2

I share my MacBook Air1 with my son. When he is logged out2 of his user account and I look at the activity monitor in my account, there are several processes owned by his user that are still running:

screenshot of processes owned by a logged out user

When I took the screenshot3, the processes were all at 0% CPU, but I noticed them because com.apple.geod briefly rose to the top with around 5% or 10% CPU.

In fact, I only startet up the activity monitor to check whether another process owned by my son was active again. He is playing Fortnite on this MacBook and a few days ago, after he had logged out and I had started using the computer, the cooling fan became very noisy, so I checked the activity monitor and saw that a process called EpicWebHelper owned by his account used a lot of CPU, until I killed it. I edited the launchd plist for that process to keep it from starting every time the computer was turned on. I guess it's nice for my son to have his game running when he logs in, but what I don't understand is:

Why does a process owned by a specific user remain active when the user logs out?


Notes.

  1. MacBook Air, mid 2012, macOS 10.15.7
  2. My son logs out via the Apple menu.
  3. All the processes shown in the screenshot are owned by my son's user account. I just cropped his username to protect his privacy.
6
  • I'm not sure myself, but to help others here, could you clarify which macOS system are you using. Additionally, when you say he logs out, is he logging out fully (through the Apple Menu) or are you logging in via fast user switching? If you have fast user switching active, it's possible to lock the screen and then enter into another user simultaneously whilst the other user is still technically logged in. To check if fast user switching is active, go to System Preferences>Users and Groups>Login Options. – AVelj Dec 29 '20 at 2:15
  • Oh also, in the above activity monitor screenshot, there's no indication that those processes belong to his user account. Could you clarify how you ascertained that the processes belong to his user account (i.e. did you inspect/sample the process through activity monitor/terminal). You can add a column to activity monitor to show which user is responsible for the process in Activity Monitor>View>Columns and select User. – AVelj Dec 29 '20 at 2:21
  • @AVelj I answered your comments in an edit to my question. See the "Notes" at the end. – user400775 Dec 29 '20 at 8:06
  • Thanks for providing the additional details and clarifying my questions. It's always useful to know which macOS system you're running to troubleshoot these things. As I said, I am unsure myself at this stage but I will have a think about it. Hopefully someone more qualified in that respect will be able to answer it for you. Cheers – AVelj Dec 29 '20 at 9:49
  • 1
    @AVelj Just to make matters clear: I'm not concerned if a process goes up to 10% occasionally. I'm curious why a process owned by a logged out user is active when another user is logged in. – user400775 Dec 29 '20 at 14:05
0

macOS is technically a multi-user system, there is nothing „wrong“ with having processes running which are owned by users not currently logged in. The processes you list seem to be usual things, don‘t see anything malicious.

PS: Of course sometimes things just get stuck due to bugs :-)

You must log in to answer this question.