Many apps have startup activities you can manage. This includes launching an app when you log in and components of apps launching to run in the background continuously. From a security perspective, you should know what’s launching and occasionally check to see whether anything new has appeared that you’re unaware of.
Login items
Apps can add themselves to a list of items that open when you log in to your account. You can also add items manually. This Login Items list is unique to the current user logged in. It’s located in System Settings > General > Login Items & Extensions.
Your Mac uses a notification to let you know whenever an app adds itself or a component to the Login Items list.
You can take several actions on the items in this list:
- Control-click/right-click: This reveals the Show in Finder option. Choose it, and the enclosing folder appears with the item selected.
- Remove: Select one or more apps and click the minus button to remove them. There’s no prompt—it just happens.
- Add: Click the plus button and then select one or more apps, documents, or network servers to open or mount at launch.
With Siri AI active in Golden Gate, the top item is Ask Siri, as with some other contextual menus, where you can ask or type in something like “What is Pastebot?” to know what a particular login item does or is. Unfortunately, you can’t just ask “What is this?” even though it’s on a contextual menu—Siri just replies with details about Login Items.
If you want to prevent all login items from launching, you can do so temporarily in one of two ways:
- With a required user login: On the login screen, hold down the Shift key when clicking the login button. Keep holding down Shift until you see the Dock appear.
- With an automatically logged-in user: Restart your Mac. Hold down the Shift key when the progress bar starts and release after you see the desktop appear.
Background activity
macOS also gives you insight into and control over components of apps that are set to run in the background. First, you’re alerted when an app installs them.
Then, you can find a list of these items in System Settings > General > Login Items & Extensions under the Background App Activity heading (or App Background Activity in Tahoe and earlier). The list provides additional information under each item that can be useful. In Golden Gate, the labels explain the item’s status, noting whether it is currently running in the background. If it ran in the background within the last week, the label notes how long ago that was.
In Tahoe, the label provided one of three pieces of information: how many components the background item represented (typically “1 item”), how many accounts it affected on multi-account Macs with an item breakdown (“5 items: 2 items affect all users” as one example), or whether it was from an unknown developer, typically the case when the app that installed it was no longer installed and the background item was orphaned.
Items that are installed without the full information required by Apple are shown with a magnifying glass button. Click it, and it opens the component in the system or user Library folder where it lives.
While you can’t remove background items via this interface, you can enable and disable them. When you disable background items, you’re prompted to authenticate with Touch ID or your password.
Launch components are divided into daemons, which run at system startup before an account login, and agents, which launch after login. They’re found in folders named LaunchAgents and LaunchDaemons in /System/Library/ and ~/Library/.
If you want more insight into and control over what’s automatically running on any release of macOS, do yourself a favor and get Lingon X. The app shows everything that launches automatically—apps, scripts, daemons, agents, and the like. A free version lets you view all that; paying $23.99 unlocks editing and saving.
Automatic login
When you set up a new Mac, one of the first things you are prompted to do is create a user account for yourself by picking a username and a password. (Your Mac can have many such accounts, but it must have at least one.) By default, macOS logs in that initial user account automatically when you turn on or restart your Mac. That means you can get right to work without entering a password, and it’s the most convenient arrangement for Macs with a single user—especially if the Mac is kept in a secure place.
However, if anyone else (including a thief!) can get to your Mac, that automatic login becomes a problem, because your keychain unlocks automatically (see how the Mac keychain works) and all the files on your Mac are readily available.
If there’s a risk of someone gaining access to your Mac, you should disable this option by selecting Off. It’s found in System Settings > Users & Groups as a pop-up menu next to “Automatically log in as.”
Automatic login is incompatible with the FileVault security model and can’t be enabled when FileVault is turned on, which is by default starting in macOS 26. See how to turn on FileVault.
Which apps are allowed to launch
Apple hides their powerful Gatekeeper technology behind a menu selection. Gatekeeper prevents malicious software from easily taking root on a Mac, even on a naïve user’s computer (not you, to be sure). You can find the setting “Allow applications downloaded from” in System Settings > Privacy & Security. The options are App Store & Known Developers (the default) and App Store, which is “App Store Only” but not labeled that way explicitly.
I recommend leaving App Store & Known Developers selected unless you’re setting up a computer for someone who needs more handholding and protection. For a full explanation of how Gatekeeper works, see how Gatekeeper decides which Mac apps can run.
Limiting your apps to the App Store may also be the right choice at a very high level of risk, where people or organizations may expend substantial resources to subvert someone’s computer. Few people fall into that category.
You can select a different option whenever you like, but it only affects apps launching after that point. Switch from App Store & Known Developers to App Store, and you can still launch any third-party apps you had previously run, but no new non-App Store apps will validate.
If you have the launch option set to App Store and attempt to mount a disk image with a third-party app, or open a downloaded third-party app or one copied from a disk image you’ve approved, a Mac first tells you why it can’t mount or launch it.
However, if you then return to the “Allow applications from” location in your version of macOS, you see a helpful Open Anyway button along with an explanation of why the app didn’t launch in the Finder. That’s a little informal, but it makes sense: you made this choice, so why not?
An administrative macOS user can lock settings to App Store here, and a regular macOS user won’t be able to override it. See how to set up safe user accounts on a shared Mac.
Manage system extensions
Apple lets developers extend the system with, er, the appropriately named system extensions, which run with relatively few privileges, but give developers controlled capabilities. Apple mediates access to system extensions through System Settings > Privacy & Security.
Up until a few years ago, Apple allowed a deeper way to modify core functions, but removed that method seemingly because of security concerns.
If you have no extensions installed and never install software that requires them, you will never see extra information there, and you don’t have to interact with those parts of the pane.
If you have an Apple silicon Mac, you’re blocked from using system extensions without first enabling Reduced Security for your system as described in how macOS protects its own system files. Read that first: the mode changes your Mac’s risk profile.
After you run the installer, a note appears with a button in System Settings > Privacy & Security. Click Details and you see a list of all system extensions.
Note that all the switches are disabled—you can’t take action here. Click OK, and, despite not seeming to have done anything, a system extensions cache rebuilding dialog appears. Finally, you’re typically prompted to restart in a non-modal dialog: you can’t opt out of restarting.
Because Apple requires no standard for removing a system extension, you could wind up with old ones littering your Mac and no sure way of what to do next. Sequoia added a distinct improvement in System Settings > General > Login Items & Extensions. You can view the list using By App or By Category. In both cases, the list mixes simpler macOS extenders (like additions to the contextual menu in the Finder or Quick Look) with system extensions. To disable an extension, click the info button for an app or a category, like Fantastical or Network Extensions, and then disable it.
However, if you want to uninstall a system extension, first choose By Category. Then, for a category with system extensions, like Camera Extensions, a More button appears for each item. Click that to reveal a menu from which you can choose Delete Extension. You’re warned when you disable or delete an extension that the extension may continue to operate until after a restart.
If you can’t find the item you’re looking for in that list, open Terminal and enter systemextensionsctl list and press Return.
The resulting output shows all system extensions and where you need to go to find them in the Extensions list. This list tells you exactly which Extensions category contains each component.
to find extensions’ configuration location.
Start by trying to find an app’s uninstaller or instruction on its website. Failing that, turn to Lingon X to dig out old agents, daemons, and extensions. It may not be able to help with all system extensions.
