If there's an app that starts up by itself, what would the most efficient places to look for it be? Does anyone have a nice comprehensive list of where to check for Startup Items, Login Items, Login Hooks, Cron, kernel extensions, etc…
At this point I forget where half of these folders/plist files are. I'm hoping someone has a cheatsheet they can share.
Basically I'm looking for a list of the most common places where Mac OS launches apps or scripts automatically (eg: at logon, or on a schedule, etc)
Best Answer
Apps that run on Startup:
/Library/StartupItems
- Standard Startup Items are found heresudo launchctl list
or look at/Library/LaunchDaemons
and/System/Library/LaunchDaemons
for launchd plists that are set to run without someone necessarily being logged in. Note: Some .plist files in the folders listed won't appear inlaunchctl list
as they are not loaded to run.Apps that run on User Login:
Check your Login Items by going to the Accounts Preference Pane in System Preferences.
Check out
~/Library/LaunchAgents
,/Library/LaunchAgents/
and/System/Library/LaunchAgents
for launchd .plists that run when a user is logged in - you can usesudo launchctl list
to see which ones are loaded.Apps that run on a schedule:
In Terminal:
crontab -e
will show what has been scheduled using cron to run items at certain times. Items in any of theLaunchAgents
orLaunchDaemons
folders may be set to run at intervals as well as defined in their .plist fileKernel Extensions
To see what Kernel extensions are loaded you can either user
Applications/Utilites/System Profiler.app
(can be opened quickly by holding option when clicking on the Apple menu - About This Mac... changes to System Profiler... in 10.5+)Alternatively you can run
kextstat
on the command line.Login/Logout Hooks
To find out if a Login or Logout Hook is installed and to find where the script file is you can run the following command:
defaults read com.apple.loginwindow LoginHook
anddefaults read com.apple.loginwindow LogoutHook
or to get both at the same time:
/usr/libexec/PlistBuddy -c Print /var/root/Library/Preferences/com.apple.loginwindow.plist | grep 'Hook'