What is process cfprefsd in Activity Monitor?

For the record, cfprefsd is a fundamental part of the MacOS operating system. It's a tool developers use when they write their application, and allows an application to read/write/modify preferences files (like files ending in .plist, and others). MacOS couldn't work without it.

So the more relevant question is which specific application is calling on cfprefsd to do something on it's behalf. This becomes a unix/MacOS lesson, about what unix utilities are at your disposal to look at the inner workings of applications as they run and interact with MacOS. For example, look at the command line tool called "fs_usage", it's one of many tools. Activity Monitor has some tools as well. But be prepared to have to learn loads about how unix-based OS's work to make sense of it.

So in summary, seeing cfprefsd in Activity Monitor is normal, as just about any app could be interacting with it. If a hacker was trying to get in to your system, they wouldn't be leaving around obvious traces like preference files...

More references:

https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man8/cfprefsd.8.html

Which leads to this:

https://developer.apple.com/library/mac/documentation/CoreFoundation/Reference/C FPreferencesUtils/index.html

Hmmm. If I were a hacker and I didn't want people identifying these processes as hacks, I might tell people not to worry about it, too. Just saying.

Totally agree. cfprefsd is showing up in activity monitor under all my account names, even ones that I have not logged in. I do not recall seeing this before. Also, my mac has become slow and unresponsive, without showing anything in activity monitor. My guess would be that as Apple moves towards a major release of OS X it has let into its software updates something that is causing this behavior because I've got waaay more processes running lateley than I used to. Course, I could have been hacked in some bizarre way 🙂

I'm seeing this show up using 1GB of RAM, now you can tell me "oh, don't worry about it.", but ANYTHING taking 1GB of ram under the username 'nobody' is a RED FLAG to me!

Sure, I still have 4GB of free mem (Apple lied about how much RAM these MacBook Pro's can use - I started running 16Gb and OMG it is nicer! I was swapping at 8.5GB normally used, and now I've swapped a total of 78 *MB* in the last 2 weeks that I've been running this way. Not sure why it would have ever gotten that high..

But, processes like this one, run from launchd taking 1GB of ram could have sucked down all the RAM and caused the swapping or something.

-Traderhut Games. (iPhone games developer.)

OOPS, misread the screen. the screen showed "1,004" KB is the size of the app, so 1 MB, not 1GB of RAM.

Still, who ran 'nobody' and who is 'nobody'? If it is a real user, give it a real name. If it is used by a system service, name it the name of the service.

-Traderhut Games

Not wanting to HJ the OP's worries/thread, but I too see this cfprefsd in activity monitor, but the part that worries me is that sometimes its doing not much at all and other times its showing 92%... is _that_ normal? Likewise, since installing Yosemite 10.10.1 and even with the 10.10.2 update, I'm also seeing a _massive_ slowdown in Apple Mail and mail sometimes shows 90+% or "Mail Not Responding" in red while the spinning beach ball is going. Otherwise, the machine seems to be running normal until I try to open, read, and reply to an email.

I am a bit puzzled by this process as well. OK if it is needed for some processes that I needn't worry about but why does it run just after booting the computer under another user name? I am looking at the activity monitor because my Mac has slowed down markedly in recent weeks. I seem to notice that there is permanent disk access even if the computer sits idle with no application running.

I have had this behavior and it was my system hard drive "soft failing". I backed it up (took forever to do), and a few days later it failed completely. The backup was a bootable copy that worked great and at full speed.

Each time it is used and launched by a different process it launches under a different specific system username. That's all there is to it.

That's one of many system user names, several rather cryptic.

There's no indication of any hacking.

See this thread: deleted user nobody

Then let it go.

cfprefsd provides preferences services for the CFPreferences and NSUserDefaults APIs.

There are no configuration options to cfprefsd manually.

From OS X man pages.

You aren't being hacked by that process. It's quite legitimate.

Those are system usernames.