple.storagekitd
-	0	com.apple.hdiejectd
144	0	com.apple.corestorage.corestoraged
-	0	com.apple.wifid
-	0	com.apple.storereceiptinstaller
148	0	com.apple.networkd_privileged
36	0	com.apple.iconservices.iconservicesagent
-	0	com.apple.emond
17	0	com.apple.syslogd
-	0	com.apple.logkextloadsd
-	0	com.apple.bluetoothReporter
137	0	com.apple.WindowServer
-	0	com.apple.NetworkSharing
150	0	com.apple.discoveryd_helper
-	0	com.apple.afpfs_checkafp
-	0	com.apple.var-db-dslocal-backup
52	0	com.apple.securityd
-	0	com.apple.nesessionmanager
-	0	com.apple.auditd
356	0	com.apple.ocspd
56	0	com.apple.autofsd
16	0	com.apple.UserEventAgent-System
-	0	com.apple.Kerberos.kadmind
-	0	com.apple.preferences.timezone.auto
-	0	com.apple.coresymbolicationd
278	0	com.apple.suhelperd
-	0	com.apple.RFBEventHelper
-	0	com.apple.racoon
-	0	com.apple.IASUtilities.IASCloudConfigHelper
-	0	com.apple.metadata.mds.scan
-	0	com.apple.RemoteDesktop.PrivilegeProxy
-	0	com.apple.installd
-	0	org.postfix.master
-	0	com.apple.dvdplayback.setregion
141	0	com.apple.nehelper
202	0	com.apple.tccd.system
-	0	com.apple.appleseed.fbahelperd
-	0	com.apple.IFCStart
-	0	com.apple.softwareupdate_download_service
-	0	com.apple.mdmclient.daemon
96	0	com.apple.ctkd
140	0	com.apple.nsurlsessiond_privileged
44	0	com.apple.awdd
45	0	com.apple.qmaster.qmasterd
-	0	com.apple.periodic-monthly
-	0	com.apple.security.authhost.00000000-0000-0000-0000-0000000186A6
105	0	com.apple.secinitd
207	0	com.apple.TMCacheDelete
-	0	com.apple.scsid
-	0	com.apple.kuncd
-	0	com.apple.IOAccelMemoryInfoCollector
-	0	com.apple.msrpc.lsarpc
65	0	com.apple.KernelEventAgent
-	0	com.apple.aslmanager
-	0	com.apple.taskgated-helper
-	0	com.apple.cmio.registerassistantservice
-	0	com.apple.RemotePairTool
67	0	com.apple.hidd
19	0	com.apple.kextd
-	0	com.apple.systemstats.analysis
72	0	com.apple.diagnosticd
24	0	com.apple.coreservices.appleevents
26	0	com.apple.powerd
75	0	com.apple.authd
-	0	com.apple.DumpPanic
-	0	com.apple.vsdbutil
-	0	com.apple.nfsd
198	0	com.apple.audio.coreaudiod
29	0	com.apple.airportd
264	-43	com.apple.watchdogd
-	0	com.apple.pfd
-	0	com.apple.NetworkDiagnostics
37	0	com.apple.iconservices.iconservicesd
-	0	com.apple.systemkeychain
-	0	com.apple.nlcd
-	0	com.apple.SCHelper
-	0	com.apple.periodic-weekly
-	0	com.apple.netbiosd
-	0	org.cups.cupsd
-	0	com.apple.statd.notify
-	0	com.apple.preferences.timezone.admintool
165	0	com.apple.nsurlstoraged
-	0	com.apple.noticeboard.state
139	0	com.apple.metadata.mds.index
51	0	com.apple.usbmuxd
-	0	com.apple.IOBluetoothUSBDFU
259	0	com.apple.CrashReporterSupportHelper
-	0	com.apple.DumpGPURestart
54	0	com.apple.displaypolicyd
55	0	com.apple.blued
187	0	com.apple.securityd_service
-	0	com.apple.periodic-daily
145	0	com.apple.alf
64	0	com.apple.logind
-	0	com.apple.dspluginhelperd
-	0	com.apple.msrpc.netlogon
-	0	com.apple.CoreRAID
-	0	com.apple.TrustEvaluationAgent.system
-	0	com.apple.newsyslog
206	0	com.apple.cache_delete
68	0	com.apple.taskgated
-	0	com.apple.GSSCred
25	0	com.apple.configd
185	0	com.apple.AccountPolicyHelper
-	0	com.apple.fontmover
-	0	com.apple.UserNotificationCenter
-	0	com.apple.speech.speechsynthesisd
-	0	com.apple.rpcbind
147	0	com.apple.networkd
41	0	com.apple.coreduetd
42	0	com.apple.wdhelper
-	0	com.apple.ucupdate.plist
