Mac Processes List: 369 macOS Background Processes, Explained

Found mds_stores, WindowServer or mediaanalysisd near the top of Activity Monitor and wondered what it is? Search for it below. Every entry has one plain sentence on what it does and a clear answer on whether to quit it, and we checked each one on a real Mac running macOS 27.0.1: where its file lives, who signed it, and how macOS starts it.

Quick answer

This Mac processes list explains 369 macOS background processes in plain English. Leave Apple’s processes alone: 126 do one job, such as indexing or syncing, and stop on their own, and the other 243 are lasting parts of macOS that it starts again when needed. We timed one restart at 0.1 seconds. Quit only apps you opened yourself.

369background processes explained
342 of 342files we could read are signed by Apple
261were running on our Mac when we checked
0.1 sfor macOS to restart one we quit

Look up any process you see in Activity Monitor

Type a process name exactly as Activity Monitor shows it, or a plain word such as Spotlight, iCloud, Wi-Fi or Photos, and the list narrows as you type. A Mac runs hundreds of processes at once, and nearly all of them belong to macOS: ours had 600 running when we checked, and more than 1,000 on a day with more apps open. Each row says what the process does in one sentence, whether to quit it, where its file lives on the Mac and, for 195 of them, Apple’s own one-line description from the macOS manual pages.

Showing all 369 processes

ProcessWhat it does, and where it livesQuit it?
AccessibilityUIServerAccessibilityrunning

This shows accessibility controls on screen.

/System/Library/CoreServices/AccessibilityUIServer.app/Contents/MacOS/AccessibilityUIServer · signed by Apple
Leave itPart of macOS
accountsdAccountsrunning

This keeps track of the accounts you've added, like iCloud, Google or Exchange.

/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AddressBookSourceSyncContactsrunning

Contacts is syncing with your accounts. It stops when it's done.

Apple’s own description: “Syncs Contacts data with servers”/System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/AddressBookSourceSync.app/Contents/MacOS/AddressBookSourceSync · signed by Apple · starts when macOS needs it
Let it finishStops on its own
addressbooksyncdContacts sync

This syncs your contacts. It stops when it's done.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
adidAd settingsrunning

This handles the advertising settings for Apple's own apps.

/System/Library/PrivateFrameworks/CoreADI.framework/adid · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AirPlayUIAgentAirPlayrunning

This shows the AirPlay menu and AirPlay messages.

/System/Library/CoreServices/AirPlayUIAgent.app/Contents/MacOS/AirPlayUIAgent · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
AirPlayXPCHelperAirPlayrunning

This sends your screen or sound to an AirPlay device.

/usr/libexec/AirPlayXPCHelper · signed by Apple · starts when macOS needs it
Leave itPart of macOS
airportdWi-Firunning

This runs Wi-Fi.

Apple’s own description: “airport daemon”/usr/libexec/airportd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AKAuthorizationRemoteViewServiceSign in with Apple

This shows the Sign in with Apple window.

/System/Library/PrivateFrameworks/AuthKitUI.framework/Versions/A/XPCServices/AKAuthorizationRemoteViewService.xpc/Contents/MacOS/AKAuthorizationRemoteViewService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
akdApple Accountrunning

This keeps you signed in to your Apple Account.

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
amfidApp security checkrunning

This checks that apps are properly signed and haven't been tampered with.

Apple’s own description: “The mobile file integrity daemon”/usr/libexec/amfid · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AMPDeviceDiscoveryAgentiPhone syncrunning

This notices when an iPhone or iPad is connected, for syncing in Finder.

Apple’s own description: “The discovery service for managing iOS/iPod device discovery”/System/Library/PrivateFrameworks/AMPDevices.framework/Versions/A/Support/AMPDeviceDiscoveryAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AMPDevicesAgentiPhone sync

This syncs or backs up your iPhone or iPad with your Mac. It stops when it's done.

Apple’s own description: “The devices agent for managing iOS/iPod device syncing”/System/Library/PrivateFrameworks/AMPDevices.framework/Versions/A/Support/AMPDevicesAgent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
AMPLibraryAgentMusic library

This keeps your Music and TV libraries up to date. It stops on its own.

Apple’s own description: “The media library agent for Music.app and TV.app”/System/Library/PrivateFrameworks/AMPLibrary.framework/Versions/A/Support/AMPLibraryAgent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
amsaccountsdApp Store accountrunning

This keeps you signed in to the App Store and other Apple media services.

/System/Library/PrivateFrameworks/AppleMediaServices.framework/Resources/amsaccountsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
analyticsdAnalyticsrunning

This collects anonymous usage and crash data, if you allowed sharing it with Apple. It's normally quiet.

Apple’s own description: “Diagnostics and Usage”/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
anedNeural Enginerunning

This runs your Mac's Neural Engine, the part of the chip used for AI features.

/usr/libexec/aned · signed by Apple · starts when macOS needs it
Leave itPart of macOS
aneuserdNeural Engine

This runs your Mac's Neural Engine, the part of the chip used for AI features.

/usr/libexec/aneuserd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
apfsdDiskrunning

This looks after your Mac's disk, like its snapshots and free space.

Apple’s own description: “APFS volume manager”/usr/libexec/apfsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
appleaccountdApple Accountrunning

This manages your Apple Account on this Mac.

/usr/libexec/appleaccountd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
appleeventsdApp automationrunning

This lets apps control each other when you've allowed it, for AppleScript and automation.

/System/Library/CoreServices/appleeventsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
appleh13cameradCamerarunning

This runs your Mac's built-in camera.

/usr/libexec/appleh13camerad · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AppleSpellSpelling

This checks your spelling as you type.

/System/Library/Services/AppleSpell.service/Contents/MacOS/AppleSpell · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AppSSOAgentWork sign-in

This signs you in to work or school accounts once, for all your apps.

/System/Library/PrivateFrameworks/AppSSO.framework/Support/AppSSOAgent.app/Contents/MacOS/AppSSOAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AppSSODaemonWork sign-in

This signs you in to work or school accounts once, for all your apps.

/System/Library/PrivateFrameworks/AppSSO.framework/Support/AppSSODaemon · signed by Apple · starts when macOS needs it
Leave itPart of macOS
appstoreagentApp Store

The App Store is checking for or installing app updates. It stops when it's done.

/System/Library/PrivateFrameworks/AppStoreDaemon.framework/Support/appstoreagent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
appstoredApp Store

The App Store is checking for, downloading or installing apps and updates. It stops when it's done.

/System/Library/PrivateFrameworks/AppStoreDaemon.framework/Support/appstored · signed by Apple · starts when macOS needs it
Let it finishStops on its own
apsdPush notificationsrunning

This receives notifications from Apple for your apps. It's normally quiet.

Apple’s own description: “Apple Push Notification service daemon”/System/Library/PrivateFrameworks/ApplePushService.framework/apsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ARDAgentRemote management

This lets someone manage this Mac remotely, if Remote Management is turned on.

Apple’s own description: “Apple Remote Desktop Agent”/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AssetCacheLocatorServiceShared downloadsrunning

This looks for a nearby Mac that shares downloads, if your network has one.

Apple’s own description: “Service to find local macOS Content Caches”/System/Library/PrivateFrameworks/AssetCacheServices.framework/Versions/A/XPCServices/AssetCacheLocatorService.xpc/Contents/MacOS/AssetCacheLocatorService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
assistantdSirirunning

This runs Siri.

Apple’s own description: “Siri Daemon”/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
audioaccessorydAirPodsrunning

This handles AirPods features like automatic switching and battery level.

/System/Library/CoreServices/audioaccessoryd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
audioanalyticsdSound levelsrunning

This measures sound levels, for things like headphone volume warnings.

Apple’s own description: “Audio Diagnostics and Usage Reporting”/usr/libexec/audioanalyticsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
AudioComponentRegistrarAudio plug-insrunning

This finds the audio plug-ins on your Mac. It's busy for a moment after you install one.

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar · signed by Apple · starts when macOS needs it
Let it finishStops on its own
audiomxdSound routingrunning

This is part of how your Mac handles sound.

/usr/libexec/audiomxd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
authdAdmin passwordrunning

This checks your admin password when something needs permission.

/System/Library/Frameworks/Security.framework/Versions/A/XPCServices/authd.xpc/Contents/MacOS/authd · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
AuthenticationServicesAgentPasskeys and passwordsrunning

This handles Sign in with Apple, passkeys and password autofill.

Apple’s own description: “Authentication Services App Login Agent”/System/Cryptexes/App/usr/libexec/AuthenticationServicesAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
autofsdNetwork drivesrunning

This keeps network drives connected when your network changes.

Apple’s own description: “daemon to update autofs mounts on network changes”/usr/libexec/autofsd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
automountdNetwork drivesrunning

This connects network drives when you open them.

Apple’s own description: “automatic mount / unmount daemon for autofs”/usr/libexec/automountd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
avconferencedVideo callsrunning

This handles the sound and video for FaceTime calls.

/usr/libexec/avconferenced · signed by Apple · starts when macOS needs it
Leave itPart of macOS
axassetsdAccessibility downloadsrunning

This downloads files for accessibility features, like voices. It stops when it's done.

/System/Library/PrivateFrameworks/AXAssetLoader.framework/Support/axassetsd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
BackgroundTaskManagementAgentLogin itemsrunning

This tells you when an app adds itself to open at login or run in the background.

Apple’s own description: “User agent which manages notifications about background task processes”/System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Support/BackgroundTaskManagementAgent.app/Contents/MacOS/BackgroundTaskManagementAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
backgroundtaskmanagementdLogin itemsrunning

This keeps track of apps that open at login or run in the background.

Apple’s own description: “Daemon which manages policy for background task processes and login items”/System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Resources/backgroundtaskmanagementd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
backupdTime Machinerunning

Time Machine is backing up your Mac. It stops when the backup is done.

Apple’s own description: “Time Machine backup daemon”/System/Library/CoreServices/TimeMachine/backupd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
backupd-helperTime Machinerunning

Time Machine is getting ready to back up your Mac. It stops when the backup is done.

Apple’s own description: “Time Machine backup daemon helper”/System/Library/CoreServices/TimeMachine/backupd-helper · signed by Apple · starts when macOS needs it
Let it finishStops on its own
bashTerminal

This runs the commands you type in a Terminal window.

Apple’s own description: “GNU Bourne-Again SHell”/bin/bash · signed by Apple · starts when macOS needs it
Leave itPart of macOS
BiomeAgentActivity historyrunning

This keeps a private history of how you use your apps, for suggestions. It stays on your Mac.

Apple’s own description: “Biome operation graph execution launch agent”/System/Library/PrivateFrameworks/BiomeStreams.framework/Support/BiomeAgent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
biomedActivity historyrunning

This keeps a private history of how you use your apps so macOS can suggest things. It stays on your Mac.

Apple’s own description: “Biome operation graph execution daemon”/System/Library/PrivateFrameworks/BiomeStreams.framework/Support/biomed · signed by Apple · starts when macOS needs it
Let it finishStops on its own
biomesyncdActivity history syncrunning

This syncs your private suggestion history between your devices. It stops on its own.

Apple’s own description: “data synchronization daemon”/usr/libexec/biomesyncd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
biometrickitdTouch IDrunning

This reads your fingerprint for Touch ID.

