Debug startup process

Jump to First Reply
Posted:
in Genius Bar
Hi
About 15 to 30 seconds after starting my iMac (M1, BigSur) all programms in /Applications are deleted, except Safari and the programms in /System/Applications. I know this because I made a LaunchDaemon that ls the content of /Applications into a file every ten seconds. How can I find out, what is causing this?
Thanks for any insight.

Comments

  • Reply 1 of 3
    to clarify: this happens at every boot. Between boots the apps get reinstalled by FileWave.
     0Likes 0Dislikes 0Informatives
  • Reply 2 of 3
    Mike Wuerthelemike wuerthele Posts: 6,955administrator
    Have you tried a verbose boot? Are you sure that the FileWave MDM isn't intentionally doing this?
     0Likes 0Dislikes 0Informatives
  • Reply 3 of 3
    Marvinmarvin Posts: 15,519moderator
    to clarify: this happens at every boot. Between boots the apps get reinstalled by FileWave.
    Given that it's running MDM software, that might be the problem. You can use some terminal commands to check what's affecting the filesystem:

    sudo opensnoop
    sudo fs_usage -f filesys

    If you run those just after boot, it should log which process is affecting the apps.

    You can also try booting without wifi to see if the apps are being removed from a network command. Also try booting in safe mode by holding shift to see if it still removes them:

    https://support.apple.com/en-us/HT201255
     0Likes 0Dislikes 0Informatives
Sign In or Register to comment.