launchd (Launch Daemon) is a safe macOS system process. launchd is the first process that runs when macOS boots (PID 1) and serves as the system's init and service management framework. It is responsible for starting, stopping, and managing all other system daemons, agents, and user-level services. Every process on your Mac is ultimately a descendant of launchd. launchd itself using noticeable CPU is abnormal since it's primarily a process manager. If you see launchd consuming significant resources, it usually means a child process is crash-looping and launchd is spending cycles restarting it. Investigate the child, not launchd itself.
Launch Daemon
launchd is the first process that runs when macOS boots (PID 1) and serves as the system's init and service management framework. It is responsible for starting, stopping, and managing all other system daemons, agents, and user-level services. Every process on your Mac is ultimately a descendant of launchd.
High CPU from constantly restarting a crashing child service
Login items or launch agents failing to load at startup
Orphaned plist files causing error messages in Console logs
Third-party launch daemons conflicting with system services
Open Console.app and filter for 'launchd' messages. Look for repeated 'Service exited with abnormal code' or 'Throttling respawn' messages — these indicate which child service is crashing and being restarted by launchd.
Check ~/Library/LaunchAgents/ and /Library/LaunchAgents/ for third-party plist files. Move suspicious or unneeded ones to the Desktop (not Trash) and restart. This prevents them from loading while keeping a backup.
Run 'launchctl bootout gui/$(id -u) /path/to/plist' to unload a specific service, then 'launchctl bootstrap gui/$(id -u) /path/to/plist' to reload it. This can resolve stuck or misconfigured service states.
Restart while holding Shift (Intel) or hold power then select Safe Mode (Apple Silicon). Safe Mode disables third-party launch daemons and agents, helping you determine if a third-party service is causing problems.
launchd itself using noticeable CPU is abnormal since it's primarily a process manager. If you see launchd consuming significant resources, it usually means a child process is crash-looping and launchd is spending cycles restarting it. Investigate the child, not launchd itself.
CoreLock audits all launch agents and daemons registered on your system, flags unsigned or suspicious entries, and detects persistence mechanisms that malware commonly uses to survive reboots via launchd plists.
Download CoreLock Freeloginwindow manages your macOS login session from start to finish. It presents the login screen, authenticates your cred...
distnoted is the macOS daemon that delivers distributed notifications between processes. When one application needs to n...
cfprefsd manages the macOS preferences system. It handles reading and writing all .plist preference files for both syste...
launchd is the foundational process management system in macOS, equivalent to systemd on Linux or the Service Control Manager on Windows. It is PID 1 — the very first process started by the kernel at boot — and it manages the lifecycle of all system services, background daemons, and user login agents.
launchd is the most critical process on macOS. Stopping it would crash the entire operating system immediately because every other process depends on it. You cannot and should not ever try to terminate launchd. If you're seeing issues related to launchd, the problem lies with one of its child services, not launchd itself.
Yes. One of the most common macOS malware persistence techniques is installing a Launch Agent or Launch Daemon plist that tells launchd to run the malware automatically at boot or login. These plists are stored in LaunchAgents and LaunchDaemons folders. CoreLock scans these locations and flags unsigned or suspicious entries.
Download CoreLock to identify suspicious processes, detect threats, and keep your Mac running smoothly.
Download CoreLock FreeAvailable for macOS and Windows