4

I share my MacBook Air1 with my son. When he is logged out2 of his user account and I look at the activity monitor in my account, there are several processes owned by his user that are still running:

screenshot of processes owned by a logged out user

When I took the screenshot3, the processes were all at 0% CPU, but I noticed them because com.apple.geod briefly rose to the top with around 5% or 10% CPU.

In fact, I only started up the activity monitor to check whether another process owned by my son was active again. He is playing Fortnite on this MacBook and a few days ago, after he had logged out and I had started using the computer, the cooling fan became very noisy, so I checked the activity monitor and saw that a process called EpicWebHelper owned by his account used a lot of CPU, until I killed it. I edited the launchd plist for that process to keep it from starting every time the computer was turned on. I guess it's nice for my son to have his game running when he logs in, but what I don't understand is:

Why does a process owned by a specific user remain active when the user logs out?

Notes.

  1. MacBook Air, mid-2012, macOS 10.15.7
  2. My son logs out via the Apple menu.
  3. All the processes shown in the screenshot are owned by my son's user account. I just cropped his username to protect his privacy.
IconDaemon
  • 19,234
  • I'm not sure myself, but to help others here, could you clarify which macOS system are you using. Additionally, when you say he logs out, is he logging out fully (through the Apple Menu) or are you logging in via fast user switching? If you have fast user switching active, it's possible to lock the screen and then enter into another user simultaneously whilst the other user is still technically logged in. To check if fast user switching is active, go to System Preferences>Users and Groups>Login Options. – AVelj Dec 29 '20 at 02:15
  • Oh also, in the above activity monitor screenshot, there's no indication that those processes belong to his user account. Could you clarify how you ascertained that the processes belong to his user account (i.e. did you inspect/sample the process through activity monitor/terminal). You can add a column to activity monitor to show which user is responsible for the process in Activity Monitor>View>Columns and select User. – AVelj Dec 29 '20 at 02:21
  • @AVelj I answered your comments in an edit to my question. See the "Notes" at the end. –  Dec 29 '20 at 08:06
  • Thanks for providing the additional details and clarifying my questions. It's always useful to know which macOS system you're running to troubleshoot these things. As I said, I am unsure myself at this stage but I will have a think about it. Hopefully someone more qualified in that respect will be able to answer it for you. Cheers – AVelj Dec 29 '20 at 09:49
  • Also, I just quickly searched what com.apple.geod does, and it seems to be a location services process. I don't know whether turning off the Mac's location will solve it, as other services may use it to communicate with Apple for analytic purposes. You could search more about the process, but I wouldn't be too concerned if it goes up occasionally to 5-10%. – AVelj Dec 29 '20 at 09:59
  • 1
    @AVelj Just to make matters clear: I'm not concerned if a process goes up to 10% occasionally. I'm curious why a process owned by a logged out user is active when another user is logged in. –  Dec 29 '20 at 14:05

2 Answers2

1

macOS is technically a multi-user system, there is nothing „wrong“ with having processes running which are owned by users not currently logged in. The processes you list seem to be usual things, don‘t see anything malicious.

PS: Of course sometimes things just get stuck due to bugs :-)

nohillside
  • 100,768
0

I also would like to know why this happens, but from other posts such as this one, you can at least easily force a logout and termination of all processes. To me, the best is:

sudo launchctl bootout user/$(id -u <username>)

(Reportedly, only MacOS 10.11 and above).

The danger is, of course, that your son might have not logged out, but simply locked the screen or put the computer on sleep. However, even in Mac 12.6, I'm finding that logging out doesn't really do that. One can assume that this a typical design "feature" by Apple to rewrite the laws of user-design, by, as in the words of Iñego Montoyo, using words that do not mean what they think it means.

Otheus
  • 129