{ "id": "d6be867d-9058-4358-bff2-b5550720fda6", "created_at": "2026-04-06T00:12:39.601885Z", "updated_at": "2026-04-10T03:20:16.599687Z", "deleted_at": null, "sha1_hash": "329be17dde6d0e38953667e40596efcc0a8a8058", "title": "Running at startup: when to use a Login Item or a LaunchAgent/LaunchDaemon", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 134287, "plain_text": "Running at startup: when to use a Login Item or a\r\nLaunchAgent/LaunchDaemon\r\nPublished: 2018-05-22 · Archived: 2026-04-05 23:03:10 UTC\r\nThere are two popular ways of getting software to run whenever your Mac starts up: it can be installed as a Login\r\nItem, or as a LaunchAgent or LaunchDaemon. This article looks at the differences between these mechanisms, so\r\nthat you can decide which to use in each case, understand what can go wrong with them, and how to fix them.\r\nlaunchd\r\nmacOS brought together the functions of a disparate group of Unix tools, including (x)inetd , init , and\r\nwatchdogd , in a single service manager launchd , which is controlled by launchctl . During startup, once the\r\nkernel is running and required kernel extensions have been loaded, launchd is run with the process ID of 1, and\r\nit remains running until your Mac shuts down again.\r\nBefore you have logged in, launchd runs services and other components which are specified in Property List\r\nfiles in the LaunchAgents and LaunchDaemons folders in /System/Library, and in /Library. Those in\r\n/System/Library are all part of macOS, owned by Apple, and protected by SIP, but those in /Library include many\r\ninstalled by third party products. As they’re run before the user logs in, they work for all users, so are global\r\nservices.\r\nOnce you have logged in, launchd runs any services and other components specified in any LaunchAgents\r\nfolders in ~/Library. Those are user-specific.\r\nThese Property List files contain keyed settings which determine what launchd does with what. Although they\r\ncan contain many other key-value pairs, two most important ones are ProgramArguments (or Program), which\r\ntells launchd what to run, and RunAtLoad, which determines whether launchd should run the service or app\r\nwhenever your Mac starts up and launchd loads those agents and services.\r\nOther keys determine whether the agent/service should be kept running at all times; if that is set, if it crashes or is\r\notherwise terminated, launchd will automatically start it up again. That is important for background services\r\nwhich apps rely on to function.\r\nYou can use this launchd mechanism to run a GUI app as a LaunchAgent if you wish. To run an app such as\r\nBailiff, for example, you would set the ProgramArguments to load the executable code within that app, say at\r\n/Applications/Bailiff.app/Contents/MacOS/Bailiff. Note that this is not the top level of the app bundle, which\r\nwould be at /Applications/Bailiff.app\r\nLaunchd is best suited to background services, which use it the most. You don’t need any tools beyond a Property\r\nList or text editor to craft its configuration files, although Lingon from Peter Borg makes them much more\r\naccessible. It’s also widely abused by malware, which often installs its own LaunchAgents and LaunchDaemons\r\nto ensure its persistence across reboots, and to perform services which it requires.\r\nhttps://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/\r\nPage 1 of 3\n\nApple defines a LaunchDaemon as a general background service, without any form of GUI. Specifically,\r\nLaunchDaemons are not allowed to connect to the macOS window server. LaunchAgents do have access to the\r\nGUI, and to other system features such as locating the current user’s Home folder, but generally have much more\r\nlimited interfaces than do regular apps.\r\nUninstalling a LaunchAgent or LaunchDaemon is simply a matter of trashing its Property List from the\r\nappropriate folder – a task sometimes necessary when you have uninstalled an app which doesn’t clean up\r\nproperly after itself. If software does need to install one or more Property Lists in any of these folders, then it\r\nshould also provide an effective uninstaller to remove them when required.\r\nApple’s documentation on launchd is quite old now, but is still a valuable reference, as is TN2083.\r\nLogin Items\r\nThese are controlled quite differently, through LaunchServices rather than launchd , which runs later following\r\nstartup. You can set any app, service, or other executable code to run at startup by adding the item to the list of\r\nLogin Items in the Users \u0026 Groups pane in System Preferences.\r\nOnce added, LaunchServices puts them into its list of apps to launch at startup, which is also kept in a Property\r\nList file. In Sierra and earlier, that is located in ~/Library/Preferences/com.apple.loginitems.plist, but High Sierra\r\nhttps://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/\r\nPage 2 of 3\n\nhas moved that, changed its extension, and the file structure, to ~/Library/Application\r\nSupport/com.apple.backgroundtaskmanagementagent/backgrounditems.btm\r\nThe older Property List isn’t intended to be maintained directly by the user. For each Login Item, it gives an ‘alias’\r\nwhich isn’t a normal macOS Bookmark, and some CustomItemProperties, which are also Base-64 encoded\r\nopaque data. The new format in High Sierra is even more opaque: although a Property List, it is now a keyed\r\narchive containing objects which are referenced by UUID, and unsuitable for manual editing.\r\nThere’s an easy way to add apps which are already in the Dock to the Login Items list: click and hold on their icon\r\nin the Dock until its menu pops up. In that, select Options, then the Open at Login command.\r\nYou can add and remove Login Items using a scripting language; for example, in AppleScript\r\ntell application \"System Events\" to make login item at end with properties\r\n{path:\"/Applications/MyApp.app\", hidden:false}\r\nadds MyApp.app as a Login Item,\r\ntell application \"System Events\" to get the name of every login item\r\nlists all Login Items, and\r\ntell application \"System Events\" to delete login item \"name\"\r\nremoves the named Login Item from the current list.\r\nLogin Items are better suited to apps of any size which have significant user interfaces, and anything which a user\r\nwants to control easily. Many apps, such as menubar or ‘Status Bar’ apps, offer the user the option of installing\r\nthem as a Login Item. Unfortunately, particularly when this is done for an app provided through the App Store,\r\nthis turns out to be a complex development task which requires a helper app.\r\nIf you’re interested in understanding this in detail, this item on Stack Overflow considers some of the problems,\r\nthis tutorial proposes one solution, and this is another tutorial account. Tomorrow I’ll be showing a much simpler\r\nway which works with apps which are not sandboxed (thus not intended for the App Store).\r\nSorting out LaunchServices problems is not easy. If you’re seeing weird things going on with your Login Items\r\nlist, the best solution is usually to start from scratch by trashing the current file (located according to whether\r\nyou’re running Sierra and earlier, or High Sierra), restarting, and setting up your Login Items again. Note that in\r\nsome versions of macOS, until there is at least one Login Item, the settings file may not exist.\r\nJust leave it running\r\nThe third and last way of opening an app when you next start up is simply to leave the app running when you shut\r\ndown or restart. It does, of course, rely on you remembering to check that the app is running beforehand.\r\nSource: https://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/\r\nhttps://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "MITRE" ], "references": [ "https://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/" ], "report_names": [ "running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon" ], "threat_actors": [], "ts_created_at": 1775434359, "ts_updated_at": 1775791216, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/329be17dde6d0e38953667e40596efcc0a8a8058.pdf", "text": "https://archive.orkl.eu/329be17dde6d0e38953667e40596efcc0a8a8058.txt", "img": "https://archive.orkl.eu/329be17dde6d0e38953667e40596efcc0a8a8058.jpg" } }