Managing Login Items and Background Agents on a Mac

7 Sep 2026

A Mac can feel slow before you have opened a single application.

You sign in and immediately hear the fans, see several icons appear in the menu bar, receive repeated permission alerts or wait while cloud storage, update tools and device utilities launch themselves. Battery life may suffer, applications can conflict, and shutdown or restart may take longer than expected.

The cause is often a collection of login items and background agents.

Some are useful and necessary. Others were installed by applications you no longer use, or they run continuously despite providing little benefit. The aim is not to disable everything—it is to identify what each item does and allow only the software you genuinely need.

What Is a Login Item?

A login item is an application, document, server connection or other item configured to open when a user signs into macOS.

Common examples include:

Microsoft Teams
OneDrive
Dropbox
Password managers
VPN clients
Printer utilities
Music applications
Clipboard managers
Window-management tools
Hardware-control software

You can view and manage these from:

Apple menu > System Settings > General > Login Items & Extensions

Apple uses this section to control items that open at login and applications permitted to continue working in the background.

What Is a Background Agent?

A background agent is a process that can perform work even when the main application window is closed.

It may:

Check for updates
Synchronise files
Monitor a connected device
Maintain a VPN or security connection
Receive notifications
Index application data
Support menu-bar controls
Run backups
Manage licences
Start helper services

On modern macOS versions, many registered background tasks appear under Allow in the Background in Login Items & Extensions settings.

On macOS 26 and later, Apple says users can be prompted when an application starts a background task that remains active after the main app has been quit.

Login Items and Background Agents Are Not the Same

A login item normally launches something visible when you sign in.

For example:

OneDrive opens and displays its menu-bar icon.

A background agent may run without opening a normal window.

For example:

A printer utility checks for connected devices in the background.

Some applications use both:

A visible login item
A background helper
A system extension
A menu-bar application
A launch agent or daemon

This is why disabling one visible startup application may not stop every related process.

Why Too Many Startup Items Matter

A long startup list can contribute to:

Slow sign-in
High CPU usage
Increased memory use
Reduced battery life
Constant network traffic
Menu-bar clutter
Application conflicts
Delayed shutdown
Repeated permission prompts
Fans running shortly after login

However, disabling every item is not automatically beneficial.

Some background components are required for:

Endpoint security
Cloud file synchronisation
Backups
VPN connectivity
Password management
Remote support
Accessibility tools
Hardware drivers
Business device management

The correct approach is selective review rather than blanket removal.

Open Login Items & Extensions

Go to:

Apple menu > System Settings > General > Login Items & Extensions

You will normally see sections such as:

Open at Login

These items open automatically when the current user signs in.

Allow in the Background

These applications are permitted to perform tasks when their main windows are not open.

Extensions

This area may include categories for:

Finder extensions
Network extensions
Sharing
Quick Look
File providers
Drivers
Endpoint security
Actions and other integrations

The exact options depend on the installed version of macOS and the software present on the Mac. Apple also directs some system-extension approvals to Login Items & Extensions on macOS Sequoia 15 and later.

Review “Open at Login”

Begin with the visible login items.

Ask whether each application genuinely needs to launch every time you sign in.

An item may reasonably remain enabled when:

You use it throughout the day
It must be available immediately
It provides essential accessibility features
It manages required business connectivity
It protects or backs up the Mac
It synchronises important working files

An item may be a candidate for removal when:

You rarely use it
You can open it manually when needed
It belongs to an old application
It creates an unnecessary menu-bar icon
It consumes noticeable resources
You do not recognise it

To remove an item:

Select it under Open at Login.
Click the minus button.
Restart or sign out and back in to test the change.

Removing an item from this list does not uninstall the application.

Add an Application to Open at Login

To add a trusted application:

Open Login Items & Extensions.
Under Open at Login, click the plus button.
Select the application, file, folder or supported item.
Click Open.

Apple confirms that applications, documents, folders and server connections can be configured to open automatically when a user logs in.

Only add items that benefit from being available at every login.

Review “Allow in the Background”

This section deserves more care.

Turning off a background item may prevent an application from:

Checking for updates
Synchronising files
Receiving calls or messages
Detecting connected hardware
Applying security protection
Maintaining a network tunnel
Running scheduled backups

Before disabling one, identify the publisher and its associated application.