Apple’s own description: “biometric daemon”/usr/libexec/biometrickitd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
birdiCloud Driverunning

iCloud Drive is syncing your files. It stops when everything is up to date.

Apple’s own description: “Documents in the Cloud”/System/Library/PrivateFrameworks/iCloudDriveCore.framework/Versions/A/Support/bird · signed by Apple · starts when macOS needs it
Let it finishStops on its own
bluetoothdBluetoothrunning

This runs Bluetooth for your headphones, mouse and keyboard.

/usr/sbin/bluetoothd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
bluetoothuserdBluetooth

This runs Bluetooth features for your account.

/usr/libexec/bluetoothuserd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
BTLEServerBluetooth accessoriesrunning

This talks to Bluetooth accessories like fitness trackers and some keyboards.

/usr/sbin/BTLEServer · signed by Apple · starts when macOS needs it
Leave itPart of macOS
BTLEServerAgentBluetooth accessoriesrunning

This talks to Bluetooth accessories like fitness trackers and some keyboards.

/usr/sbin/BTLEServerAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
caffeinateKeep-awake commandrunning

A Terminal command that keeps your Mac awake. It stops when that command ends.

Apple’s own description: “prevent the system from sleeping on behalf of a utility”/usr/bin/caffeinate · signed by Apple
Leave itPart of macOS
calaccessdCalendarrunning

This gives apps access to your calendars.

Apple’s own description: “calendar data process”/System/Library/PrivateFrameworks/CalendarDaemon.framework/Support/calaccessd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
CalendarAgentCalendar

Calendar is syncing your events. It stops when they're up to date.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
callservicesdPhone callsrunning

This handles FaceTime and iPhone calls on your Mac.

Apple’s own description: “call server”/System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
cameracapturedCamerarunning

This runs your camera for apps that use it.

/usr/libexec/cameracaptured · signed by Apple · starts when macOS needs it
Leave itPart of macOS
cdpdiCloud protectionrunning

This helps protect your iCloud data and account recovery.

/System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
cfprefsdApp settingsrunning

This reads and saves the settings for every app. It gets busy when an app saves lots of settings.

Apple’s own description: “defaults server”/usr/sbin/cfprefsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
chronodWidgetsrunning

This keeps your widgets up to date.

/System/Library/PrivateFrameworks/ChronoCore.framework/Support/chronod · signed by Apple · starts when macOS needs it
Leave itPart of macOS
clouddiCloudrunning

iCloud is syncing data for your apps, like notes, reminders and settings. It stops when everything is up to date.

Apple’s own description: “CloudKit”/System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
cloudpairdBluetooth pairing sync

This shares AirPods and other Bluetooth pairings across your devices through iCloud.

Apple’s own description: “cloudpaird daemon”Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
cloudphotodiCloud Photosrunning

Photos is uploading or downloading pictures with iCloud Photos. It stops when everything is in sync.

Apple’s own description: “The macOS iCloud Photos agent”/System/Library/PrivateFrameworks/CloudPhotoLibrary.framework/Versions/A/Support/cloudphotod · signed by Apple · starts when macOS needs it
Let it finishStops on its own
cloudtelemetrydiCloud reportsrunning

This sends iCloud problem reports, if you allowed it.

Apple’s own description: “Cloud Telemetry Daemon”/System/Library/PrivateFrameworks/CloudTelemetry.framework/Support/cloudtelemetryd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
com.apple.accessibility.mediaaccessibilitydCaptions

This handles captions and audio descriptions for videos.

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.AmbientDisplayAgentTrue Tonerunning

This adjusts your screen's colour to the light around you.

/System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServices/com.apple.AmbientDisplayAgent.xpc/Contents/MacOS/com.apple.AmbientDisplayAgent · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.appkit.xpc.openAndSavePanelServiceOpen and Save windowrunning

This draws the Open and Save windows for your apps.

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.CallKit.CallDirectoryCaller ID

This shows caller ID and blocked numbers from apps, for calls on your Mac.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
com.apple.CloudDocs.iCloudDriveFileProvideriCloud Driverunning

iCloud Drive is syncing your files. It stops when everything is up to date.

/System/Library/PrivateFrameworks/CloudDocs.framework/PlugIns/com.apple.CloudDocs.iCloudDriveFileProvider.appex/Contents/MacOS/com.apple.CloudDocs.iCloudDriveFileProvider · signed by Apple
Let it finishStops on its own
com.apple.cmio.registerassistantserviceCamera setuprunning

This sets up cameras and video devices for apps.

Apple’s own description: “CoreMediaIO DAL Registration Assistant Service”/System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/com.apple.cmio.registerassistantservice · signed by Apple · starts when macOS needs it
Leave itPart of macOS
com.apple.CodeSigningHelperApp signature checkrunning

This checks that an app really comes from its developer. It finishes quickly.

/System/Library/Frameworks/Security.framework/Versions/A/XPCServices/com.apple.CodeSigningHelper.xpc/Contents/MacOS/com.apple.CodeSigningHelper · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
com.apple.FaceTime.FTConversationServiceFaceTime

This handles group FaceTime and SharePlay.

/System/Library/PrivateFrameworks/TelephonyUtilities.framework/XPCServices/com.apple.FaceTime.FTConversationService.xpc/Contents/MacOS/com.apple.FaceTime.FTConversationService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.geodMaps datarunning

This downloads map data for Maps, Weather and Find My. It stops when the download is done.

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
com.apple.hiservices-xpcserviceApp servicesrunning

This helps apps with things like the Services menu and accessibility.

/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/XPCServices/com.apple.hiservices-xpcservice.xpc/Contents/MacOS/com.apple.hiservices-xpcservice · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.MapKit.SnapshotServiceMap pictures

This draws small map pictures for apps. It finishes quickly.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
com.apple.MobileInstallationHelperServiceInstalling

This installs an app. It stops when it's done.

/System/Library/PrivateFrameworks/MobileInstallation.framework/XPCServices/com.apple.MobileInstallationHelperService.xpc/Contents/MacOS/com.apple.MobileInstallationHelperService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
com.apple.MobileSoftwareUpdate.UpdateBrainServiceSoftware Update

macOS is preparing an update. It stops when it's done.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
com.apple.Passwords.MenuBarExtraPasswordsrunning

This is the Passwords icon in your menu bar.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
com.apple.quicklook.ThumbnailsAgentFile previewsrunning

This makes thumbnail pictures of your files. It stops once they're made.

/System/Library/Frameworks/QuickLookThumbnailing.framework/Support/com.apple.quicklook.ThumbnailsAgent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
com.apple.Safari.SafeBrowsing.ServiceSafe Browsing

This updates Safari's list of dangerous websites. It stops on its own.

Apple’s own description: “Safari Safe Browsing Service”/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/Versions/A/com.apple.Safari.SafeBrowsing.Service · signed by Apple · starts when macOS needs it
Let it finishStops on its own
com.apple.StreamingUnzipServiceUnpacking

This unpacks an app or update while it downloads. It stops when it's done.

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
com.apple.Virtualization.VirtualMachineVirtual machine

This is a virtual machine: another system, like Linux or a copy of macOS, running inside your Mac for an app such as Docker. Closing the app that started it stops it.

/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.WebKit.GPUWeb page graphics

This draws video and graphics for web pages. Closing busy tabs calms it down.

/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.GPU.xpc/Contents/MacOS/com.apple.WebKit.GPU · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.WebKit.NetworkingWeb page loading

This loads web pages for Safari and other apps.

/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
com.apple.WebKit.WebContentA web page

This is a web page open in Safari or another app. A busy one is usually a page with video or ads, and closing that tab calms it down.

/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
CommCenteriPhone calls and textsrunning

This handles calls and text messages that come through your iPhone.

Apple’s own description: “Provides functionality to allow the Mac to make and receive phone calls”/System/Library/Frameworks/CoreTelephony.framework/Support/CommCenter · signed by Apple · starts when macOS needs it
Leave itPart of macOS
commerceApp Store purchasesrunning

This handles App Store purchases. It's normally quiet.

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/commerce · signed by Apple · starts when macOS needs it
Leave itPart of macOS
configdNetwork settingsrunning

This keeps track of your network and system settings.

Apple’s own description: “System Configuration Daemon”/usr/libexec/configd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
contactsdContactsrunning

This gives apps access to your contacts.

Apple’s own description: “contactsd daemon”/System/Library/Frameworks/Contacts.framework/Support/contactsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
containermanagerdApp storagerunning

This sets up private storage folders for your apps.

Apple’s own description: “Application and plug-in containerization management daemon”/usr/libexec/containermanagerd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
containermanagerd_systemApp storagerunning

This sets up private storage folders for apps.

Apple’s own description: “System container directory management daemon”/usr/libexec/containermanagerd_system · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ContainerMetadataExtractorApp inforunning

This reads information about newly installed apps. It finishes quickly.

/System/Library/PrivateFrameworks/iCloudDriveService.framework/XPCServices/ContainerMetadataExtractor.xpc/Contents/MacOS/ContainerMetadataExtractor · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
ContextStoreAgentSuggestionsrunning

This keeps track of what you're doing so macOS can make suggestions. It stays on your Mac.

/System/Library/PrivateFrameworks/CoreDuetContext.framework/Resources/ContextStoreAgent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
contextstoredSuggestionsrunning

This keeps track of what you're doing so macOS can make suggestions. It stays on your Mac.

/System/Library/PrivateFrameworks/CoreDuetContext.framework/Resources/contextstored · signed by Apple · starts when macOS needs it
Let it finishStops on its own
ContinuityCaptureAgentiPhone as webcamrunning

This lets you use your iPhone as a webcam.

/usr/libexec/ContinuityCaptureAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ControlCenterControl Centerrunning

This runs Control Center and many of the icons in your menu bar.

Apple’s own description: “macOS Control Center”/System/Library/CoreServices/ControlCenter.app/Contents/MacOS/ControlCenter · signed by Apple · starts when macOS needs it
Leave itPart of macOS
coreaudiodSoundrunning

This plays all sound on your Mac.

/usr/sbin/coreaudiod · signed by Apple · starts when macOS needs it
Leave itPart of macOS
coreauthdTouch ID and passwordsrunning

This handles Touch ID and password prompts.

Apple’s own description: “LocalAuthentication daemon and agent”/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
corebrightnessdScreen brightnessrunning

This adjusts your screen brightness and Night Shift.

Apple’s own description: “corebrightnessd daemon”/usr/libexec/corebrightnessd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
CoreDeviceServiceConnected devicesrunning

This talks to connected iPhones and iPads, mostly for Xcode and Finder.

/Library/Developer/PrivateFrameworks/CoreDevice.framework/Versions/A/XPCServices/CoreDeviceService.xpc/Contents/MacOS/CoreDeviceService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
coreduetdBackground schedulerrunning

This helps macOS decide when to run background jobs and which apps to suggest.

/usr/libexec/coreduetd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
CoreLocationAgentLocationrunning

This asks you before an app can use your location.

Apple’s own description: “manages location authorization prompts”/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
coreservicesdCore servicesrunning

This helps apps open files and find each other.

