M4 is slow after user login due to a runaway CPU process

MM M4 slow after user logging in.


MMM4 with external SSD Samsung and user installed on external drive. M4 used to load very fast but started slowing down over time. Etrecheck Pro states a runaway process is using heavily the CDU.


Please find rapport attached.

Mac mini, macOS 26.5

Posted on Jul 9, 2026 6:13 AM

Reply
Question marked as Top-ranking reply

Posted on Jul 9, 2026 7:01 AM

You should remove this unneeded and unnecessary software:

NordVPN Threat Protection Pro™

Express VPN


Apps of the types anti-virus, security, cleaning, optimizing and VPN typically cause more problems than they solve and are best left uninstalled. Here in the Community, performance problems related to Mac performance are very often solved by the removal of these types of software from the Mac.


Unless your job or financial institute requires a VPN, these are best avoided as they may not provide the security they proffer.

Private VPN's are Anything But Private and 

Security Risks: The Dangers of Using Free VPNs – eccu.edu.  


For more info, please see:

Effective Defenses Against Malware - Apple Community (Thanks, John Galt!)


7 replies
Question marked as Top-ranking reply

Jul 9, 2026 7:01 AM in response to Ibiraviking

You should remove this unneeded and unnecessary software:

NordVPN Threat Protection Pro™

Express VPN


Apps of the types anti-virus, security, cleaning, optimizing and VPN typically cause more problems than they solve and are best left uninstalled. Here in the Community, performance problems related to Mac performance are very often solved by the removal of these types of software from the Mac.


Unless your job or financial institute requires a VPN, these are best avoided as they may not provide the security they proffer.

Private VPN's are Anything But Private and 

Security Risks: The Dangers of Using Free VPNs – eccu.edu.  


For more info, please see:

Effective Defenses Against Malware - Apple Community (Thanks, John Galt!)


Jul 10, 2026 10:46 AM in response to Ibiraviking

Ibiraviking wrote:
MMM4 with external SSD Samsung and user installed on external drive.

Did you relocate your home user folder to an external drive? If so, that can easily cause you huge performance issues compared to having the home user folder on the internal SSD. Your fastest USB3 SSD from the EtreCheck report has a theoretical maximum transfer rate of 10Gb/s (aka 1GB/s) whereas the internal SSD is over double that rate.


Plus there is a lot of risk having a home user folder located on an external drive. It will likely break at some point & could be difficult to fix (it happened multiple times after each Monterey minor update patches).


M4 used to load very fast but started slowing down over time.

What has changed since the system performed well and now?


And where do you notice this slower performance?


Etrecheck Pro states a runaway process is using heavily the CDU.

To manually remove the last remnant of NordVPN, delete the following file:

/Library/LaunchDaemons/com.nordvpn.macos.helper.plist


Also, the following item in the EtreCheck report is very unusual and even looks a bit suspicious.....even if it is safe...I find unusual is many times the source of problems:

Launch Agents: [Loaded] CCMH3DF6ZF.be.isabel.XPCServiceProxy.plist (Isabel NV - installed 2024-02-02) Executable: /usr/local/isabel/CCMH3DF6ZF.be.isabel.XPCServiceProxy.app/Contents/MacOS/CCMH3DF6ZF.be.isabel.XPCServiceProxy



Otherwise I agree with @D.I.Johnson..... your EtreCheck report looks very good compared to most. See if the Spotlight indexing (mdworker & "mds" processes) settle down after a day or two. We have seen some people have issues with Spotlight and macOS 26.x Tahoe. I don't have links to those other threads at the moment to see what those symptoms were (I know part of it was Spotlight consuming lots of storage).


Have you tried disconnecting all your external devices to see if that makes any difference? Perhaps one of them is causing a problem or a compatibility issue with the other devices.


Jul 9, 2026 12:47 PM in response to Ibiraviking

The process'mdworker_shared' is a vital macOS background worker for Spotlight, the local search engine. It automatically indexes new files, updates document metadata, and maintains search databases so you can quickly find items on your Mac. It will typically kick in after an update or upgrade and can keep busy for some time. Usually its activity will diminish in an hour or so. If it does not, that may indicate some trouble with Spotlight.


I don't know the fixes for Spotlight or the mdworker_shared process overworking.


Have patience and I expect other of our friends will chime here in with guidance.


Otherwise, to my eye, there is little in the etreCheck report that looks suspicious.

You appear to have plenty of RAM (16 GB), plenty of drive free space (148+ GB) and your drive write and read speeds are respectable.


Nothing jumps out as a reason for your Mac mini's slowdown. In fact, the EtreCheck report took only 2:03 to run and complete. That's pretty quick.

Jul 9, 2026 9:52 AM in response to D.I. Johnson

I have removed traces of Express VPN and removed from Apps the NordVPN however still some traces left. The speed of loading home-page improved slightly but Etrecheck still warns about an app using more than 100% CPU:


Top Processes Snapshot by CPU


Process (count)SourceCPUmdworker_shared (39)Apple218.53 %WindowServerApple9.28 %AboutmdsApple6.52 %Aboutkernel_taskApple5.70 %com.apple.audio.SandboxHelper (26)Apple4.73 %


Full report attached


Any recommendations?


Jul 10, 2026 10:49 AM in response to D.I. Johnson

Highly appreciated your input. I guess the system will adapt and yes, there was an update to Tahoe a few days ago. The VPN and their traces did reduce speed of loading programs at startup. Removal improved that speed. I read your links. I was aware of the misinformation of AV's and Cleaners. I did not expect that from VPN's but I learned some new things. Thanks.

Jul 10, 2026 11:04 AM in response to D.I. Johnson

I did move the home folder to the SSD. It's a Samsung SSD 990 Pro, 2TB drive. I guess one of the more reliable ones. I made a comparison in startup times between the home folder on the internal drive or the external one. Can't say I noticed a difference. I do know SSD's will fail in the end. I do have a backup and iCloud for dooms-day.

What changed over time is the amount of programs loaded. However only one program is to load at startup (Focusrite) I removed all from that.

The "Isabel" program is something from a Belgium bank (BNP). It is a security program. Should cause no issues.

I removed the last traces of NordVPN as you stated.

The programs that are quite demanding, like Photos, Pixelmator Pro, Garageband, Fender, are loading fast after that initial startup of the Mac mini M4. CAn't complain of that part. Appreciate everybody's input. I learned a lot. Thanks.

M4 is slow after user login due to a runaway CPU process

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.