Useful questions include:

Do I still have this application installed?
Do I use its background feature?
Is it part of company security or management?
Does the item return after I disable it?
Is it consuming significant CPU, memory or network data?
Does the application continue to work without it?

On modern macOS, selecting the information button beside a registered background item can provide more detail about what is being launched.

Do Not Disable Unfamiliar Business Agents

On a company Mac, apparently obscure items may belong to:

Microsoft Intune
Endpoint detection and response
Content filtering
Backup software
Remote monitoring
VPN enforcement
Compliance checks
Patch management
Device inventory
Data-loss prevention

Disabling these can make the Mac non-compliant or leave it unprotected.

If the Mac is managed, ask the IT provider before changing items you do not recognise.

Apple supports centrally managed login and background items through device-management profiles, so some entries may be intentionally controlled by the organisation.

How to Identify an Unknown Item

An unfamiliar name is not automatically suspicious.

Try these checks:

Look at the publisher

The entry may show the application or developer responsible.

Click the information button

Where available, macOS may display details about the registered background component.

Search the Applications folder

Look for a matching application in:

Finder > Applications

Check Activity Monitor

Open:

Applications > Utilities > Activity Monitor

Search for the process name and inspect:

CPU use
Memory use
Energy impact
Open files and ports
Parent process
User account

Check the file location

In Activity Monitor, select the process and use the information window to review its path where available.

Typical legitimate locations include:

/Applications

/Library

~/Library

A process running from Downloads, a temporary directory or an unusually named hidden folder deserves closer investigation.

Use Activity Monitor to Find Heavy Startup Software

If the Mac becomes slow shortly after sign-in:

Restart the Mac.
Sign in.
Do not open other applications.
Open Activity Monitor.
Select the CPU tab.
Sort by % CPU.
Check Memory, Energy, Disk and Network as well.

Look for processes that remain unusually active for several minutes.

Some legitimate tasks—such as cloud synchronisation, Spotlight indexing or antivirus scanning—may use substantial resources temporarily.

The important question is whether the activity eventually settles and whether it matches a service you need.

Test by Disabling Items in Groups

When there are many login items, disabling them one at a time can be slow.

A faster approach is controlled elimination:

Record the current list.
Disable half of the non-essential login items.
Restart and test.
If the problem disappears, the cause is probably in the disabled half.
Re-enable half of that group.
Repeat until one item is identified.

Apple recommends removing login items and adding them back individually to isolate an item responsible for startup problems.

Keep background security and business-management tools enabled unless their removal has been approved.

Hold Shift to Prevent Reopening Windows

Sometimes the items appearing after login are not traditional login items. macOS may be reopening applications and windows from the previous session.

When restarting or shutting down, clear:

Reopen windows when logging back in

You can also hold Shift while opening an application to prevent it from restoring its previous windows. Apple recommends checking application reopening behaviour separately from ordinary login-item configuration.

This distinction matters because removing a login item will not stop macOS from restoring an application saved from the previous session.

Check the Application’s Own Settings

Many applications provide their own startup switch, often labelled:

Launch at login
Open at startup
Start automatically
Run in background
Keep helper running
Start when my Mac starts

Turn off the setting inside the application where possible.

This is often cleaner than removing the entry only through System Settings because the application may otherwise recreate it during an update or next launch.

Why a Disabled Item May Return

A login or background item may reappear because:

The application was opened again
Its own launch-at-login setting remains enabled
The app was updated
A helper tool was reinstalled
Device management reapplied it
The application repairs its startup registration
Another related component adds it back

Check the application’s preferences and confirm whether the Mac is managed before repeatedly removing the item.

Menu-Bar Applications

Many login items exist mainly to place an icon in the menu bar.

Examples include:

Cloud storage
Screen-capture utilities
Password managers
Display controls
Clipboard tools
Audio utilities
Hardware monitors

A menu-bar icon can be useful without needing to open a larger application window.

Before disabling it, check whether the menu-bar tool provides a core function you use.

For example, removing a cloud-storage menu-bar application may stop or delay file synchronisation.