/System/Library/CoreServices/coreservicesd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
CoreServicesUIAgentSecurity promptsrunning

This shows messages like "Are you sure you want to open this app?"

/System/Library/CoreServices/CoreServicesUIAgent.app/Contents/MacOS/CoreServicesUIAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
corespeechdSiri listeningrunning

This listens for "Siri" and handles voice features.

/System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
corespeechd_systemSiri listeningrunning

This listens for "Siri" and handles voice features.

/System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd_system · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
corespotlightdSpotlightrunning

Spotlight is indexing what's inside your apps, like notes and messages, so search can find them. It stops on its own.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/corespotlightd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
coresymbolicationdCrash reports

This turns crash reports into something readable. It's busy for a moment after a crash.

Apple’s own description: “daemon to manage debug symbols cache”/System/Library/PrivateFrameworks/CoreSymbolication.framework/coresymbolicationd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
countrydRegionrunning

This works out which country your Mac is in, for things like Wi-Fi rules.

Apple’s own description: “Listens for country-level information and makes that available to users of RegulatoryDomain.framework”/usr/libexec/countryd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
CrashReporterSupportHelperCrash reportsrunning

This helps macOS write crash reports. It stops on its own.

Apple’s own description: “Provides functionality in support of CrashReporterSupport”/System/Library/CoreServices/CrashReporterSupportHelper · signed by Apple · starts when macOS needs it
Let it finishStops on its own
cronScheduled tasksrunning

This runs tasks that were set up to run at set times.

Apple’s own description: “daemon to execute scheduled commands (Vixie Cron)”/usr/sbin/cron · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ctkahpSmart cardsrunning

This handles smart cards and security keys, like a work ID card.

Apple’s own description: “SmartCard Agent”/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ctkdSmart cardsrunning

This handles smart cards and security keys, like a work ID card.

Apple’s own description: “SmartCard daemon/agent”/System/Library/Frameworks/CryptoTokenKit.framework/ctkd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
cupsdPrinting

This sends documents to your printer. It stops when printing is done.

Apple’s own description: “cups scheduler”/usr/sbin/cupsd · readable by the system only · starts when macOS needs it
Let it finishStops on its own
CursorUIViewServicePointerrunning

This draws pointer effects, like the big pointer when you shake the mouse.

/System/Library/PrivateFrameworks/TextInputUIMacHelper.framework/Versions/A/XPCServices/CursorUIViewService.xpc/Contents/MacOS/CursorUIViewService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
CVMServerGraphics setuprunning

This prepares graphics for apps that use older graphics code. It stops on its own.

Apple’s own description: “Mac OS X Core Virtual Machine Server”/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/CVMServer · signed by Apple · starts when macOS needs it
Let it finishStops on its own
dasdBackground schedulerrunning

This decides when background jobs like backups and updates run, usually when your Mac is idle.

/usr/libexec/dasd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
deletedFreeing spacerunning

macOS is clearing out caches and old files it doesn't need, to free up space. It stops on its own.

Apple’s own description: “The purgeable space / cache management daemon”/System/Library/PrivateFrameworks/CacheDelete.framework/deleted · signed by Apple · starts when macOS needs it
Let it finishStops on its own
diagnosticdDiagnostics

This sends your Mac's activity log to a tool that is watching it, like Console. It stops when that tool is closed.

Apple’s own description: “unified logging system diagnostic daemon”/usr/libexec/diagnosticd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
diskarbitrationdDisksrunning

This notices when disks and USB drives are plugged in and opens them.

Apple’s own description: “disk arbitration daemon”/usr/libexec/diskarbitrationd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
diskimagesiodDisk imagesrunning

This opens a disk image (.dmg) file. It's busy while one is being read, then stops.

Apple’s own description: “Handles I/O for disk images”/usr/libexec/diskimagesiod · signed by Apple · starts when macOS needs it
Let it finishStops on its own
diskmanagementdDisk Utility

This helps Disk Utility change a disk. It stops when it's done.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
DiskUnmountWatcherDisk ejectingrunning

This watches for disks being ejected.

Apple’s own description: “watches for disk unmount and remove cached credentials”/System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher · signed by Apple · starts when macOS needs it
Leave itPart of macOS
distnotedApp messagesrunning

This passes messages between apps. It's normally quiet; if it stays busy, one of your apps is usually the cause.

Apple’s own description: “distributed notification server”/usr/sbin/distnoted · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
dmdDevice management

This applies device rules, like Screen Time limits or settings from your school or company.

/usr/libexec/dmd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
DockDockrunning

This runs the Dock at the bottom of your screen.

Apple’s own description: “Provides the Dock interface for the system”/System/Library/CoreServices/Dock.app/Contents/MacOS/Dock · signed by Apple · starts when macOS needs it
Leave itPart of macOS
donotdisturbdFocusrunning

This runs Focus and Do Not Disturb.

Apple’s own description: “do dot disturb daemon”/System/Library/PrivateFrameworks/DoNotDisturbServer.framework/Support/donotdisturbd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
duetexpertdApp predictionsrunning

This predicts which apps you'll want next, for suggestions in Spotlight and elsewhere.

/usr/libexec/duetexpertd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
eligibilitydFeature availabilityrunning

This checks which features your Mac and region can use.

Apple’s own description: “eligibilityd - computes feature availability”/usr/libexec/eligibilityd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
endpointsecuritydSecurity software

This lets security software watch for threats.

Apple’s own description: “Daemon that manages user space components of the EndpointSecurity (ES) subsystem”/usr/libexec/endpointsecurityd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
eventkitsyncdCalendar sync

This syncs your calendars and reminders. It stops when it's done.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
extensionkitserviceApp add-ons

This runs small add-ons that apps provide, like widgets and share options.

/System/Library/Frameworks/ExtensionFoundation.framework/Versions/A/XPCServices/extensionkitservice.xpc/Contents/MacOS/extensionkitservice · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
fairplaydMedia protectionrunning

This unlocks music, films and apps you've bought so they can play.

/System/Library/PrivateFrameworks/CoreFP.framework/Versions/A/fairplayd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
familycircledFamily Sharingrunning

This runs Family Sharing.

/System/Library/PrivateFrameworks/FamilyCircle.framework/Versions/A/Resources/familycircled · signed by Apple
Leave itPart of macOS
filecoordinationdFile safetyrunning

This stops two apps from changing the same file at the same time.

Apple’s own description: “system-wide file access coordination”/usr/sbin/filecoordinationd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
fileproviderdCloud filesrunning

macOS is syncing files with iCloud Drive or another cloud folder like Dropbox or Google Drive. It stops when your files are up to date.

Apple’s own description: “Part of File Coordination”/System/Library/PrivateFrameworks/FileProvider.framework/Support/fileproviderd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
FinderFinderrunning

Finder shows your files and desktop. It restarts itself if closed.

/System/Library/CoreServices/Finder.app/Contents/MacOS/Finder · signed by Apple · starts when macOS needs it
Leave itPart of macOS
findmydevice-user-agentFind Myrunning

This lets you find this Mac with Find My.

Apple’s own description: “Find My Mac user agent”/usr/libexec/findmydevice-user-agent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
findmydevicedFind Myrunning

This lets you find this Mac with Find My.

Apple’s own description: “Find My Mac daemon”/usr/libexec/findmydeviced · signed by Apple · starts when macOS needs it
Leave itPart of macOS
findmylocateagentFind Myrunning

This finds your devices and people for Find My.

Apple’s own description: “User agent for the Find My subsystem”/usr/libexec/findmylocateagent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
followupdSetup remindersrunning

This shows reminders to finish setting something up, like your Apple Account.

/System/Library/PrivateFrameworks/CoreFollowUp.framework/Versions/A/Support/followupd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
fontdFontsrunning

This manages the fonts on your Mac. It can get busy after you install fonts, then settles.

Apple’s own description: “Mac OS X system font registration manager”/System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS.framework/Support/fontd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
fontservicesdFonts

This manages the fonts on your Mac.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
fontworkerFontsrunning

This prepares fonts for apps. It can get busy after you install fonts, then settles.

Apple’s own description: “Mac OS X system font registration and validation daemon”/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Support/fontworker · signed by Apple · starts when macOS needs it
Let it finishStops on its own
fseventsdFile trackingrunning

macOS is keeping track of files that changed. It calms down when copying or installing finishes.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/Support/fseventsd · signed by Apple · macOS restarts it the moment it quits
Let it finishStops on its own
fskitdDisk formatsrunning

This lets your Mac read disks in other formats.

Apple’s own description: “FSKit mount manager and mount support”/usr/libexec/fskitd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
gamecontrolleragentdGame controllersrunning

This handles game controllers.

/usr/libexec/gamecontrolleragentd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
gamecontrollerdGame controllersrunning

This handles game controllers.

Apple’s own description: “game controller daemon”/usr/libexec/gamecontrollerd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
gamepolicydGame Moderunning

This turns on Game Mode when you play a game full screen, so the game gets priority.

Apple’s own description: “Optimizes system performance for running game processes”/usr/libexec/gamepolicyd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
generativeexperiencesdApple Intelligencerunning

This runs Apple Intelligence features like Writing Tools.

Apple’s own description: “A daemon that powers generative experience”/System/Library/PrivateFrameworks/GenerativeExperiencesRuntime.framework/Versions/A/generativeexperiencesd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
geoanalyticsdMaps reports

This sends anonymous Maps reports, if you allowed it. It stops on its own.

/System/Library/PrivateFrameworks/GeoAnalytics.framework/geoanalyticsd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
geodMaps data

This downloads map data for Maps, Weather and Find My. It stops when the download is done.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
GSSCredNetwork sign-in

This keeps you signed in to company or school networks.

Apple’s own description: “manages GSS-API credentials”/System/Library/Frameworks/GSS.framework/Helpers/GSSCred · signed by Apple · starts when macOS needs it
Leave itPart of macOS
heardHearing featuresrunning

This runs hearing features for headphones and hearing devices.

/System/Library/PrivateFrameworks/HearingCore.framework/heard · signed by Apple · starts when macOS needs it
Leave itPart of macOS
helpdHelp pages

This builds the help pages for your apps. It's busy for a moment after updates.

Apple’s own description: “Help Daemon”/System/Library/PrivateFrameworks/HelpData.framework/Versions/A/Resources/helpd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
hiddKeyboard and mouse

This handles your keyboard, mouse and trackpad.

Apple’s own description: “The HID library userland daemon”/usr/libexec/hidd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
homedHomerunning

This connects your Mac to your smart home accessories.

Apple’s own description: “home services daemon”/System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed · signed by Apple · starts when macOS needs it
Leave itPart of macOS
icddScanners and camerasrunning

This finds scanners and cameras for Image Capture.

Apple’s own description: “ImageCapture Discovery Daemon”/System/Library/Image Capture/Support/icdd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
iconservicesagentIcons

This draws app and file icons. It gets busy after updates, then settles.

Apple’s own description: “agent responsible for generating icon images from the resources provided in application bundles and by the system”/System/Library/CoreServices/iconservicesagent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
iconservicesdIcons

This draws app and file icons. It gets busy after updates, then settles.

Apple’s own description: “deamon responsible for managing the shared icon cache”/System/Library/CoreServices/iconservicesd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
identityservicesdMessages and FaceTimerunning

This connects Messages and FaceTime to your Apple Account.

