“Background Items Added” on a Mac: find what it is and turn it off safely

What the notification means

The notification looks like this:

Background Items Added
"Google Updater" added items that can run in the background. You can manage this in Login Items Settings.

Since macOS 13, macOS keeps a record of everything that can start by itself, and tells you when an app adds a new one. The record lives in Background Task Management; the switches for it are in System Settings › General › Login Items & Extensions. It is a notice, not a warning: updaters, sync clients, VPNs, backup tools and helpers for printers or mice all add background items. It is worth a look anyway, because it is also how unwanted software keeps itself running.

Most of the items are launchd jobs, each defined by a property list (plist) file:

Folder	What it holds	Runs as
~/Library/LaunchAgents	Agents installed for you alone	you, while you are logged in
/Library/LaunchAgents	Agents installed for every user	each user, while logged in
/Library/LaunchDaemons	Daemons	root or a service account, from boot
inside an app, Contents/Library/LaunchAgents and similar	Items an app registers itself	depends on the type

Apple’s own jobs live in /System/Library, on the read-only system volume.

Step 1: find the item in System Settings

Open System Settings › General › Login Items & Extensions. There are two lists:

• Open at Login: apps that open when you log in. These are ordinary apps, and the minus button removes them.
• App Background Activity (called Allow in the Background on earlier versions of macOS): the background items, each with an on/off switch. Many show only a developer’s name, and one entry can stand for several items.

If the name in the notification is there, you have found it. If the name is a company you don’t recognise, or the notification has already gone, go to the files.

Step 2: find the plist and the program

List the three folders, newest first:

ls -lt ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

The file added most recently is a good suspect. Read it:

plutil -p /Library/LaunchAgents/io.northwind.agent.plist

Label is the job’s name in launchd, and Program or the first item of ProgramArguments is what it runs. Check who signed that program:

codesign -dv --verbose=2 "/Applications/Northwind Sync.app/Contents/MacOS/northwind-agent"

The Authority= lines and TeamIdentifier= say who built it. A program that does not exist any more means the plist is a leftover from an app you deleted.

To see which jobs are loaded in your session right now, skipping Apple’s:

launchctl list | grep -v com.apple

A number in the first column is a running process; - means loaded but not running.

Step 3: the full list, with sfltool

macOS has a command that prints the whole Background Task Management record, every user’s items with their developer, Team ID, file and switch state. It needs an administrator password:

sudo sfltool dumpbtm

Each item looks like this (trimmed, demo values):

 #4:
                 Name: Northwind Sync
       Developer Name: Northwind Software
      Team Identifier: ABCDE12345
                 Type: legacy agent (0x10008)
          Disposition: [enabled, allowed, notified] (0xb)
           Identifier: 8.io.northwind.agent
                  URL: file:///Library/LaunchAgents/io.northwind.agent.plist
      Executable Path: /Applications/Northwind Sync.app/Contents/MacOS/northwind-agent

URL is the plist, Executable Path the program, and Disposition the state: enabled in that list means the switch in System Settings is on. Apple documents the command for administrators as printing “the current status of login and background items”.

Step 4: turn it off without breaking anything

There are four ways to stop a background item, from gentlest to most final:

1. The switch in App Background Activity. macOS then won’t let launchd run it. It is the safest choice and the one the app’s developer expects; switch it back on if the app stops working. Only you can change it, in System Settings.

2. launchctl disable. launchd’s own override, which survives restarts until you enable it again:

   launchctl bootout gui/$(id -u)/io.northwind.agent     # stop it now
   launchctl disable gui/$(id -u)/io.northwind.agent     # and don't load it again

   For a daemon, use sudo and system/io.northwind.agent. launchctl enable undoes it. Note that an agent in /Library/LaunchAgents runs once per logged-in user, so disable it in each user’s domain.

3. launchctl bootout alone stops it until the next login or restart. Useful to test whether anything breaks.

4. Removing the plist. Only for leftovers whose program is gone, or after the app’s own uninstaller. Unload it first, and move the file to a folder of your own rather than deleting it, so you can put it back. An installed app often recreates its plist when it next runs.

To get rid of the app itself, use its uninstaller if it has one: dragging an app to the Bin leaves its plists in /Library behind, and those are what keep the notifications coming.

When the notification keeps coming back

Reports in Apple’s forums point to the same few causes: an app that re-registers its item every time it runs, or a leftover plist from an app that was dragged to the Bin. Update the app, or remove its leftovers as above, and restart.

sfltool resetbtm resets the whole Background Task Management record. Apple’s administrator guide describes it as resetting “login and background item data”, and suggests a restart afterwards. It is a blunt tool: every item’s switch goes back to its default, and you will be notified again about items you had already reviewed. Use it last, not first.

The shortcut: LD Manager

LD Manager is a free, open-source Mac app and command-line tool that lists every launchd job on the Mac: your agents, agents for all users, system daemons and Apple’s own, read-only. Each job has one status joined from every layer: the plist, whether launchd has it loaded, the enable or disable override, the App Background Activity switch and the owner System Settings shows for it, the PID, the run count and the last exit code. A job that launchd has enabled but Login Items has switched off shows as “off in Login Items”, so you can see at once which of the two switches is holding it.

ldm list
ldm show io.northwind.agent --background
ldm disable io.northwind.agent --dry-run

--background re-reads Login Items (macOS asks for your password each time, unless you approve LD Manager’s optional helper once). ldm disable unloads the job and sets launchd’s disable override, and --dry-run prints the exact launchctl commands first. The Doctor flags plists whose program is missing, the usual leftovers. Every edit shows a diff and keeps a backup.

Its limits: macOS has no public way to change the App Background Activity switches, so LD Manager reads them and opens the Login Items pane for you to flip them. It manages launchd jobs, not the apps under Open at Login. It requires macOS 26 or later. For a security audit of everything that persists on a Mac, browser extensions and kernel extensions included, a dedicated tool such as KnockKnock lists more kinds of items; LD Manager is for managing and fixing the launchd ones.

Background items

What does “Background Items Added” mean on a Mac?

An app registered an item that can run without you opening it, usually a launchd LaunchAgent or LaunchDaemon. macOS lists these items in System Settings › General › Login Items & Extensions and notifies you when a new one appears.

Is it a virus?

Usually not: updaters, sync clients, VPNs, backup tools and device helpers all add background items. Check who signed the program the item runs, with codesign -dv, and turn it off if you do not recognise or need it.

How do I see every background item and who made it?

Run sudo sfltool dumpbtm. It prints each item’s name, developer, Team ID, type, state, plist URL and program. The plists themselves are in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons.

Is it safe to turn off an item in App Background Activity?

Yes, it is reversible: switch it back on if the app stops working. launchctl disable is also reversible with launchctl enable. Deleting plist files is not, and an installed app often recreates them.

What does sfltool resetbtm do?

It resets the whole login and background item record, and Apple suggests restarting afterwards. Every item goes back to its default and you are notified again, so use it only when removing leftovers and updating apps has not helped.