Mac privacy notification for unknown app requesting local network access

Go to  > System Settings > Privacy & Security > Local Networks. If you see an unnamed process there , or one that is turned off, you may be able to Control-Click that process where you will see a Show in Finder option that will take you to the app.

It is usually the case though, that you won't see the process in Local Networks until after you have allowed access. You could compare before allowing and then see what appears there after you allow it, where you will then have the option to turn it off, or at least find out what app it is attributed to.

It certainly may be one of those. It may be possible to identify the process running in one of your Launch folders wanting access by posting the free EtreCheck report. It does not contain any personal information, but will show the background processes running on your computer. Any that are listed as "Not Signed" should not be there and I would recommend removal. Even Google is known to throw some "Not Signed" processes into your Launch Folders and I would still remove those.

How to use the Add Text Feature When Post… - Apple Community

soren2 wrote:

I deleted all of them (Epson installer, Chrome, Spotify) and restarted. I still get the "Allow <unknown>..." pop-up window.

Perhaps it isn't one of those. Do you have any other apps configured to run in the background in /Library/LaunchDaemons, /Library/LaunchAgents, or ~/Library/LaunchAgents? Such apps might show up as "unknown" because they aren't fully apps. They might still be related to one of those other apps too. The names of the files and folder are irrelevant. What Apple is trying to display is the name of a signed app. If it isn't a signed app, then it could say "unknown".

It really is easier just to post the free EtreCheck report using the Additional Text option when posting. It will show clearly which files in those folders are Not Signed and those are the ones that you will want to delete.

How to use the Add Text Feature When Post… - Apple Community

I do suspect the org.macosforge.xquartz.startx.plist and org.macosforge.xquartz.privileged_startx.plist are likely Not Signed because those are typically quite old and were carried over from previous updates. Also the Google Keystone files are typically Not Signed and I would be deleted those too..

If you already deleted the Skype app and did not use the uninstaller, then go ahead and delete the Skype file you see there.

I ran EtreCheckPro that identified 5 unsigned files that I deleted:

com.epson.RemotePrintIOHelper.plist

com.epson.RemotePrintIODaemon.plist

com.epson.epsvcp.plist

com.microsoft.EdgeUpdater.update-internal.109.0.1518.89.plist

com.microsoft.EdgeUpdater.update.system.plist

So far it has taken care of my <unknown> pop up, fingers crossed.

Thank you to all for the help, especially etresoft!

PS: I also deleted 8 unsigned apps, mostly google apps, I don't use any of them...

soren2 wrote:

Etresoft; thanks again.

I did go to the absolute paths, I just edited the front part to ".../" to not show computername and username here.

I removed macosforge/xquartz from both /Library/LaunchAgents and /Library/LaunchDaemons and Skype as well from /Library/LaunchDaemons (using sudo rm -rf) and they no longer show when I do an ls, and did a restart after that, but it didn't help.

I should clarify, I have 2 standard user accounts (and one admin) and I get the pop-up when I log out of one of the accounts and am at the login screen.

I would encourage you to look at the creation dates for all those files you listed, especially the Microsoft ones.

I experienced this "unknown" message upon logout with a new M5 Macbook Air that I had migrated to from my wife's older Mac. When I looked in those three directories (the ones Etresoft pointed you to) I found some odd Microsoft items related to MS-365, ones that appeared to be quite old and possibly inconsistent with the newer version of MS-365. When I disabled the old ones in System Settings =>General=>Login Items & Extensions the "unknown" issue went away.

I would look at all the Microsoft items there, especially if you migrated some possibly older Microsoft items from an older system some time ago (or recently).

What about posting the etrecheck report here . . . that's what you are supposed to do, as many forum members will be able to interpret it better than you or I can.

soren2 wrote:

I have exactly the same problem. However of the programs listed by the original poster (OBS, TiktokLiveStudio, Chrome, discord, VLC) I only have Chrome and VLC. I checked Local Networks and there's nothing "unknown", only Epson Installer, Google Chrome, and Spotify. I'm wondering, should I just try to clean house and get rid of all of them – even if none of them are named "unknown" ??

None of them are going to be named "unknown". It's definitely one of those three. Most likely Chrome.

Turns out I had firewall turned off. I’m gonna go keep it on and see if that stops it. If not I’ll seek out apple care

If it were me I wouldn't grant it access. I'd wait until something didn't work and then make a decision. You could also try accessing network devices with the apps you've downloaded, which will also trigger the same notification.

soren2 wrote:

etresoft – thank you for giving me a hand here, much appreciated!!

I have my everyday user (standard privileges) and my admin separated.

Since this popup happens in your account, it can only be either something running at the system level or in your account.

~/Library/LaunchAgents for my standard user shows:

.../LaunchAgents> ls

com.amazon.music.plist

com.amazon.music.startup.plist

com.epson.epsvcp.plist

com.microsoft.EdgeUpdater.update-internal.109.0.1518.89.plist

com.microsoft.EdgeUpdater.update.plist

com.microsoft.EdgeUpdater.wake.109.0.1518.89.plist

It could be any of them, but the EdgeUpdater is by far the most likely.

.../LaunchAgents % ls

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist

com.epson.Epson_Low_Ink_Reminder.launcher.plist

com.epson.RemotePrintIOHelper.plist

com.epson.esua.launcher.plist

com.epson.eventmanager.agent.plist

com.epson.scannermonitor.plist

com.google.keystone.agent.plist

com.google.keystone.xpcservice.plist

com.microsoft.OneDriveStandaloneUpdater.plist

com.microsoft.SyncReporter.plist

com.microsoft.update.agent.plist

org.macosforge.xquartz.startx.plist

us.zoom.updater.login.check.plist

us.zoom.updater.plist

Next most likely would be the epson files, as printers may be poking around with local networks.