/System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app/Contents/MacOS/identityservicesd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
imagentMessagesrunning

This sends and receives your iMessages.

/System/Library/PrivateFrameworks/IMCore.framework/imagent.app/Contents/MacOS/imagent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
imageplaygrounddImage Playground

This makes images for Image Playground and Genmoji.

Apple’s own description: “imageplaygroundd daemon”/System/Library/PrivateFrameworks/SuggestedImage.framework/Support/imageplaygroundd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
IMAutomaticHistoryDeletionAgentMessages cleanup

This deletes old messages if you've set Messages to keep them for a limited time.

/System/Library/PrivateFrameworks/IMDPersistence.framework/IMAutomaticHistoryDeletionAgent.app/Contents/MacOS/IMAutomaticHistoryDeletionAgent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
IMDPersistenceAgentMessages

This saves your messages on your Mac. It can get busy when lots of messages arrive at once, then settles.

/System/Library/PrivateFrameworks/IMDPersistence.framework/XPCServices/IMDPersistenceAgent.xpc/Contents/MacOS/IMDPersistenceAgent · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
imklaunchagentTypingrunning

This starts input methods for typing emoji and other languages.

/System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
installdInstallingrunning

An app or update is being installed. It stops when it's done.

Apple’s own description: “macOS software installation daemon”/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
installerInstaller

An installer is running. It stops when it's done.

Apple’s own description: “system software and package installer tool”/usr/sbin/installer · signed by Apple
Let it finishStops on its own
intelligencecontextdApple Intelligencerunning

This gives Apple Intelligence the context it needs, like what's on screen when you ask.

Apple’s own description: “This is a daemon that retrieves contextual information from various sources”/System/Library/PrivateFrameworks/IntelligenceFlowContextRuntime.framework/Versions/A/intelligencecontextd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
intelligenceflowdApple Intelligencerunning

This handles your Apple Intelligence requests.

Apple’s own description: “A daemon that manages sessions for intelligence services”/System/Library/PrivateFrameworks/IntelligenceFlowRuntime.framework/Versions/A/intelligenceflowd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
IntelligencePlatformComputeServiceApple Intelligencerunning

Apple Intelligence is processing information on your Mac. It works mostly when your Mac is idle, and stops on its own.

/System/Library/PrivateFrameworks/IntelligencePlatformCompute.framework/Versions/A/XPCServices/IntelligencePlatformComputeService.xpc/Contents/MacOS/IntelligencePlatformComputeService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
intelligenceplatformdApple Intelligencerunning

Apple Intelligence is organising information on your Mac so it can help you. It works mostly when your Mac is idle, and stops on its own.

Apple’s own description: “A daemon that analyzes content on the device to build and query a general purpose knowledge graph”/System/Library/PrivateFrameworks/IntelligencePlatformCore.framework/Versions/A/intelligenceplatformd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
itunesclouddMusic library sync

This syncs your Music library with iCloud. It stops when everything is up to date.

/System/Library/PrivateFrameworks/iTunesCloud.framework/Support/itunescloudd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
itunesstoredApple media purchases

This handles purchases from the iTunes Store, Apple Music and Apple TV.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
kdcSharing sign-inrunning

This handles secure sign-in between Macs, for things like file and screen sharing.

Apple’s own description: “Kerberos 5 server”/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kdc · signed by Apple · starts when macOS needs it
Leave itPart of macOS
kernel_taskmacOS cooling

This is the heart of macOS. When your Mac gets hot, it uses this to slow things down so it can cool off.

The macOS kernel itself, so there is no separate file.
Leave itPart of macOS
KernelEventAgentDisk warningsrunning

This shows warnings, like when a disk was removed without ejecting it.

Apple’s own description: “utility to provide user interface on behalf of the kernel”/usr/sbin/KernelEventAgent · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
kernelmanagerdDriversrunning

This loads the drivers for your hardware and accessories.

/usr/libexec/kernelmanagerd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
keybagdEncryption

This looks after the keys that keep your files encrypted.

/usr/libexec/keybagd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
keyboardservicesdTyping suggestions

This learns words you type, for predictions and autocorrect. It stays on your Mac.

/usr/libexec/keyboardservicesd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
Keychain Circle NotificationiCloud Keychainrunning

This shows iCloud Keychain messages, like approving a new device.

Apple’s own description: “Part of iCloud Keychain syncing”/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification · signed by Apple · starts when macOS needs it
Leave itPart of macOS
knowledge-agentSuggestionsrunning

This keeps a private record of how you use your Mac so it can suggest things. It stays on your Mac and settles on its own.

/usr/libexec/knowledge-agent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
KonaSynthesizerSpoken voices

This reads text out loud, for Siri and read-aloud features. It stops when it's done talking.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
languageassetdLanguage filesrunning

This downloads language files for dictation, translation and typing. It stops when it's done.

/usr/libexec/languageassetd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
launchdmacOSrunning

This starts and stops everything on your Mac.

Apple’s own description: “System wide and per-user daemon/agent manager”/sbin/launchd · signed by Apple
Leave itPart of macOS
launchservicesdApp listrunning

This keeps track of your apps and which app opens which kind of file.

/System/Library/CoreServices/launchservicesd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
linkdShortcuts actionsrunning

This lets Siri and Shortcuts use actions from your apps.

Apple’s own description: “daemon that handles interaction with applications via their App Intents interfaces”/usr/libexec/linkd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
liveactivitiesdLive Activitiesrunning

This shows Live Activities from your iPhone, like a delivery or a game score.

/System/Library/PrivateFrameworks/SessionCore.framework/Support/liveactivitiesd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
LocalAuthenticationRemoteServiceTouch ID promptsrunning

This shows Touch ID and password prompts for apps.

/System/Library/PrivateFrameworks/LocalAuthenticationUI.framework/Versions/A/XPCServices/LocalAuthenticationRemoteService.xpc/Contents/MacOS/LocalAuthenticationRemoteService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
localspeechrecognitionDictation

This turns speech into text on your Mac, for dictation and apps that listen. It stops when the listening stops.

/System/Library/Frameworks/Speech.framework/Versions/A/XPCServices/localspeechrecognition.xpc/Contents/MacOS/localspeechrecognition · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
locationdLocationrunning

This works out where your Mac is for apps you've allowed, like Maps and Weather.

Apple’s own description: “location services daemon”/usr/libexec/locationd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
logdSystem logrunning

This writes your Mac's activity log. It gets busy when an app writes too much to it.

Apple’s own description: “unified logging system daemon”/usr/libexec/logd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
loginTerminal sessionrunning

This signs you in when a Terminal window opens.

Apple’s own description: “log into the computer”/usr/bin/login · signed by Apple
Leave itPart of macOS
logindLogin sessionsrunning

This keeps track of who is logged in.

/System/Library/CoreServices/logind · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
loginwindowYour loginrunning

This runs the login screen and keeps you logged in. Closing it would log you out.

/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow · signed by Apple · starts when macOS needs it
Leave itPart of macOS
lsdApp listrunning

This keeps track of which app opens which kind of file.

/usr/libexec/lsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
MacinTalkAUSPSpoken voices

This reads text out loud with a system voice. It stops when it's done talking.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
maildMail

Mail is downloading or sorting your email in the background. It stops when your mailbox is up to date.

/System/Library/PrivateFrameworks/EmailDaemon.framework/Versions/A/maild · signed by Apple · starts when macOS needs it
Let it finishStops on its own
managedcorespotlightdSpotlight

This is part of Spotlight, the search on your Mac. It stops on its own.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/managedcorespotlightd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mdbulkimportSpotlightrunning

Spotlight is reading a big batch of files so search can find them. It stops on its own.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdbulkimport · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mDNSResponderNetworkrunning

This finds websites and devices on your network. It gets busy when apps make lots of connections.

Apple’s own description: “Multicast and Unicast DNS daemon”/usr/sbin/mDNSResponder · signed by Apple · starts when macOS needs it
Leave itPart of macOS
mDNSResponderHelperNetworkrunning

This helps find websites and devices on your network.

Apple’s own description: “mDNS privilege separation helper”/usr/sbin/mDNSResponderHelper · signed by Apple · starts when macOS needs it
Leave itPart of macOS
mdsSpotlightrunning

Spotlight, the search on your Mac, is sorting your files so you can find them. This is normal after an update or when you add lots of files, and it stops on its own.

Apple’s own description: “metadata server”/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds · signed by Apple · macOS restarts it the moment it quits
Let it finishStops on its own
mds_storesSpotlightrunning

Spotlight, the search on your Mac, is sorting your files so you can find them. This is normal after an update or when you add lots of files, and it stops on its own.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds_stores · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mdworkerSpotlight

Spotlight, the search on your Mac, is sorting your files so you can find them. This is normal after an update or when you add lots of files, and it stops on its own.

Apple’s own description: “metadata server worker”/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mdworker_sharedSpotlightrunning

Spotlight, the search on your Mac, is sorting your files so you can find them. This is normal after an update or when you add lots of files, and it stops on its own.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mdwriteSpotlightrunning

This is part of Spotlight, the search on your Mac. It finishes quickly.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdwrite · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mediaanalysisdPhotosrunning

macOS is looking through your photos and videos so you can search for what's in them, like "dog" or "beach". It stops on its own, mostly when your Mac is idle.

/System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mediaremotedNow Playingrunning

This controls what's playing, for the Now Playing menu and media keys.

/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted · signed by Apple · starts when macOS needs it
Leave itPart of macOS
MIDIServerMusic keyboards

This connects music keyboards and other MIDI devices.

Apple’s own description: “Agent supporting CoreMIDI framework”/System/Library/Frameworks/CoreMIDI.framework/MIDIServer · signed by Apple · starts when macOS needs it
Leave itPart of macOS
migrationhelperMoving your datarunning

This helps move your data after a macOS update or Migration Assistant. It stops when it's done.

/System/Library/PrivateFrameworks/SystemMigrationNetwork.framework/Resources/migrationhelper · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mlhostdOn-device AI

This runs on-device AI models for apps. It stops when they're done.

/usr/libexec/mlhostd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mobileassetdExtra downloadsrunning

macOS is downloading extra parts it needs, like voices, fonts or dictionaries. It stops when the download finishes.

/usr/libexec/mobileassetd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
mobiletimerdAlarms and timersrunning

This runs alarms and timers from the Clock app.

Apple’s own description: “timer agent”/System/Library/PrivateFrameworks/MobileTimer.framework/Executables/mobiletimerd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
modelcatalogdAI modelsrunning

This keeps track of which on-device AI models are installed.

Apple’s own description: “A daemon that stores base models and adapters”/System/Library/PrivateFrameworks/ModelCatalogRuntime.framework/Versions/A/modelcatalogd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
modelmanagerdApple Intelligencerunning

This loads the on-device AI models when an app uses Apple Intelligence.

Apple’s own description: “Model Management Daemon”/usr/libexec/modelmanagerd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
MTLAssetUpgraderDGraphics setup

This updates graphics files after a macOS update. It stops when it's done.