-	0	com.apple.ManagedClient.enroll
-	0	com.apple.DesktopServicesHelper
-	0	com.apple.Kerberos.kcm
63	0	com.apple.loginwindow
-	0	com.apple.efilogin-helper
-	0	com.apple.cmio.iOSScreenCaptureAssistant
69	0	com.apple.notifyd
-	0	com.apple.ReportPanicService
-	0	com.apple.Kerberos.digest-service
20	0	com.apple.fseventsd
367	0	com.apple.automountd
-	0	com.vix.cron
22	0	com.apple.thermald
233	0	com.apple.FileCoordination
-	0	com.apple.eapolcfg_auth
-	0	com.apple.coreservices.appleid.passwordcheck
-	0	com.apple.AssetCacheLocatorService
277	0	com.apple.softwareupdated
-	0	com.apple.systemadministration.writeconfig
-	0	com.apple.security.agentMain
-	0	com.apple.SubmitDiagInfo
-	0	com.apple.emond.aslmanager
-	0	com.apple.msrpc.mdssvc
-	0	com.apple.dpd
257	0	com.apple.cmio.AppleCameraAssistant
-	0	com.apple.corestorage.corestoragehelperd
-	0	com.apple.ReportCrash.Root
-	0	com.apple.systempreferences.install
-	0	com.apple.cmio.IIDCVideoAssistant
-	0	com.apple.security.syspolicy
142	0	com.apple.usbd
70	0	com.apple.distnoted.xpc.daemon
-	0	com.apple.bsd.dirhelper
61	0	com.apple.stackshot
62	0	com.apple.revisiond
-	0	com.apple.smb.preferences
-	0	com.apple.cloudfamilyrestrictionsd
74	0	com.apple.cfprefsd.xpc.daemon
-	0	com.apple.Localization.SetDefaultsService
-	0	com.apple.unmountassistant.sysagent
-	0	com.apple.uninstalld
-	0	com.apple.xpc.smd
-	0	com.apple.gkreport
-	0	com.apple.backupd
-	0	com.apple.airport.wps
301	0	com.apple.systemstatsd
-	0	com.apple.nfsconf
-	0	com.apple.netauth.sys.auth
247	0	com.apple.MobileFileIntegrity
-	0	com.apple.DesktopServicesHelper.CECEFA4F-9553-4111-AB71-921542016951
-	0	com.apple.configureLocalKDC
336	0	com.apple.spindump
32	0	com.apple.metadata.mds
-	0	com.apple.mbicloudsetupd
-	0	com.apple.lockd
-	0	com.apple.wwand
-	0	com.apple.printtool.daemon
-	0	com.apple.fontd
-	0	com.apple.cmio.VDCAssistant
-	0	com.apple.security.authhost
-	0	com.apple.pfctl
-	0	com.apple.gssd
-	0	com.apple.PerformanceAnalysis.animationperfd
47	0	com.apple.wirelessproxd
-	0	com.apple.security.agentMain.00000000-0000-0000-0000-0000000XXXXX
-	0	com.apple.loginwindow.LFVTracer
50	0	com.apple.coreservices.launchservicesd
-	0	com.apple.afpfs_afpLoad
-	0	com.apple.platform.ptmd
-	0	com.apple.iokit.ioserviceauthorized
-	0	com.apple.Kerberos.kdc
59	0	com.apple.softwareupdatecheck.initial
-	0	com.apple.msrpc.srvsvc
-	0	com.apple.bnepd
-	0	com.apple.familycontrols
-	0	com.apple.dpaudiothru
-	0	com.apple.nis.ypbind
-	0	com.apple.kcproxy
171	0	com.apple.AmbientDisplayAgent
-	0	com.apple.installandsetup.systemmigrationd
-	0	com.apple.metadata.mds.spindump
-	0	com.apple.Kerberos.kpasswdd
-	0	com.apple.msrpc.wkssvc
-	0	com.apple.awacsd
31	0	com.apple.warmd
-	0	com.apple.powerd.swd
-	0	com.apple.ManagedClient
38	0	com.apple.diskarbitrationd
-	0	com.apple.systemstats.daily
-	0	com.apple.netauth.sys.gui
46	0	com.apple.opendirectoryd
143	0	com.apple.ifdreader
-	0	com.apple.bluetoothaudiod
49	0	com.apple.networking.discoveryd
-	0	com.apple.ManagedClient.cloudconfigurationd
-	0	com.apple.PCIELaneConfigTool
-	0	com.apple.GameController.gamecontrollerd
-	0	com.apple.sessionlogoutd
-	0	com.apple.pacemaker
-	0	com.apple.cmio.AVCAssistant
-	0	com.apple.diskmanagementd
179	0	com.apple.CodeSigningHelper
146	0	com.apple.sysmond
-	0	com.apple.sandboxd
#

2,291 total views, 4 views today