Extensions Need Separate Review

Extensions allow applications to integrate more deeply with macOS.

Examples include:

Finder sync badges
Network filtering
File-provider services
Quick Look previews
Sharing options
Endpoint security
Driver extensions

An application may be removed from Open at Login but retain an enabled extension.

Review the Extensions area under Login Items & Extensions and disable only integrations you understand.

Apple directs users to this section for categories such as Finder and sharing extensions, and on current macOS releases it may also contain system-extension controls.

Finder Extensions

Cloud-storage and document-management applications often install Finder extensions to provide:

Sync-status icons
Context-menu actions
Share commands
Version controls
Online-only file options

If Finder becomes slow or repeatedly crashes, temporarily disabling non-essential Finder extensions can help identify the cause.

Do not disable the file-provider extension of a cloud service without checking how it stores local and online-only files.

Network and Security Extensions

VPN clients, web filters and endpoint-security applications may use network extensions.

Disabling one can affect:

Internet access
Corporate VPN connections
Web filtering
Malware protection
Content inspection
Access to internal services

On an organisation-owned Mac, these settings may be locked or automatically reapplied.

Do not lower startup security or approve old kernel extensions merely to keep unsupported software running. Apple’s current guidance notes that some older extensions may require reduced security on Apple silicon, which should only be considered when the software is trusted and genuinely necessary.

What Are Launch Agents and Launch Daemons?

Behind the graphical settings, macOS uses launchd to start and supervise many background processes.

Third-party software may install:

User Launch Agents

Usually stored under:

~/Library/LaunchAgents

These normally run for one user after login.

System-Wide Launch Agents

Often stored under:

/Library/LaunchAgents

These can run for users across the Mac.

Launch Daemons

Often stored under:

/Library/LaunchDaemons

These normally run at the system level, sometimes before a user signs in.

Files in these folders are commonly property-list files ending in:

.plist

Do not delete them merely because they look unfamiliar.

Avoid Manually Deleting Agents as a First Step

Removing a .plist from a LaunchAgents or LaunchDaemons folder can:

Break an application
Stop security software
Disable backups
Leave orphaned helper files
Cause repeated error messages
Be undone by the next update
Create permission problems

The safer sequence is:

Disable the feature in the application.
Use Login Items & Extensions.
Update or repair the application.
Use the developer’s official uninstaller.
Remove leftover agents manually only after confirming exactly what they belong to.

A filename alone is not enough to determine whether an agent is safe to remove.

Uninstall the Parent Application Properly

If a background agent belongs to software you no longer use, uninstall the application rather than only disabling the helper.

Some Mac applications can be removed by dragging them to the Bin.

Others provide an uninstaller because they install:

Background agents
Privileged helpers
Drivers
Extensions
Licence services
Network filters

Use the developer’s supported removal method.

After uninstalling:

Restart the Mac.
Review Login Items & Extensions.
Check whether the background item remains.
Remove documented leftovers only where necessary.

Check for Malware or Unwanted Software

Suspicious startup items may indicate adware or malware.

Warning signs include:

Unknown items returning after removal
Random browser extensions
Search redirects
Fake security alerts
Processes with misleading system-style names
Background tasks running from temporary folders
High network activity while idle
Security settings changing without permission

Run a scan using the organisation’s approved security platform or a trusted Mac security product.

Do not install several antivirus products simultaneously. Competing real-time scanners can themselves cause high CPU use and startup delays.

Try Safe Mode

Safe Mode prevents or limits many third-party items from loading and performs basic system checks.

If the Mac behaves normally in Safe Mode, a login item, background extension or other startup software becomes a stronger suspect.

Apple silicon Mac

Shut down the Mac.
Press and hold the power button until startup options appear.
Select the startup disk.
Hold Shift.
Select Continue in Safe Mode.

Intel Mac

Restart the Mac.
Immediately hold Shift.
Release it when the login window appears.

Apple describes Safe Mode as a way to determine whether software loaded during startup is causing a problem.

Restart normally after testing.

Create a Test User Account

Create a temporary account from:

System Settings > Users & Groups

Sign into that account and observe startup performance.