Apple’s own description: “Metal asset upgrader daemon”/usr/libexec/MTLAssetUpgraderD · signed by Apple · starts when macOS needs it
Let it finishStops on its own
MTLCompilerServiceGraphics setup

macOS is preparing graphics for your apps. It's busy for a while after an update, then stops.

/System/Library/Frameworks/Metal.framework/Versions/A/XPCServices/MTLCompilerService.xpc/Contents/MacOS/MTLCompilerService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
nanoappregistrydApple Watch

This connects your Mac to your Apple Watch.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
nanotimekitcompaniondApple Watch

This connects your Mac to your Apple Watch.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
navdLeave-time alerts

This works out when you should leave for calendar events, using traffic from Maps.

Apple’s own description: “Time to Leave Daemon”/System/Library/CoreServices/navd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
neagentVPNrunning

This runs VPN and network filter apps.

Apple’s own description: “Host process for Network Extension plugins”/usr/libexec/neagent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
nearbydNearby devicesrunning

This finds nearby Apple devices for things like AirDrop and Find My.

Apple’s own description: “The proximity daemon”/usr/libexec/nearbyd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
nehelperVPNrunning

This helps set up VPNs and network filters.

Apple’s own description: “Helper daemon for the Network Extension framework”/usr/libexec/nehelper · signed by Apple · starts when macOS needs it
Leave itPart of macOS
nesessionmanagerVPNrunning

This keeps your VPN or network filter connected.

Apple’s own description: “Daemon responsible for running and managing Network Extension sessions”/usr/libexec/nesessionmanager · signed by Apple · starts when macOS needs it
Leave itPart of macOS
netbiosdWindows network namesrunning

This finds Windows computers and shared folders on your network.

Apple’s own description: “NetBIOS protocol daemon”/usr/sbin/netbiosd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
networkserviceproxyPrivate Relayrunning

This runs iCloud Private Relay, which hides your internet address in Safari.

Apple’s own description: “Transparent network proxy for Apple system services”/usr/libexec/networkserviceproxy · signed by Apple · starts when macOS needs it
Leave itPart of macOS
newsdApple News

This updates Apple News in the background. It stops on its own.

/System/Library/PrivateFrameworks/NewsDaemon.framework/newsd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
NotificationCenterNotificationsrunning

This shows your notifications and widgets.

Apple’s own description: “Notification Center service for display notifications”/System/Library/CoreServices/NotificationCenter.app/Contents/MacOS/NotificationCenter · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
notifydSystem messagesrunning

This passes small messages between parts of macOS, like "the network changed".

Apple’s own description: “notification server”/usr/sbin/notifyd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
NPKCompanionAgentApple Watch

This connects your Mac to your Apple Watch, for things like Apple Pay.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
nsurlsessiondBackground downloadsrunning

macOS is downloading something in the background, often for iCloud or an app. It stops when the download finishes.

Apple’s own description: “The background NSURLSession daemon”/usr/libexec/nsurlsessiond · signed by Apple · starts when macOS needs it
Let it finishStops on its own
opendirectorydUser accountsrunning

This keeps track of the user accounts on your Mac.

Apple’s own description: “is a launchd(8) job for client access to local or remote directory systems”/usr/libexec/opendirectoryd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
osanalyticshelperCrash reportsrunning

This helps write crash and diagnostic reports. It stops on its own.

Apple’s own description: “Helper process for analytics and diagnostics”/System/Library/CoreServices/osanalyticshelper · signed by Apple · starts when macOS needs it
Let it finishStops on its own
parsecdSearch suggestions

This fetches suggestions from Apple for Spotlight, Safari and Siri.

Apple’s own description: “Support daemon for Siri Search”/System/Library/PrivateFrameworks/CoreParsec.framework/parsecd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
passdWallet and Apple Payrunning

This runs Wallet and Apple Pay.

Apple’s own description: “Apple Pay & Wallet daemon”/System/Library/PrivateFrameworks/PassKitCore.framework/passd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
PasswordBreachAgentPassword check

This checks, privately, whether any saved password showed up in a known data leak. It stops on its own.

Apple’s own description: “Leaked Password Warning Agent”/System/Volumes/Preboot/Cryptexes/App/usr/libexec/PasswordBreachAgent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
passwordbreachdPassword check

This checks, privately, whether any saved password showed up in a known data leak. It stops on its own.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
pboardCopy and pasterunning

This runs copy and paste.

Apple’s own description: “pasteboard server”/usr/libexec/pboard · signed by Apple · starts when macOS needs it
Leave itPart of macOS
pbsServices menurunning

This helps with the Services menu and copying between apps.

Apple’s own description: “general helper tool”/System/Library/CoreServices/pbs · signed by Apple · starts when macOS needs it
Leave itPart of macOS
peopledPeople suggestionsrunning

This works out who you talk to most, for suggestions when you share. It stays on your Mac.

/System/Library/PrivateFrameworks/People.framework/peopled · signed by Apple · starts when macOS needs it
Let it finishStops on its own
PerfPowerServicesEnergy measuringrunning

This measures how much energy apps use.

Apple’s own description: “manages structured log archives that enable retrieval of system power and performance data”/usr/libexec/PerfPowerServices · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
photoanalysisdPhotosrunning

Photos is scanning your pictures to find people, places and memories. It stops on its own, and works faster when your Mac is plugged in.

Apple’s own description: “The macOS photo library analysis agent”/System/Library/PrivateFrameworks/PhotoAnalysis.framework/Versions/A/Support/photoanalysisd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
photolibrarydPhotosrunning

Photos is keeping your photo library up to date, often while it syncs with iCloud. It stops on its own.

Apple’s own description: “The macOS photo library agent”/System/Library/PrivateFrameworks/PhotoLibraryServices.framework/Versions/A/Support/photolibraryd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
pkdAdd-on managerrunning

This keeps track of the add-ons and extensions apps install.

Apple’s own description: “management and supervision daemon for plug-in services”/usr/libexec/pkd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
PowerChimeCharging soundrunning

This plays the sound when you plug in the charger.

/System/Library/CoreServices/PowerChime.app/Contents/MacOS/PowerChime · signed by Apple · starts when macOS needs it
Leave itPart of macOS
powerdPowerrunning

This manages sleep, battery and power settings.

Apple’s own description: “Daemon that manages Energy Preferences”/System/Library/CoreServices/powerd.bundle/powerd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
powerexperiencedBattery carerunning

This runs battery features like Optimised Battery Charging.

/usr/libexec/powerexperienced · signed by Apple · starts when macOS needs it
Leave itPart of macOS
privacyaccountingdPrivacy report

This keeps the record behind the privacy report in Settings.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
promotedcontentdApple's ads

This picks the ads shown in Apple's own apps, like the App Store and News.

/usr/libexec/promotedcontentd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
QLPreviewGenerationExtensionFile previewsrunning

This makes preview pictures of your files. It stops once the previews are made.

/System/Library/Frameworks/QuickLookUI.framework/Versions/A/PlugIns/QLPreviewGenerationExtension.appex/Contents/MacOS/QLPreviewGenerationExtension · signed by Apple
Let it finishStops on its own
quicklookdFile previews

This makes preview pictures of your files. It stops once they're made.

/System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd.app/Contents/MacOS/quicklookd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
QuickLookUIServiceQuick Lookrunning

This shows file previews when you press the Space bar.

/System/Library/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
rapportdNearby devicesrunning

This lets your Mac talk to your other Apple devices nearby, for things like Handoff and Universal Clipboard.

Apple’s own description: “Rapport Daemon”/usr/libexec/rapportd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
recentsdRecent contactsrunning

This remembers people you recently emailed or messaged, for suggestions.

Apple’s own description: “recentsd daemon”/System/Library/PrivateFrameworks/CoreRecents.framework/Versions/A/Support/recentsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
reminddRemindersrunning

This syncs your reminders.

Apple’s own description: “This line parsed for whatis database”/usr/libexec/remindd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
remotepairingdDevice pairingrunning

This pairs your Mac with your iPhone, iPad or Vision Pro.

/System/Library/Templates/Data/Library/Apple/System/Library/PrivateFrameworks/RemotePairing.framework/Versions/A/XPCServices/remotepairingd.xpc/Contents/MacOS/remotepairingd · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
replaydScreen recordingrunning

Something is recording or sharing your screen. It stops when the recording stops.

Apple’s own description: “MacOS daemon to support ReplayKit on macOS”/usr/libexec/replayd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
ReportCrashCrash report

An app just crashed and macOS is writing down what happened. It stops on its own.

Apple’s own description: “Generates crash reports”/System/Library/CoreServices/ReportCrash · signed by Apple · starts when macOS needs it
Let it finishStops on its own
revisiondDocument versionsrunning

This saves older versions of your documents so you can go back. It's normally quiet.

Apple’s own description: “storage manager for document revisions”/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/Support/revisiond · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
routinedFrequent placesrunning

This learns places you visit often, for things like travel time suggestions. It stays on your Mac.

Apple’s own description: “A daemon that learns the historical location patterns of a user”/usr/libexec/routined · signed by Apple · starts when macOS needs it
Let it finishStops on its own
rtcreportingdCall quality reportsrunning

This reports FaceTime call quality to Apple, if you allowed it.

Apple’s own description: “Diagnostics and Usage Reporting”/usr/libexec/rtcreportingd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
runningboarddApp managerrunning

This decides how much power and memory each running app may use.

Apple’s own description: “assertion services daemon”/usr/libexec/runningboardd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
sandboxdApp safety rulesrunning

This keeps each app in its own space so it can't reach what it shouldn't.

Apple’s own description: “sandbox daemon”/usr/libexec/sandboxd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ScopedBookmarkAgentFile accessrunning

This remembers which files and folders you've let an app open.

/System/Library/CoreServices/ScopedBookmarkAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
screencaptureuiScreenshots

This is the screenshot tool.

Apple’s own description: “screencapture daemon”/System/Library/CoreServices/screencaptureui.app/Contents/MacOS/screencaptureui · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ScreenSaverEngineScreen saver

Your screen saver is running. It stops when you move the mouse.

/System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine · signed by Apple
Let it finishStops on its own
screensharingdScreen Sharing

Someone is viewing or controlling this Mac with Screen Sharing. It stops when they disconnect.

Apple’s own description: “listens for VNC connections from clients”/System/Library/CoreServices/RemoteManagement/screensharingd.bundle/Contents/MacOS/screensharingd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
ScreenTimeAgentScreen Time

This tracks Screen Time and app limits.

Apple’s own description: “Screen Time Agent”/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
searchpartydFind Myrunning

This runs Find My for this Mac, your AirTags and your devices.

Apple’s own description: “searchparty daemon”/usr/libexec/searchpartyd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
searchpartyuseragentFind Myrunning

This helps Find My locate your devices and AirTags.

Apple’s own description: “searchparty user agent”/usr/libexec/searchpartyuseragent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
secdPasswordsrunning

This keeps your saved passwords safe and syncs them with iCloud Keychain.

Apple’s own description: “centralised keychain agent”/usr/libexec/secd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
secinitdApp safety setuprunning

This sets up the security rules for each app as it opens.

Apple’s own description: “The security policy initialization daemon”/usr/libexec/secinitd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
SecurityAgentPassword prompt

This shows the window that asks for your password.

