Why Foreman sometimes asks for your password

Foreman asks for your administrator password when you try to change something that macOS itself protects: ending a process that belongs to macOS or another user, raising a process’s priority, starting or stopping a system service, or disabling or removing a system-wide startup item. These are things macOS only lets an administrator do. Everyday actions on your own apps, such as End Task, Efficiency Mode and Suspend, do not need a password.

If Foreman asks and you were not expecting it, the question to ask is what you clicked, and the list below tells you.

The short version

macOS divides the processes on your Mac by who owns them. Your apps run under your account. Many parts of macOS run as root or under a system account, and on a shared Mac some processes belong to other users. To change those, macOS wants proof that you are an administrator, and it is the same rule whether you use Terminal, a Mac app or anything else. Foreman asks for the password first, when you choose such an action. The User column on the Processes page (from the header’s menu) and on All Processes shows who owns each process.

If the account you use is not an administrator account, you will need the password of one that is.

When Foreman asks

Here is every case in the app where an administrator password comes up.

Ending processes that belong to macOS or other users. On the Processes and All Processes pages, End Task works without a password on your own apps. For processes that belong to macOS or to other users, Foreman asks for an administrator password first. Foreman also warns you about the few that matter. Before ending something like WindowServer or loginwindow, it tells you what will happen, which is that you are logged out. And it never offers to end kernel_task or launchd at all.

Raising priority. On the All Processes page, Set Priority has four levels: Normal, Below Normal, Low and Lowest. Lowering a process’s priority is allowed for your own processes. Going back up to a higher priority needs an administrator password, because macOS only lets an administrator raise priority. That surprises people: slowing something down is free, but undoing it is not. How to stop one app from slowing down everything else on your Mac covers when each is the right tool.

System services. The Services page lists macOS’s background services, for you and for the system. Start, Stop and Restart work on your own services without a password. System services need an administrator password.

System startup items. On Startup Apps, Disable and Enable work on your own items directly. System daemons, which run for the whole Mac rather than for you, need an administrator password to change.

Cleaning up leftovers. An item marked “Program missing” is a startup item whose app has been deleted. You can remove them one at a time with Remove…, or all at once with Clean Up Leftovers. If some of them are system-wide, Foreman asks once for a single administrator password for all of them. Their files go to the Trash, so you can look at what was removed.

When it does not ask

Foreman is not asking for a password to get around macOS or to look at anything extra. Most of what it does needs none:

• Reading the processes, the totals and the graphs.
• End Task, Force Quit and Restart on your own apps.
• Lowering the priority of your own processes.
• Efficiency Mode on any process running under your account, including many of macOS’s own background processes. Foreman does not offer it for processes owned by root, a system account or another user.
• Suspend… on processes running under your account. It is not offered for root, system or other users’ processes, or for parts of macOS such as Finder and the Dock that would freeze the Mac.
• Starting and stopping your own services, and disabling and enabling your own startup items.

If you see a password prompt where you did not expect one, check the User column to see who owns the process. Some macOS processes, such as nsurlsessiond and cloudd, run two copies with the same name, one under your account and one under a system account, and only your copy can use Efficiency Mode and Suspend.

Is it safe to type it

The prompt is a request that you confirm you are an administrator before a protected change. It appears when you start the change, and it relates to that one action. If it appears at a moment when you did not click anything, do not type your password. Cancel it and look at what triggered it.

You can also decline. If you cancel the prompt, the protected action does not happen.

What to try before you give it

Sometimes the better answer is not to end the process at all.

• If a system process is busy, it is often doing real work, such as indexing files after an update, and it settles on its own. What is mds_stores on a Mac is one example.
• macOS restarts many of its own processes by itself when they end, so ending one often changes nothing for long.
• Some system processes are best left alone. Ending the login session (loginwindow) logs you out, and ending the window server does the same, which is why Foreman warns first.

If a process is not responding and it is yours, End Task or Force Quit in Foreman does the job without any password.

A worked example

Say Spotlight indexing (mds_stores) has been busy for a long time and you find it in All Processes. It runs as root, so End Task makes Foreman ask for your administrator password. You type it, the process ends, and macOS starts a fresh copy when it is needed, because that is how many of its services are set up. The CPU figure drops and, if the cause was a bad state, stays down. If the cause was real work, it climbs again, and the better fix was to wait. The password did what it should; it just could not tell you which of the two cases you were in.

Where this leaves you

A password prompt in Foreman means you chose an action that macOS reserves for administrators. It is not a sign that something is wrong, and it is not required for the everyday jobs of finding a heavy app and dealing with it.