>

Persistently Disable a System Daemon with launchctl disable

launchctl enable/disable writes a persistent override so a daemon stays off across reboots and updates of its plist.

macOSlaunchctllaunchdhardeningMedium risk
Run `sudo launchctl disable system/<label>` to keep a daemon off permanently, and `sudo launchctl print-disabled system` to review the list.

01Command

Command
$ sudo launchctl disable system/com.apple.example.daemon
# Confirm current state:
sudo launchctl print-disabled system | grep example

02What it does

Unlike `launchctl bootout`, which only unloads a service until its plist is re-read, `disable` records a per-user or per-system override that launchd honors on every boot. The target takes the unusual `system/<label>` form — the domain, a slash, and the service label from the plist, not the file path. This is the supported hardening move for shrinking a Mac's attack surface without deleting Apple's files, since disabling survives macOS updates that would restore a removed plist.

03Risk

RiskMedium risk
RequirementsSudo (admin account)
!Warning: Some Apple services are protected by SIP and re-enable themselves; check `print-disabled` output rather than assuming the disable took effect.

04Undo

Undo
$ sudo launchctl enable system/com.apple.example.daemon

05Sources

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Inspect and Restart Services with launchctl print
macOSdaemonslaunchctllaunchd

The modern launchctl interface — full state of any launchd job plus a restart that actually works.

Medium risk ✓ 2026-09-17