Apple’s own description: “Authorization Services Agent”/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
securitydSecurityrunning

This keeps passwords, keys and certificates safe.

Apple’s own description: “Security context daemon for keychain and cryptographic operations”/usr/sbin/securityd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
sensorkitdResearch data

This handles sensor data for research studies you've joined. It's normally idle.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
sharedfilelistdRecent itemsrunning

This keeps your recent files and the Finder sidebar lists.

Apple’s own description: “User agent which manages lists of file system items”/System/Library/CoreServices/sharedfilelistd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
sharingdAirDrop and Handoffrunning

This runs AirDrop, Handoff and sharing with nearby devices.

Apple’s own description: “Sharing Daemon that enables AirDrop, Handoff, Instant Hotspot, Shared Computers, and Remote Disc in the Finder”/usr/libexec/sharingd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
ShortcutsViewServiceShortcutsrunning

This shows a shortcut on screen while it runs.

/System/Library/PrivateFrameworks/WorkflowKit.framework/XPCServices/ShortcutsViewService.xpc/Contents/MacOS/ShortcutsViewService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
SidecarRelaySidecar

This lets you use an iPad as a second screen.

Apple’s own description: “Sidecar Relay Service”/usr/libexec/SidecarRelay · signed by Apple · starts when macOS needs it
Leave itPart of macOS
SiriSirirunning

This shows Siri on screen.

/System/Library/CoreServices/Siri.app/Contents/MacOS/Siri · signed by Apple · starts when macOS needs it
Leave itPart of macOS
siriactionsdShortcuts and Sirirunning

This runs actions for Siri and the Shortcuts app.

Apple’s own description: “Daemon for the Shortcuts application”/System/Library/PrivateFrameworks/VoiceShortcuts.framework/Versions/A/Support/siriactionsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
siriinferencedSiri

This helps Siri understand what you asked.

/System/Library/PrivateFrameworks/SiriInference.framework/Versions/A/siriinferenced · signed by Apple · starts when macOS needs it
Leave itPart of macOS
siriknowledgedSiri suggestionsrunning

This learns from your apps so Siri can make suggestions. It stops on its own.

/usr/libexec/siriknowledged · signed by Apple · starts when macOS needs it
Let it finishStops on its own
SiriNCServiceSirirunning

This shows Siri results.

/System/Library/CoreServices/Siri.app/Contents/XPCServices/SiriNCService.xpc/Contents/MacOS/SiriNCService · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
smdBackground helpersrunning

This starts helper programs that apps have asked to run in the background.

Apple’s own description: “ServiceManagement framework daemon”/usr/libexec/smd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
socketfilterfwFirewallrunning

This is your Mac's firewall. It decides which apps may accept connections.

Apple’s own description: “Application Firewall daemon”/usr/libexec/ApplicationFirewall/socketfilterfw · signed by Apple · starts when macOS needs it
Leave itPart of macOS
softwareupdatedSoftware Update

macOS is downloading or preparing an update. It stops when it's done.

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated · signed by Apple · starts when macOS needs it
Let it finishStops on its own
SoftwareUpdateNotificationManagerUpdate reminders

This shows reminders that a software update is ready.

Apple’s own description: “macOS software update”/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager · signed by Apple · starts when macOS needs it
Leave itPart of macOS
speechsynthesisdSpoken voices

This reads text out loud. It stops when it's done talking.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
spindumpFreeze report

An app stopped responding and macOS is writing a report about it. It stops on its own.

Apple’s own description: “Profile entire system during a time interval”/usr/sbin/spindump · signed by Apple · starts when macOS needs it
Let it finishStops on its own
spindump_agentFreeze report

This helps macOS write a report when an app stops responding. It stops on its own.

Apple’s own description: “helper agent for spindump(8)”/usr/libexec/spindump_agent · signed by Apple · starts when macOS needs it
Let it finishStops on its own
SpotlightSpotlight

This is the Spotlight search bar and its results.

/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight · signed by Apple · starts when macOS needs it
Leave itPart of macOS
spotlightknowledgedSpotlight

This is part of Spotlight, the search on your Mac. It gets busy after updates and stops on its own.

/System/Library/Frameworks/CoreSpotlight.framework/spotlightknowledged · signed by Apple · starts when macOS needs it
Let it finishStops on its own
spotlightknowledged.importerSpotlightrunning

This is part of Spotlight, the search on your Mac. It gets busy after updates and stops on its own.

/usr/libexec/spotlightknowledged.importer · signed by Apple · starts when macOS needs it
Let it finishStops on its own
spotlightknowledged.updaterSpotlightrunning

This is part of Spotlight, the search on your Mac. It gets busy after updates and stops on its own.

/usr/libexec/spotlightknowledged.updater · signed by Apple · starts when macOS needs it
Let it finishStops on its own
sshRemote connectionrunning

This is a connection to another computer, started from Terminal.

Apple’s own description: “OpenSSH remote login client”/usr/bin/ssh · signed by Apple
Leave itPart of macOS
ssh-agentRemote connection keysrunning

This remembers your keys for connecting to other computers.

Apple’s own description: “OpenSSH authentication agent”/usr/bin/ssh-agent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
StatusKitAgentFocus statusrunning

This tells people who message you that your notifications are silenced, if you allow it.

Apple’s own description: “Agent backing StatusKit framework”/System/Library/PrivateFrameworks/StatusKit.framework/StatusKitAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
storagekitdDisk Utilityrunning

This helps Disk Utility change a disk. It stops when it's done.

Apple’s own description: “helper for the StorageKit framework”/usr/libexec/storagekitd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
storedownloaddApp Store downloads

The App Store is downloading an app or an update. It stops when it's done.

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
storekitdIn-app purchases

This handles purchases and subscriptions inside apps.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS
SubmitDiagInfoCrash reportsrunning

This sends crash reports to Apple, if you allowed it. It stops when it's done.

Apple’s own description: “sends diagnostic information to Apple”/System/Library/CoreServices/SubmitDiagInfo · signed by Apple · starts when macOS needs it
Let it finishStops on its own
suggestdSuggestionsrunning

This finds things like events and contacts in your mail and messages so it can suggest them. It works mostly when your Mac is idle.

Apple’s own description: “daemon that processes user content in order to detect contacts, events, named entities, etc”/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
suhelperdSoftware Updaterunning

This helps Software Update check for and prepare updates. It stops when it's done.

Apple’s own description: “Helper daemon for softwareupdate - no user initiated interface”/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
swcdWebsite links

This lets apps use your saved website passwords and open website links, when the website allows it.

Apple’s own description: “Shared Web Credentials Daemon”/usr/libexec/swcd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
symptomsdNetwork healthrunning

This watches for network problems and helps apps pick the best connection.

Apple’s own description: “Symptom framework service daemon”/usr/libexec/symptomsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
syncdefaultsdiCloud settings syncrunning

iCloud is syncing your settings between your devices. It stops on its own.

Apple’s own description: “NSUbiquitousKeyValueStore”/System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
sysdiagnoseDiagnostics

macOS is gathering a big diagnostic report, usually because someone asked for one. It stops when it's done.

Apple’s own description: “gathers system-wide diagnostic information helpful in investigating system performance issues”/usr/bin/sysdiagnose · signed by Apple
Let it finishStops on its own
sysextdSystem extensions

This installs and manages system extensions, like drivers and security tools.

Apple’s own description: “system extension manager”/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
syslogdSystem logrunning

This keeps older-style system logs.

Apple’s own description: “Apple System Log server”/usr/sbin/syslogd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
sysmondActivity numbersrunning

This collects the numbers that Activity Monitor shows.

Apple’s own description: “system monitor daemon”/usr/libexec/sysmond · signed by Apple · starts when macOS needs it
Leave itPart of macOS
syspolicydApp security checkrunning

macOS is checking that an app you opened is safe. It stops on its own.

Apple’s own description: “System Policy daemon”/usr/libexec/syspolicyd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
system_installdInstallingrunning

macOS is installing software, like an update or an installer package. It stops when it's done.

Apple’s own description: “macOS software installation daemon”/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
systemstatsBattery historyrunning

This records battery and energy use for the Battery settings.

Apple’s own description: “summarize system stats”/usr/sbin/systemstats · signed by Apple · starts when macOS needs it
Leave itPart of macOS
systemstatusdStatus iconsrunning

This shows the camera and microphone dots and other status icons in the menu bar.

/System/Library/PrivateFrameworks/SystemStatusServer.framework/Support/systemstatusd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
SystemUIServerMenu barrunning

This draws parts of the menu bar at the top of your screen.

Apple’s own description: “Presents status items in the upper right of menu bar”/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer · signed by Apple · starts when macOS needs it
Leave itPart of macOS
tailspindSlowdown report

macOS is saving a record of a recent slowdown so it can be looked at later. It stops on its own.

Apple’s own description: “helper daemon for tailspin(1)”/usr/libexec/tailspind · signed by Apple · starts when macOS needs it
Let it finishStops on its own
talagentdWindow restorerunning

This reopens your windows when apps or your Mac restart.

Apple’s own description: “helper agent for application lifecycle features”/System/Library/CoreServices/talagentd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
taskgatedDeveloper permissionsrunning

This decides which programs may inspect other programs, which developer tools need.

Apple’s own description: “task_for_pid access control daemon taskgated is a system daemon that implements a policy for the task_for_pid system service. When the kernel is asked for the task port of a process, and preliminary access control checks pass, it invokes this daemon (via launchd) to make the”/usr/libexec/taskgated · signed by Apple · starts when macOS needs it
Leave itPart of macOS
tccdPrivacy permissionsrunning

This remembers which apps you've allowed to use your camera, microphone, files and more.

/System/Library/PrivateFrameworks/TCC.framework/Support/tccd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
TextInputMenuAgentKeyboard menurunning

This shows the keyboard and input menu.

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
thermalmonitordHeat monitorrunning

This watches your Mac's temperature and tells it to slow down when it's too hot.

/usr/libexec/thermalmonitord · signed by Apple · starts when macOS needs it
Leave itPart of macOS
timedClockrunning

This keeps your Mac's clock accurate.

Apple’s own description: “time synchronization daemon”/usr/libexec/timed · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
tipsdTipsrunning

This checks for new tips for the Tips app. It's normally quiet.

/usr/libexec/tipsd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
translationdTranslation

This translates text on your Mac, for the Translate app and apps that use it. It stops when it's done.

Apple’s own description: “Daemon that enables Translation features”/System/Library/Frameworks/Translation.framework/translationd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
trialdFeature updatesrunning

This downloads small updates to how some macOS features work. It's normally quiet.

/usr/libexec/triald · signed by Apple · starts when macOS needs it
Let it finishStops on its own
trustdSecurity checkrunning

macOS is checking that websites and apps are who they say they are. It stops on its own.

Apple’s own description: “Daemon and LaunchAgent that performs trust evaluations”/usr/libexec/trustd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
tvremotedRemote control

This lets an Apple TV remote or your iPhone control your Mac.

Apple’s own description: “Apple TV Remote services daemon”/usr/libexec/tvremoted · signed by Apple · starts when macOS needs it
Leave itPart of macOS
UIKitSystemiPhone and iPad appsrunning

This helps iPhone and iPad apps run on your Mac.