~/Library/LaunchAgents % ls

com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist

There seems to be some confusion regarding your paths there. It's always best to use absolute paths to eliminate any doubt.

That first set of files seems to be /Library/LaunchAgents

The second set is /Library/LaunchDaemons

The last set if ~/Library/LaunchAgents

using the report the only thing that was under not signed was stuff from Google Chrome, a minor report popped up saying there might be profiles set up on the computer but when I went to check there were no other profiles listed (as I haven't set anything up)

upon giving the app full disc access the report of unknown profiles went away getting rid of chrome and clearing its cache has helped but whenever i hit command shift Q to logout and do log out the pop up happens again, nothing is flagging as un signed on my computer in that list nothing is in the profiles

gabe262 wrote:

Turns out I had firewall turned off. I’m gonna go keep it on and see if that stops it. If not I’ll seek out apple care

The firewall has nothing to do with this and the firewall does nothing anyway.

It's hard to say what's causing it. I don't know where that system dialog gets the "unknown" from. But apps are always inventing new bundle structures that are unlike any other known app but somehow still function, after a fashion.

Most likely, this dialog will continue to pop-up. You won't be able to stop it. At least one of the apps you mentioned (Chrome) is known to build the app incorrectly and cause problems with local networking. Chrome has known about this problem for years, but they blame Apple. Also years ago, Apple published detailed specifications for how to construct an app so this problem won't happen. And it just so happens that Chrome doesn't follow those specifications. I don't know about the other apps. But because Chrome is Google, everyone now wants to build their apps just like Chrome. So it could be anything really.

Sorry to be the bearer of bad news, but there's no solution to this problem.

upon using etc check to see it says other profiles may be installed but none show at all, I went ahead and checked with terminal and no other profiles came up, gemini informed me this is just an issue with the date and time auto being locked to on

gabe262 wrote:

upon using etc check to see it says other profiles may be installed but none show at all, I went ahead and checked with terminal and no other profiles came up, gemini informed me this is just an issue with the date and time auto being locked to on

Not sure if that is true or not. I have Date & Time set to Auto and don't see that profile warning. The Developer of EtreCheck may chime in here if they have seen this reported or offer more information, as they do participate in these forums. Unfortunately direct messaging is not an option here, so they would have to see the post.

I have exactly the same problem. However of the programs listed by the original poster (OBS, TiktokLiveStudio, Chrome, discord, VLC) I only have Chrome and VLC. I checked Local Networks and there's nothing "unknown", only Epson Installer, Google Chrome, and Spotify. I'm wondering, should I just try to clean house and get rid of all of them – even if none of them are named "unknown" ??

I deleted all of them (Epson installer, Chrome, Spotify) and restarted. I still get the "Allow <unknown>..." pop-up window. And now Spotify and Teams show in the Local Networks list, both gave me a pop-up window with name (Spotify and Teams) and I declined both. Really annoying, I would have assumed that Apple wouldn't allow anything to identify as "unknown". Oh-well...

etresoft – thank you for giving me a hand here, much appreciated!!

I have my everyday user (standard privileges) and my admin separated.

~/Library/LaunchAgents for my standard user shows:

.../LaunchAgents> ls

com.amazon.music.plist

com.amazon.music.startup.plist

com.epson.epsvcp.plist

com.microsoft.EdgeUpdater.update-internal.109.0.1518.89.plist

com.microsoft.EdgeUpdater.update.plist

com.microsoft.EdgeUpdater.wake.109.0.1518.89.plist

as my admin I get:

.../LaunchDaemons % ls

com.adobe.ARMDC.Communicator.plist

com.adobe.ARMDC.SMJobBlessHelper.plist

com.epson.RemotePrintIODaemon.plist

com.google.GoogleUpdater.wake.system.plist

com.google.keystone.daemon.plist

com.microsoft.EdgeUpdater.update.system.plist

com.microsoft.EdgeUpdater.wake.system.plist

com.microsoft.OneDriveStandaloneUpdaterDaemon.plist

com.microsoft.OneDriveUpdaterDaemon.plist

com.microsoft.autoupdate.helper.plist

com.microsoft.office.licensingV2.helper.plist

com.microsoft.teams.TeamsUpdaterDaemon.plist

com.skype.skypeinstaller.plist

org.macosforge.xquartz.privileged_startx.plist

us.zoom.ZoomDaemon.plist

.../LaunchAgents % ls

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist

com.epson.Epson_Low_Ink_Reminder.launcher.plist

com.epson.RemotePrintIOHelper.plist

com.epson.esua.launcher.plist

com.epson.eventmanager.agent.plist

com.epson.scannermonitor.plist

com.google.keystone.agent.plist

com.google.keystone.xpcservice.plist

com.microsoft.OneDriveStandaloneUpdater.plist

com.microsoft.SyncReporter.plist

com.microsoft.update.agent.plist

org.macosforge.xquartz.startx.plist

us.zoom.updater.login.check.plist

us.zoom.updater.plist

~/Library/LaunchAgents % ls

com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist

obviously should do some cleaning (clean install?) given that I haven't used Skype and xquartz for many years...

Again, your help and advice is greatly appreciated.

Etresoft; thanks again.

I did go to the absolute paths, I just edited the front part to ".../" to not show computername and username here.

I removed macosforge/xquartz from both /Library/LaunchAgents and /Library/LaunchDaemons and Skype as well from /Library/LaunchDaemons (using sudo rm -rf) and they no longer show when I do an ls, and did a restart after that, but it didn't help.

I should clarify, I have 2 standard user accounts (and one admin) and I get the pop-up when I log out of one of the accounts and am at the login screen.

I just wanted to make sure my Mac wasn’t being hacked :( stuff like this is so annoying and anxiety ridden