Auditing the menu bar: what your background utilities are doing

Nobody installs twelve background utilities on purpose. They arrive one at a time over three years, each solving a real problem, and none of them ever leaves. Every one holds some combination of permissions, launches at login, and talks to a server on a schedule you never chose.

An inventory takes about half an hour and is one of the highest-value things you can do to a Mac you have owned for a while.

Step 1 — Find everything that starts itself

Three places, all of which need checking:

The third location is where the surprises are. Dragging an app to the Trash does not remove a daemon it installed, which is why people find things still connecting months after they thought they had removed them — a recurring finding in first-week monitoring reports.

Step 2 — Match each one to a purpose

For every item, answer two questions: what does it do, and do I still want that? Anything you cannot answer is a candidate for removal. The correct disposition of an unexplained background job is to remove it and see what breaks — which, in practice, is almost never anything.

Step 3 — Watch what they connect to

This is where a connection monitor turns a list into information. Leave it running for a day and sort by process. You are looking for three patterns:

• Chatty updaters. Polling every few minutes for software that ships four times a year.
• Analytics endpoints from utilities that have no plausible reason to measure you.
• Anything from a process you could not name in step 2.

Step 4 — Cross-reference permissions

Open Privacy & Security and check each of Accessibility, Input Monitoring, Screen Recording, Full Disk Access and Local Network against your inventory. Two rules:

• Any grant belonging to software not in your inventory is stale. Remove it.
• Any utility holding several powerful grants at once needs a specific justification. One is normal; three is a conversation. The scope of each is covered in what Accessibility actually allows.

What a well-behaved utility looks like

It is worth having a reference point for "normal", because without one every background process looks suspicious.

A well-behaved menu bar utility has a single clear job, holds exactly the permissions that job requires, connects to the network only to check for updates — or not at all — and can be removed completely by deleting the app.

Keyboard window managers are a good example of the shape. Rectangle, for instance, needs Accessibility because moving another app's window is impossible without it, needs nothing else, and its only outbound traffic is an update check you can switch off. Under monitoring it is essentially silent. That is the profile to compare everything else against — and a useful reminder that "background utility" is not a synonym for "phoning home".

What poor behaviour looks like

• Persistence installed without being mentioned at setup
• Connections to third-party analytics or attribution vendors
• Requesting permissions unrelated to the stated function
• An uninstaller that leaves launch agents behind
• Update checks measured in minutes rather than days

None of these individually proves bad intent. Two or three together is enough to justify replacing the tool.

Step 5 — Remove properly

1. Quit the utility from its menu bar item.
2. Remove the app from Applications.
3. Delete its launch agent or daemon from the three locations above.
4. Remove its entries from every Privacy & Security list.
5. Delete its preferences from ~/Library/Preferences and its support folder from ~/Library/Application Support.

Step 3 is the one everyone skips, and it is the reason ghost processes exist.

How often

Twice a year, or after any period of installing a lot of software. It takes half an hour and the result is a machine where you can account for every process that starts itself — which is a prerequisite for noticing when something new appears.

Frequently asked questions