I keep getting a privacy notification on my Mac saying allow <unknown> to find devices on local networks and I don’t know where it’s coming from. I recently reset my Mac because it had the same popup and I just downloaded the basic extra apps for streaming (OBS, TiktokLiveStudio, Chrome, discord, VLC) and I’m wondering if it’s from one of these just not labeled right ?
[Edited by Moderator]
Go to > System Settings > Privacy & Security > Local Networks. If you see an unnamed process there , or one that is turned off, you may be able to Control-Click that process where you will see a Show in Finder option that will take you to the app.
It is usually the case though, that you won't see the process in Local Networks until after you have allowed access. You could compare before allowing and then see what appears there after you allow it, where you will then have the option to turn it off, or at least find out what app it is attributed to.
Go to > System Settings > Privacy & Security > Local Networks. If you see an unnamed process there , or one that is turned off, you may be able to Control-Click that process where you will see a Show in Finder option that will take you to the app.
It is usually the case though, that you won't see the process in Local Networks until after you have allowed access. You could compare before allowing and then see what appears there after you allow it, where you will then have the option to turn it off, or at least find out what app it is attributed to.
It certainly may be one of those. It may be possible to identify the process running in one of your Launch folders wanting access by posting the free EtreCheck report. It does not contain any personal information, but will show the background processes running on your computer. Any that are listed as "Not Signed" should not be there and I would recommend removal. Even Google is known to throw some "Not Signed" processes into your Launch Folders and I would still remove those.
How to use the Add Text Feature When Post… - Apple Community
soren2 wrote:
I deleted all of them (Epson installer, Chrome, Spotify) and restarted. I still get the "Allow <unknown>..." pop-up window.
Perhaps it isn't one of those. Do you have any other apps configured to run in the background in /Library/LaunchDaemons, /Library/LaunchAgents, or ~/Library/LaunchAgents? Such apps might show up as "unknown" because they aren't fully apps. They might still be related to one of those other apps too. The names of the files and folder are irrelevant. What Apple is trying to display is the name of a signed app. If it isn't a signed app, then it could say "unknown".
It really is easier just to post the free EtreCheck report using the Additional Text option when posting. It will show clearly which files in those folders are Not Signed and those are the ones that you will want to delete.
How to use the Add Text Feature When Post… - Apple Community
I do suspect the org.macosforge.xquartz.startx.plist and org.macosforge.xquartz.privileged_startx.plist are likely Not Signed because those are typically quite old and were carried over from previous updates. Also the Google Keystone files are typically Not Signed and I would be deleted those too..
If you already deleted the Skype app and did not use the uninstaller, then go ahead and delete the Skype file you see there.
What about posting the etrecheck report here . . . that's what you are supposed to do, as many forum members will be able to interpret it better than you or I can.
soren2 wrote:
I have exactly the same problem. However of the programs listed by the original poster (OBS, TiktokLiveStudio, Chrome, discord, VLC) I only have Chrome and VLC. I checked Local Networks and there's nothing "unknown", only Epson Installer, Google Chrome, and Spotify. I'm wondering, should I just try to clean house and get rid of all of them – even if none of them are named "unknown" ??
None of them are going to be named "unknown". It's definitely one of those three. Most likely Chrome.
Turns out I had firewall turned off. I’m gonna go keep it on and see if that stops it. If not I’ll seek out apple care
If it were me I wouldn't grant it access. I'd wait until something didn't work and then make a decision. You could also try accessing network devices with the apps you've downloaded, which will also trigger the same notification.
soren2 wrote:
etresoft – thank you for giving me a hand here, much appreciated!!
I have my everyday user (standard privileges) and my admin separated.
Since this popup happens in your account, it can only be either something running at the system level or in your account.
~/Library/LaunchAgents for my standard user shows:
.../LaunchAgents> ls
com.amazon.music.plist
com.amazon.music.startup.plist
com.epson.epsvcp.plist
com.microsoft.EdgeUpdater.update-internal.109.0.1518.89.plist
com.microsoft.EdgeUpdater.update.plist
com.microsoft.EdgeUpdater.wake.109.0.1518.89.plist
It could be any of them, but the EdgeUpdater is by far the most likely.
.../LaunchAgents % ls
com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist
com.epson.Epson_Low_Ink_Reminder.launcher.plist
com.epson.RemotePrintIOHelper.plist
com.epson.esua.launcher.plist
com.epson.eventmanager.agent.plist
com.epson.scannermonitor.plist
com.google.keystone.agent.plist
com.google.keystone.xpcservice.plist
com.microsoft.OneDriveStandaloneUpdater.plist
com.microsoft.SyncReporter.plist
com.microsoft.update.agent.plist
org.macosforge.xquartz.startx.plist
us.zoom.updater.login.check.plist
us.zoom.updater.plist
Next most likely would be the epson files, as printers may be poking around with local networks.
~/Library/LaunchAgents % ls
com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist
There seems to be some confusion regarding your paths there. It's always best to use absolute paths to eliminate any doubt.
That first set of files seems to be /Library/LaunchAgents
The second set is /Library/LaunchDaemons
The last set if ~/Library/LaunchAgents
using the report the only thing that was under not signed was stuff from Google Chrome, a minor report popped up saying there might be profiles set up on the computer but when I went to check there were no other profiles listed (as I haven't set anything up)
upon giving the app full disc access the report of unknown profiles went away getting rid of chrome and clearing its cache has helped but whenever i hit command shift Q to logout and do log out the pop up happens again, nothing is flagging as un signed on my computer in that list nothing is in the profiles
gabe262 wrote:
Turns out I had firewall turned off. I’m gonna go keep it on and see if that stops it. If not I’ll seek out apple care
The firewall has nothing to do with this and the firewall does nothing anyway.
It's hard to say what's causing it. I don't know where that system dialog gets the "unknown" from. But apps are always inventing new bundle structures that are unlike any other known app but somehow still function, after a fashion.
Most likely, this dialog will continue to pop-up. You won't be able to stop it. At least one of the apps you mentioned (Chrome) is known to build the app incorrectly and cause problems with local networking. Chrome has known about this problem for years, but they blame Apple. Also years ago, Apple published detailed specifications for how to construct an app so this problem won't happen. And it just so happens that Chrome doesn't follow those specifications. I don't know about the other apps. But because Chrome is Google, everyone now wants to build their apps just like Chrome. So it could be anything really.
Sorry to be the bearer of bad news, but there's no solution to this problem.
upon using etc check to see it says other profiles may be installed but none show at all, I went ahead and checked with terminal and no other profiles came up, gemini informed me this is just an issue with the date and time auto being locked to on
gabe262 wrote:
upon using etc check to see it says other profiles may be installed but none show at all, I went ahead and checked with terminal and no other profiles came up, gemini informed me this is just an issue with the date and time auto being locked to on
Not sure if that is true or not. I have Date & Time set to Auto and don't see that profile warning. The Developer of EtreCheck may chime in here if they have seen this reported or offer more information, as they do participate in these forums. Unfortunately direct messaging is not an option here, so they would have to see the post.
I have exactly the same problem. However of the programs listed by the original poster (OBS, TiktokLiveStudio, Chrome, discord, VLC) I only have Chrome and VLC. I checked Local Networks and there's nothing "unknown", only Epson Installer, Google Chrome, and Spotify. I'm wondering, should I just try to clean house and get rid of all of them – even if none of them are named "unknown" ??
Mac privacy notification for unknown app requesting local network access