/System/Library/CoreServices/UIKitSystem.app/Contents/MacOS/UIKitSystem · signed by Apple · starts when macOS needs it
Leave itPart of macOS
universalaccessdAccessibilityrunning

This runs accessibility features like Zoom and VoiceOver settings.

Apple’s own description: “universal access server”/usr/sbin/universalaccessd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
UniversalControlUniversal Control

This lets you use one keyboard and mouse across your Mac and iPad.

Apple’s own description: “Universal Control”/System/Library/CoreServices/UniversalControl.app/Contents/MacOS/UniversalControl · signed by Apple · starts when macOS needs it
Leave itPart of macOS
UsageTrackingAgentScreen Time

This counts how long you use apps and websites, for Screen Time.

Apple’s own description: “Usage Tracking Agent”/System/Library/PrivateFrameworks/UsageTracking.framework/Versions/A/UsageTrackingAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
usbaudiodUSB soundrunning

This runs USB speakers, headsets and microphones.

Apple’s own description: “usbaudiod is a system daemon that runs the USB audio driver”/System/Library/Audio/Plug-Ins/usbaudio.bundle/Contents/MacOS/usbaudiod · signed by Apple · starts when macOS needs it
Leave itPart of macOS
usbmuxdiPhone connectionrunning

This talks to an iPhone or iPad connected by cable.

Apple’s own description: “iOS communications daemon”/System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
useractivitydHandoffrunning

This passes what you're doing to your other Apple devices, for Handoff.

/System/Library/PrivateFrameworks/UserActivity.framework/Agents/useractivityd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
UserEventAgentBackground eventsrunning

This reacts to things like plugging in a device or changing networks.

Apple’s own description: “high-level system event handler”/usr/libexec/UserEventAgent · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
UserFontManagerFonts

This manages the fonts on your Mac. It can get busy after you install fonts, then settles.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
usermanagerdUser accountsrunning

This manages the user accounts on your Mac.

/usr/libexec/usermanagerd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
usernotedNotificationsrunning

This delivers notifications from your apps.

Apple’s own description: “Notification Center daemon”/usr/sbin/usernoted · signed by Apple · macOS restarts it the moment it quits
Leave itPart of macOS
UserNotificationCenterNotification alertsrunning

This shows alert-style notifications and system messages.

/System/Library/CoreServices/UserNotificationCenter.app/Contents/MacOS/UserNotificationCenter · signed by Apple · starts when macOS needs it
Leave itPart of macOS
usernotificationsdNotificationsrunning

This manages notifications from your apps.

/System/Library/PrivateFrameworks/UserNotificationsCore.framework/Support/usernotificationsd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
UVCAssistantCamerarunning

This runs your camera for an app that's using it. It stops when you close the video call.

/System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/UVCAssistant.systemextension/Contents/MacOS/UVCAssistant · signed by Apple · starts when macOS needs it
Let it finishStops on its own
ViewBridgeAuxiliaryApp windows helperrunning

This helps apps show parts of macOS inside their windows.

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary · signed by Apple · started by the app or feature that uses it
Leave itPart of macOS
voicebankingdPersonal Voice

This runs Personal Voice, which lets your Mac speak in your own voice.

/System/Library/PrivateFrameworks/TextToSpeechVoiceBankingSupport.framework/Support/voicebankingd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
VoiceOverVoiceOver

This is VoiceOver, which reads your screen out loud.

/System/Library/CoreServices/VoiceOver.app/Contents/MacOS/VoiceOver · signed by Apple · starts when macOS needs it
Leave itPart of macOS
VTDecoderXPCServiceVideo playbackrunning

This plays video for an app. It stops when the video stops.

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
VTEncoderXPCServiceVideo export

This turns video into a file when an app records, exports or shares video. It stops when that's done.

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTEncoderXPCService.xpc/Contents/MacOS/VTEncoderXPCService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
WallpaperAerialsExtensionMoving wallpaperrunning

Your moving wallpaper is playing. Picking a still wallpaper stops it.

/System/Library/ExtensionKit/Extensions/WallpaperAerialsExtension.appex/Contents/MacOS/WallpaperAerialsExtension · signed by Apple
Let it finishStops on its own
WallpaperAgentWallpaperrunning

This changes and draws your wallpaper.

/System/Library/CoreServices/WallpaperAgent.app/Contents/MacOS/WallpaperAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
watchdogdFreeze detectorrunning

This checks that macOS is still responding.

Apple’s own description: “watchdog daemon”/usr/libexec/watchdogd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
webbookmarksdSafari bookmarks

This saves and syncs your Safari bookmarks. It stops on its own.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Let it finishStops on its own
WiFiAgentWi-Firunning

This shows Wi-Fi networks and Wi-Fi messages.

Apple’s own description: “Wi-Fi User agent”/System/Library/CoreServices/WiFiAgent.app/Contents/MacOS/WiFiAgent · signed by Apple · starts when macOS needs it
Leave itPart of macOS
wifianalyticsdWi-Fi quality check

This measures how well your Wi-Fi is working. It's normally quiet.

/usr/libexec/wifianalyticsd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
wifip2pdAirDrop Wi-Firunning

This lets your Mac connect straight to nearby devices over Wi-Fi, for AirDrop and Sidecar.

Apple’s own description: “Daemon responsible for managing peer-to-peer Wi-Fi discovery and data links”/usr/libexec/wifip2pd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
wifivelocitydWi-Fi diagnosticsrunning

This collects Wi-Fi problem reports when something asks for them. It stops on its own.

Apple’s own description: “launchd daemon for the WiFiVelocity framework”/usr/libexec/wifivelocityd · signed by Apple · starts when macOS needs it
Let it finishStops on its own
WindowManagerStage Managerrunning

This arranges your windows, for Stage Manager and window tiling.

/System/Library/CoreServices/WindowManager.app/Contents/MacOS/WindowManager · signed by Apple · starts when macOS needs it
Leave itPart of macOS
WindowServerYour screenrunning

This draws everything on your screen. Closing it would log you out.

Apple’s own description: “Window management, compositing, and event routing daemon”/System/Library/PrivateFrameworks/SkyLight.framework/Resources/WindowServer · signed by Apple · starts when macOS needs it
Leave itPart of macOS
WirelessRadioManagerdWirelessrunning

This keeps Wi-Fi and Bluetooth from getting in each other's way.

Apple’s own description: “Wireless Radio Manager daemon”/usr/sbin/WirelessRadioManagerd · signed by Apple · starts when macOS needs it
Leave itPart of macOS
xpcproxyApp launcher

This starts small helper programs for apps. Each one only runs for a moment.

Apple’s own description: “configures the execution environment for XPC services”/usr/libexec/xpcproxy · signed by Apple
Leave itPart of macOS
XProtectMalware check

macOS is checking your apps for malware. It stops on its own.

/System/Library/Templates/Data/Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/XProtect · signed by Apple · starts when macOS needs it
Let it finishStops on its own
XProtectBridgeServiceMalware checkrunning

macOS is checking your apps for malware. It stops on its own.

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XProtectBridgeService.xpc/Contents/MacOS/XProtectBridgeService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
xprotectdMalware checkrunning

macOS is checking your apps for malware. It stops on its own.

Apple’s own description: “XProtect Daemon”/usr/libexec/xprotectd · signed by Apple · macOS restarts it the moment it quits
Let it finishStops on its own
XprotectServiceMalware check

macOS is checking your apps for malware. It stops on its own.

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService · signed by Apple · started by the app or feature that uses it
Let it finishStops on its own
zshTerminalrunning

This runs the commands you type in a Terminal window.

Apple’s own description: “the Z shell”/bin/zsh · signed by Apple
Leave itPart of macOS
-zshTerminalrunning

This runs the commands you type in a Terminal window.

Not on our macOS 27.0.1 test Mac; older versions and other setups run it.
Leave itPart of macOS

Get the data: CSV · JSON. Reuse it under CC BY 4.0 with a link to this page. Every row has its own link, so you can point someone straight at one process.

Which Mac processes can I safely quit?

You can safely quit apps you opened yourself, and their helper processes. Leave the processes that belong to macOS alone: the ones marked Let it finish stop by themselves, and the ones marked Leave it come straight back or take a feature down with them. Apple’s own definition is a good starting point:

Processes are programs running on your Mac. Processes can be apps, system apps used by macOS, or invisible background processes.

What you seeExampleQuit it?
An app you openedSafari, Slack, PhotoshopYes. Use Quit (⌘ Command + Q) before Force Quit, so it can save.
A helper of that appGoogle Chrome Helper (Renderer), com.apple.WebKit.WebContentYes. It closes or reloads one tab or window.
Apple process marked Let it finishmds_stores, mediaanalysisd, softwareupdatedNo need. It stops when its job is done, and quitting it only restarts the job later.
Apple process marked Leave ittrustd, coreaudiod, bluetoothdNo. macOS needs it, and most come straight back.
The two you must never quitWindowServer, loginwindowNever. Quitting either one logs you out and closes every app.

Not sure which kind you are looking at? Apple processes live in the system folders: on our test Mac, every one of the 343 files we found sat under /System, /usr, /bin or /sbin. An app you installed lives in /Applications or in your home folder.

What happens if you quit a macOS background process?

If you quit a macOS background process, macOS usually starts a new copy within a second, so nothing is gained. The first process macOS starts, launchd, starts most of the others and watches them. We matched every process in this list to the 921 launchd job files on our test Mac. For 29 of them the job file says KeepAlive, which tells launchd to start a new copy the moment the old one exits:

This optional key is used to control whether your job is to be kept continuously running or to let demand and conditions control the invocation. The default is false and therefore only demand will start the job.

What happens when you quit a macOS background process A background process is asked to quit and exits. launchd, which started it, sees it exit and starts a new copy. On our test Mac the new copy was running 0.1 seconds later. AirPlayUIAgent PID 2214 is asked to quit. The process exits. launchd process 1, started first reads the job’s plist: KeepAlive = true AirPlayUIAgent New PID 22974, running 0.1 s later exit noticed new copy started
Measured on our test Mac: we asked AirPlayUIAgent to quit, and launchd had a new copy running 0.1 seconds later. TextInputMenuAgent came back just as fast.

We tested it. On 7 October 2026 we quit two of those 29, AirPlayUIAgent and TextInputMenuAgent, from Terminal with kill, which sends the standard request to quit. Both were running again under new process IDs about 0.1 seconds later. Another 266 processes in this list start on demand: they stay gone only until something in macOS asks for them, which for Spotlight, iCloud or Wi-Fi is usually within seconds. 34 more are XPC services that an app or system feature starts when it needs them.

How macOS starts the 369 processes in this list
  1. starts when needed266
  2. started by its app (XPC)34
  3. restarted at once (KeepAlive)29
  4. started another way14
  5. not on macOS 27.0.126

Source: the 921 launchd job files on our test Mac, matched to each process’s executable on 7 October 2026.

Quitting is not harmless either. Quit WindowServer or loginwindow and you are logged out. Quit coreaudiod and sound drops out until it restarts. Quit mds_stores halfway through indexing and Spotlight starts that work again later. The fix for a busy Apple process is almost always time, or removing the cause: an app, a sync or a display setting.

Which background processes use the most CPU and memory?

