The internet has been abuzz over the past year with discussions of whether or not Apple has been silently analyzing users’ photo libraries to send to law enforcement. Independent testing has confirmed beyond a shadow of a doubt that it does not.

But, high mediaanalysisd CPU usage has been reported from various sources. This background processing can load the Mac‘s CPUs and slow down your machine to varying degrees. Even in the absence of any silent Apple reporting, mediaanalysisd is simply scanning photo libraries for AI purposes such as face recognition and Spotlight indexing.

In any event, you may want to disable mediaanalysisd to prevent excessive CPU usage.

To do so, you’ll first need to disable macOS’s System Integrity protection (SIP).

How to disable System Integrity Protection in macOS

To disable SIP in macOS, follow the instructions on Apple’s SIP page.

Apple warns that disabling System Integrity Protection should only be done temporarily, and it should be reactivated as soon as possible afterwards. The company also says that it can leave your computer “vulnerable to malicious code.”

Disabling SIP involves restarting your Mac in recovery mode, and in Terminal entering:

csrutil disable

You may or may not also need to unlock the LaunchAgents directory itself by changing the directory’s permissions. Just be sure to set permissions back to what they were when finished. You can use a 3rd-party utility such as BatchMod to do so:

Don’t change the user or group permissions on the folder, just the -rxw permissions. Be sure to change them back to their original state when done.

How to remove or disable com.apple.mediaanalysisd.plist

Next, remove /System/Library/LaunchAgents/com.apple.mediaanalysisd.plist in Terminal by typing:

sudo rm -R /System/Library/LaunchAgents/com.apple.mediaanalysisd.plist

and pressing Return.

Then restart your Mac.

Apple’s com.apple.mediaanalysisd.plist is the Launch Services daemon loader file which tells macOS where to find the mediaanalysisd binary and how to launch it. Once you remove com.apple.mediaanalysisd.plist, macOS will no longer launch it on startup or intermittently.

If macOS auto-regenerates the .plist file, you’ll need to edit the file directly to set the com.apple.mediaanalysisd.photos setting to NO. The default is YES.

Beware that editing this file may alter the behavior of your Mac, or even render parts non-functional so do so at your own risk.

You may also want to try changing the value of com.apple.mediaanalysisd.realtime from YES to NO. In fact, you could try disabling all the MachServices settings except for the two Homekit ones. But again, it’s not clear currently what each of these does.

But again, be aware that changing these settings will disable some macOS functionality — namely Spotlight indexing and text selection in Photos and Preview.

You may also want to play with the EnableTransactions setting, although it’s not clear yet whether this value is what tells the daemon to use network transactions or not.

Apple’s plist files are just XML files. So, if you know XML, you can use any text editor or use Apple’s Xcode development tool to modify them.

When editing .plist files in Xcode, you get a built-in editor which converts the XML into a table of editable fields with data types and presets for some types in the center column:

The .plist also gives us a clue as to where the actual daemon binary lives on disk in macOS. Under the “ProgramArguments” field: In “Item 0” we see a value of:

/System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd

So the mediaanalysisd binary itself lives inside the MediaAnalysis.framework bundle. It’s not clear what disabling this bundle would do, but do so at your own risk as we haven’t determined the impact of removing this framework from the system.

Peeking into the .plist LaunchEvents

Examining the LaunchEvents->com.apple.xpc.activity dictionary in the .plist file, we see a few more interesting items. In fact, that dictonary contains five photo analysis items:

1. com.apple.mediaanalysisd.photosanalysis
2. com.apple.mediaanalysisd.photos.visualsearch
3. com.apple.mediaanalysisd.photos.face
4. com.apple.mediaanalysisd.photos.maintenance
5. com.apple.mediaanalysisd.photos.ocr

XPC (sometimes called IPC) is Apple’s interprocess communications technology by which applications can talk to each other through XPC Services – including across networks.

The com.apple.mediaanalysisd.photos.ocr task is obviously used to convert words in images into text, both for selection, and for Spotlight.

But the full extent of what com.apple.mediaanalysisd.photosanalysis and com.apple.mediaanalysisd.photos.maintenance are doing is still unknown.

The “ExpectedDuration” field of each com.apple.xpc.activity item is the time the task runs in seconds. So “3600” would be 60 minutes – one hour.

The “Priority” and “CPUIntensive” fields are also interesting. It’s not clear what setting the CPUIntensive field to NO would do to system performance, and there’s scant Apple documentation on it.

The “Interval” field is the time between process launches, also in seconds. In the case of com.apple.mediaanalysisd.photosanalysis, this is set to 7200 — which means 120 minutes.

The Interval field for the com.apple.mediaanalysisd.photos.maintenance service is set to 86400 by default, which means it runs once every 24 hours.

There are also fields to signal whether a task repeats, whether it runs during screensavers, and whether it runs during PowerNap.

Final thoughts and additional info

Most of macOS’s daemon architecture is run by a background daemon called launchd which manages the launching, running, and quitting of daemons. You can learn more about launchd in Terminal using the man page:

man launchd and pressing Return.

There is another Terminal command, launchctl, which interfaces with launchd to control daemons and background processes. It too has a man page for usage and more info.

In Terminal you can also view all running processes (apps and daemons) on your Mac by typing the top command:

top

and pressing Return.

An easier and cleaner way is to use Apple’s /Applications/Utilities/Activity Monitor app. Typing “media” into its search field will reveal mediaanalysisd usage:

If you double-click a process’s name in Activity Monitor, you’ll get a window with more detailed info on the process:

Under the Open Files and Ports tab we can also see a little more about where mediaanalysisd is interacting with the filesystem. We also see that it is using several other Apple frameworks:

1. CoreNLP.framework
2. DataDetectorsCore.framework
3. Lexicon.framework
4. MetalPerformanceShaders.framework

We also learn from this log that there is one other mysterious Apple daemon in the system: analyticsd. There is an analyticsd man page, but it has little info and simply says it’s used for “diagnostics.”