How to Manage Background Task Items and Login Approvals Using sctl in macOS

Starting in macOS Ventura and continuing through macOS Sonoma and macOS Sequoia, Apple introduced a overhauled background management architecture governed by the ServiceManagement framework. Under this system, whenever third-party software registers LaunchDaemons, LaunchAgents, or login helpers, macOS automatically prompts the user with a “Background Items Added” notification and populates the Login Items & Extensions interface in System Settings. For Mac administrators, enterprise fleet engineers, and power users, diagnosing background persistence issues through GUI settings alone is often insufficient. The command-line utility sctl provides comprehensive control to query, inspect, and reset background item approval states directly in macOS.

Understanding the ServiceManagement Background Model

Historically, background tasks on macOS were configured by writing property list (.plist) files directly into filesystem locations like /Library/LaunchDaemons, /Library/LaunchAgents, or ~/Library/LaunchAgents. While functional, this permitted installers to silently register persistent background processes without user consent.

Modern macOS implementations utilise the SMAppService API, tracking all persistent items within an internal Service Management database. Persistent items fall into distinct categories:

• Login Items: Helper applications bundled inside an application’s Contents/Library/LoginItems directory that launch automatically when the user signs in.
• LaunchAgents: Per-user background services running in the user session.
• LaunchDaemons: System-wide privileged background services running under the root context.

Querying Background Items and Status with sctl

The sctl (Service Controller) command-line tool interacts directly with the Service Management subsystem. To display all registered background task items on your Mac:

1. Open Terminal from Applications > Utilities (or via Spotlight).
2. Execute the following command to dump registered background items:

sctl dump

The command outputs a structured list detailing all known background services, their corresponding bundle identifiers, developer team identifiers, and current approval statuses:

• enabled / approved: The service is fully authorised to launch in the background.
• disabled / rejected: The user or administrator has toggled the background item off in System Settings, preventing launchd from executing the task.
• user notification state: Indicates whether the system has already presented the notification banner to the user.

Inspecting Detailed Service Targets

To inspect a specific application’s background registration details without sifting through the full system dump, filter the output using grep:

sctl dump | grep -B 2 -A 5 "com.example.app"

This reveals the precise filesystem path from which the background item originated, the designated user UUID, and whether the service was registered via a legacy LaunchDaemon plist or the modern SMAppService framework.

Resetting the Background Item Database

During software development, testing, or troubleshooting orphaned background notifications (such as deleted apps that continue appearing in System Settings), resetting the Service Management state is frequently necessary. To reset background item tracking:

sudo sctl reset

Executing sctl reset forces macOS to re-index all installed applications and scan traditional launch directories. After running this command:

1. Restart the Mac or restart the background notification service:

killall BackgroundItemsSystemExtension

2. Open System Settings > General > Login Items & Extensions.
3. Observe that legacy, orphaned entries have been purged, and active background services have re-registered cleanly.

Managing Login Items via MDM and Configuration Profiles

In managed corporate environments, users toggling critical security agents or backup daemons off in System Settings presents a compliance risk. Administrators can deploy Apple Configuration Profiles using the com.apple.servicemanagement payload to lock background items:

• RuleType: Specifies whether to match items by BundleIdentifier, BundleIdentifierPrefix, Label, or TeamIdentifier.
• RuleValue: The specific identifier (e.g., Apple Developer Team ID).
• Comment: Explanatory text presented within the System Settings panel.

When enforced via MDM, the background item appears in the user’s Login Items panel with the toggle switch locked in the “On” position, preventing local modification while ensuring enterprise agents remain persistently operational.