On our Mac, WindowServer was the busiest Apple process by a wide margin, averaging 41.8% of one CPU core over 20 minutes of normal work, with peaks of 50.3%. The rest of macOS was quiet most of the time. Spotlight’s worker processes averaged 7.9% but jumped to 79.0% in a single sample, which is how indexing looks: short bursts, then nothing. airportd, which runs Wi-Fi, did the same: it sat at zero for most of the 20 minutes, then went above one full core (108.8%) in a single sample.

Busiest Apple background processes on our Mac, average CPU over 20 minutes
  1. WindowServer41.8%
  2. mdworker_shared7.9%
  3. mds_stores4.0%
  4. airportd3.4%
  5. opendirectoryd3.3%
  6. usbaudiod1.9%
  7. syspolicyd1.8%
  8. Finder1.4%
  9. SystemUIServer1.3%
  10. coreaudiod1.3%

40 samples, 30 seconds apart, during normal work on the Apple M1 Pro Mac, with two external 1080p displays connected and the built-in screen mirroring one of them. 100% is one full CPU core; this Mac has 8 cores (6 performance, 2 efficiency). Copies of the same process are added together.

Apple background processes holding the most memory on our Mac
  1. VTDecoderXPCService642 MB
  2. WindowServer560 MB
  3. WiFiAgent489 MB
  4. Finder262 MB
  5. chronod248 MB
  6. cron190 MB
  7. ControlCenter125 MB
  8. com.apple.cmio.registerassistantservice75 MB
  9. QuickLookUIService72 MB
  10. loginwindow69 MB

Average memory over the same 20 minutes, read the way Activity Monitor’s Memory column counts it. Copies of the same process are added together.

The reason most of this stays out of your way: on Apple silicon, macOS keeps low-priority background work on the efficiency cores. As Howard Oakley puts it in his explainer on E cores, “background threads aren’t normally allowed to run on P cores, even if they’re delayed by the load on the E cores they’re restricted to.” Indexing or photo analysis can look busy in Activity Monitor and still leave the app you are using untouched.

Several of the biggest memory numbers were not what they seemed. WiFiAgent showed 489 MB in the Memory column, chronod, which keeps widgets up to date, 248 MB and cron 190 MB, all steady across every sample on a Mac that had gone six days without a restart. A closer look with top showed more than 95% of each was compressed, and none was actively using more than 22 MB. That is memory a process holds but has not touched for a while, which macOS packs down or moves to disk to make room. It costs less than the number suggests, and it is handed back when the process restarts. Restarting the Mac restarts all of them at once. VTDecoderXPCService, which plays video for apps, was the exception: almost none of its 642 MB was compressed.

Two things to take from this. First, a single snapshot in Activity Monitor lies: a process at 80% for ten seconds is normal, the same process at 80% for an hour is not. Sort by % CPU, wait a minute, and look again before you act. Second, memory figures in the hundreds of megabytes for WindowServer and video helpers are ordinary on a Mac with large or several displays. Watch the Memory Pressure graph instead, as our RAM usage guide explains, and use the CPU usage guide to tell a busy Mac from a stuck one.

What is WindowServer, and why is it using so much CPU?

WindowServer draws everything you see: every window, the Dock, the menu bar, shadows, transparency and animations. Apple’s manual page calls it the “window management, compositing, and event routing daemon”. It gets busier with more displays, higher resolutions, more open windows and anything that redraws constantly, such as a video, an animated web page or a screen recording. On our test Mac it averaged 41.8% of a core and held 560 MB of memory.

Activity Monitor CPU tab on our macOS 27 test Mac with kernel_task and WindowServer near the top of the list
WindowServer and kernel_task near the top of Activity Monitor’s CPU tab on our test Mac. Both are normal there, and neither should be quit.

To bring it down: close windows and browser tabs you are not using, unplug a display you do not need, and in System Settings > Accessibility > Display turn on Reduce transparency and Reduce motion (Apple explains both). Do not quit it. Quitting WindowServer ends your login session and closes every open app without saving.

What is kernel_task, and why is it using so much CPU?

kernel_task is the core of macOS itself, so you cannot quit it and there is no file to find. When it shows high CPU, it is usually keeping your Mac cool by holding other processes back:

One of the functions of kernel_task is to help manage CPU temperature by making the CPU less available to processes that are using it intensely.

Apple adds that kernel_task responds to heat “even if your Mac doesn’t feel hot to you”, and backs off when the temperature drops. So the cause is whatever was heating the Mac: a heavy app, a blocked vent, a hot room or a charger that is working hard. In our Activity Monitor screenshot it sat at 42.7% of a core while the Mac as a whole was more than half idle, so nothing needed quitting. If it stays high, find the app above it in the CPU list and close that.

What are mds, mds_stores and mdworker_shared?

They are Spotlight, the Mac’s search, reading your files so it can find them later. mds is the metadata server, mds_stores writes the index, and the mdworker_shared processes read individual files. They are busiest after a macOS update, after you copy in a lot of files and on a new Mac, and they stop on their own. On our test Mac mds_stores averaged 4.0% with a peak of 52.8%. If Spotlight is still busy a day later, or search stops finding things, Apple’s fix is to rebuild the index (Apple’s steps). Howard Oakley’s explainer on Spotlight indexing goes deeper into how the indexing runs in the background.

What are mediaanalysisd and photoanalysisd?

Both scan your photos and videos on the Mac itself, so Photos can find people, places, pets and text, and build Memories. photoanalysisd is “the macOS photo library analysis agent”, in Apple’s words, and mediaanalysisd does the same kind of work for search and Live Text. They run hardest after you import a big library or turn on iCloud Photos, mostly while the Mac is idle and plugged in, and they settle when the library is done. Leaving the Mac awake and charging overnight is the fastest way through it.

What are cloudd, bird, fileproviderd and nsurlsessiond?

They move your data. cloudd syncs iCloud data for apps, bird and fileproviderd keep iCloud Drive and folders such as Dropbox or Google Drive in step, and nsurlsessiond runs downloads in the background for macOS and apps. All four are marked Let it finish: they are busy while something is uploading or downloading and quiet afterwards. If one stays busy for hours, look for a sync that keeps restarting, such as a huge file that keeps changing or a cloud folder that is nearly full.

Is a Mac process a virus? How to check it is really Apple’s

A process with an odd name is almost always Apple’s, and you can prove it in one command. Apple signs every file it ships, and the system folders are sealed: Apple’s security guide says the signed system volume “verifies the integrity of the system content at runtime” and rejects anything without Apple’s signature (Apple Platform Security). We ran the check below on every process in this list. All 342 files we could read are signed by Apple; the one exception, cupsd, can only be read by the system itself.

Terminal
codesign -dvv /usr/libexec/trustd 2>&1 | grep Authority
Authority=macOS Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Real output from our macOS 27.0.1 test Mac. To check any process, find its path in Activity Monitor (double-click it, then Open Files and Ports) or in the list above. Command reference: SS64 codesign.

Three signs that a process is not Apple’s: it runs from your home folder, /tmp or /Users/Shared; its name imitates an Apple one with a small change; or codesign shows a developer you do not recognise, or no signature at all. macOS also scans for known malware by itself with XProtect, which Apple describes in its malware protection guide.

How we checked this list

The descriptions are written in plain English for people who do not live in Terminal, and every line was written and checked by hand. Then we tested every entry against a real Mac on 7 October 2026:

  • Test Mac: Apple M1 Pro MacBook Pro with 16 GB of memory, macOS 27.0.1 (build 26A434), in daily use.
  • Files: we searched the system folders for each process and found 343 of the 369. The other 25 are not on macOS 27.0.1 (older versions, or Macs with other hardware or features, still run them), and kernel_task is the kernel itself.
  • Signatures: codesign on every file found: 342 signed by Apple, 1 readable only by the system.
  • How each one starts: we read all 921 launchd job files in the system folders and matched them to each executable.
  • Apple’s own words: 195 processes have a manual page with a one-line description, quoted in the list.
  • CPU and memory: we sampled every process every 30 seconds for 20 minutes (40 samples) while the Mac was in normal use, and kept only the Apple processes in this list.
  • Restart test: we quit two processes that launchd keeps alive and timed how long the new copy took to appear.

We recheck the list after each major macOS update. If you see a process that is missing, the about page explains who writes this site and how to reach us.

Frequently asked questions

How do I list all processes in macOS?

Open Activity Monitor and choose View, then All Processes. In Terminal, ps -ax prints every process and top shows a live list sorted by CPU. Our test Mac had 600 processes running at once, which is normal.

What processes should be running on my Mac?

Hundreds, and most belong to macOS. Apple processes live under /System, /usr, /bin or /sbin and are signed by Apple. Anything you do not recognise can be looked up in the list on this page.

How do I turn off background processes on my Mac?

For apps, open System Settings, then General, then Login Items and Extensions, and switch off the apps you do not need at login. Apple's own background processes cannot be switched off this way, and quitting them only makes macOS start them again.

How do I check what is slowing down my Mac?

Open Activity Monitor, click CPU and sort by % CPU, then click Memory and check the Memory Pressure graph. An app you opened at the top for minutes is the usual cause; a busy Apple process such as mds_stores usually finishes on its own.

Is it safe to quit WindowServer on a Mac?

No. WindowServer draws everything on screen, and quitting it logs you out and closes every open app without saving. Reduce its load by closing windows, unplugging a display you do not need, or turning on Reduce transparency.

Can I quit kernel_task?

No. kernel_task is the macOS kernel. High CPU from kernel_task usually means it is holding other processes back to keep the Mac cool, so find and close the app that is heating it.

Why does a process I quit keep coming back?

Because launchd restarts it. Many Apple processes are marked KeepAlive or start on demand, so macOS starts a new copy as soon as the old one exits or as soon as something needs it. On our test Mac that took about 0.1 seconds.

How do I get memory back on my Mac?

Quit apps you are not using, close browser tabs, and restart the Mac if it has been on for weeks. Do not quit Apple background processes to save memory; macOS manages their memory itself and restarts them.

Portrait of Junaid Khalid
Written and tested by
Junaid Khalid

Junaid is a software engineer who builds native macOS apps, which means he spends his days inside Activity Monitor, Instruments and the Terminal watching how Mac apps use CPU and memory. Before that he worked as an L2 technical support consultant, resolving around 500 escalated customer tickets with a satisfaction score above 95%. He holds a BSc in Software Engineering from NUST. Every step on this site is re-run on a real Mac before it is published.

Sources

  1. Apple: View information about Mac processes in Activity Monitor
  2. Apple Support: If kernel_task is using a large percentage of your Mac CPU
  3. Apple Support: Rebuild the Spotlight index on your Mac
  4. The Eclectic Light Company: In the background, Spotlight indexing
  5. The Eclectic Light Company: Why E cores make Apple silicon fast
  6. launchd.plist manual page (KeepAlive, ProcessType)
  7. Apple Developer: Creating Launch Daemons and Agents
  8. Wikipedia: launchd
  9. Apple Platform Security: Signed system volume security
  10. Apple Platform Security: Protecting against malware in macOS
  11. SS64: codesign command for macOS
  12. Apple: Reduce onscreen motion and transparency on Mac
  13. Apple: Change Login Items and Extensions settings on Mac