I share my MacBook Air1 with my son. When he is logged out2 of his user account and I look at the activity monitor in my account, there are several processes owned by his user that are still running:

screenshot of processes owned by a logged out user

When I took the screenshot3, the processes were all at 0% CPU, but I noticed them because com.apple.geod briefly rose to the top with around 5% or 10% CPU.

In fact, I only started up the activity monitor to check whether another process owned by my son was active again. He is playing Fortnite on this MacBook and a few days ago, after he had logged out and I had started using the computer, the cooling fan became very noisy, so I checked the activity monitor and saw that a process called EpicWebHelper owned by his account used a lot of CPU, until I killed it. I edited the launchd plist for that process to keep it from starting every time the computer was turned on. I guess it's nice for my son to have his game running when he logs in, but what I don't understand is:

Why does a process owned by a specific user remain active when the user logs out?


  1. MacBook Air, mid-2012, macOS 10.15.7
  2. My son logs out via the Apple menu.
  3. All the processes shown in the screenshot are owned by my son's user account. I just cropped his username to protect his privacy.
  • I'm not sure myself, but to help others here, could you clarify which macOS system are you using. Additionally, when you say he logs out, is he logging out fully (through the Apple Menu) or are you logging in via fast user switching? If you have fast user switching active, it's possible to lock the screen and then enter into another user simultaneously whilst the other user is still technically logged in. To check if fast user switching is active, go to System Preferences>Users and Groups>Login Options.
    – AVelj
    Dec 29, 2020 at 2:15
  • Oh also, in the above activity monitor screenshot, there's no indication that those processes belong to his user account. Could you clarify how you ascertained that the processes belong to his user account (i.e. did you inspect/sample the process through activity monitor/terminal). You can add a column to activity monitor to show which user is responsible for the process in Activity Monitor>View>Columns and select User.
    – AVelj
    Dec 29, 2020 at 2:21
  • @AVelj I answered your comments in an edit to my question. See the "Notes" at the end.
    – user400775
    Dec 29, 2020 at 8:06
  • Thanks for providing the additional details and clarifying my questions. It's always useful to know which macOS system you're running to troubleshoot these things. As I said, I am unsure myself at this stage but I will have a think about it. Hopefully someone more qualified in that respect will be able to answer it for you. Cheers
    – AVelj
    Dec 29, 2020 at 9:49
  • 1
    @AVelj Just to make matters clear: I'm not concerned if a process goes up to 10% occasionally. I'm curious why a process owned by a logged out user is active when another user is logged in.
    – user400775
    Dec 29, 2020 at 14:05

2 Answers 2


macOS is technically a multi-user system, there is nothing „wrong“ with having processes running which are owned by users not currently logged in. The processes you list seem to be usual things, don‘t see anything malicious.

PS: Of course sometimes things just get stuck due to bugs :-)

  • Sorry, but that answer is ridiculous, in the literal sense, as it's a non-sequitur.
    – Otheus
    Nov 4, 2022 at 10:25

I also would like to know why this happens, but from other posts such as this one, you can at least easily force a logout and termination of all processes. To me, the best is:

sudo launchctl bootout user/$(id -u <username>)

(Reportedly, only MacOS 10.11 and above).

The danger is, of course, that your son might have not logged out, but simply locked the screen or put the computer on sleep. However, even in Mac 12.6, I'm finding that logging out doesn't really do that. One can assume that this a typical design "feature" by Apple to rewrite the laws of user-design, by, as in the words of Iñego Montoyo, using words that do not mean what they think it means.

  • What does launchctl bootout do. if the user already is logged out?
    – nohillside
    Nov 4, 2022 at 12:13

You must log in to answer this question.