If the Mac works normally there, the problem may involve:

User-specific login items
User LaunchAgents
Browser extensions
Menu-bar applications
User preferences
Application caches

If every user is affected, investigate system-wide agents, extensions, drivers or hardware.

Check Console for Repeated Background Errors

Open:

Applications > Utilities > Console

Search for the process or application name.

A faulty background agent may repeatedly log messages such as:

Permission denied
File not found
Authentication failed
Connection refused
Database locked
Helper crashed
Relaunching process

A process that continuously fails and restarts can consume CPU, disk and battery power.

Do not delete logs as the solution. Fix or remove the application generating them.

Advanced Inspection with Terminal

Administrators can inspect modern login and background task registrations with:

sfltool dumpbtm

Apple documents this command as a way to print the current state of login and background items, including registered service-management details.

The output is technical and may contain numerous legitimate entries.

Do not use reset commands simply to clean up the list. Apple also documents sfltool resetbtm for testing, but recommends restarting afterwards; it is intended for diagnostics rather than routine optimisation.

Do Not Use “Cleaner” Apps Blindly

Some cleaning utilities classify background agents as unnecessary without understanding their purpose.

They may remove:

Cloud-sync helpers
Security components
Printer software
Application licensing
VPN extensions
Backup agents

Review each recommendation manually.

A startup item is not harmful merely because it runs in the background.

When a Background Item Uses Too Much Battery

Open Activity Monitor and check the Energy tab.

Look for:

High Energy Impact
High 12 hr Power
Processes preventing sleep
Persistent CPU usage
Heavy network transfer

Then determine whether the task is temporary.

For example, high activity may be expected while:

OneDrive completes its first sync
Photos analyses a large library
Security software performs an initial scan
Backup software processes a new disk
An application installs an update

If it never settles, update, reconfigure or reinstall the responsible application.

When Login Items Delay Shutdown

An application may hold up shutdown while it:

Syncs data
Waits for a network service
Saves application state
Closes a database
Completes an update
Fails to terminate correctly

Quit the suspected application manually before shutting down.

If shutdown becomes immediate, update or repair that application.

Do not routinely force the Mac off, as this can interrupt file writes and increase the risk of corruption.

Managed Background Items

Businesses can approve, restrict or automatically configure login and background items through device management.

An organisation may use rules based on:

Bundle identifier
Bundle-identifier prefix
Team identifier
Service-management labels

Apple documents these controls for managing background tasks and suppressing repeated user alerts for approved applications.

Local changes may therefore be unavailable or may revert after a management-policy refresh.

A Sensible Review Process

Use this order:

Open Login Items & Extensions.
Record the current items.
Remove unnecessary applications from Open at Login.
Review each Allow in the Background entry.
Check the publisher and associated application.
Leave security, backup and management tools enabled.
Use Activity Monitor to identify heavy processes.
Disable non-essential items in controlled groups.
Restart after each meaningful change.
Review application-specific launch settings.
Inspect extensions separately.
Uninstall unwanted applications properly.
Test in Safe Mode if problems continue.
Test another user account.
Ask IT before altering managed items.
Use Terminal inspection only when normal settings are insufficient.

What Is Usually Safe to Disable?

After checking its purpose, you can often disable automatic startup for:

Applications you rarely use
Optional chat applications
Music players
Game launchers
Update helpers for non-essential software
Menu-bar tools you no longer need
Old printer utilities
Unused clipboard managers
Unnecessary cloud-storage clients
Software belonging to removed hardware

The application can usually still be opened manually.

What Should Usually Remain Enabled?

Do not disable without understanding the impact:

Antivirus or endpoint security
Backup software
Password managers you rely on
Required VPN clients
Accessibility tools
Business device-management agents
Cloud sync containing active work
Hardware drivers
Remote-support tools used by your IT provider
Encryption or data-protection software

The correct list depends on how the Mac is used.

Need Help Cleaning Up Mac Startup Items?

Too many login items and background agents can slow sign-in, drain the battery and create application conflicts. Removing the wrong agent can also disable backups, security, cloud synchronisation or business-management tools.

Hamilton Group can review your Mac’s startup processes, identify unwanted or faulty agents and optimise performance without removing essential protection.

Call 0330 043 0069 or visit hgmssp.com to speak with one of our IT experts.

Previous Next