Finding the cause of Allow

Win W wrote:

Thanks, Steve! I finally wound wound up having to buy the full version of the software you recommended. At first I thought it had cleaned up one piece of software that was unsigned, and that was causing the issue. It worked for about 24 hours and now it’s come back again with the “Unknown “. So now that I own the paid version of this software, everyone’s recommended. I’ll go back and see if I can find something else that seems to be causing this very annoying problem. I really appreciate everyone’s help, and I’m always open to suggestions. Thanks again

In addition, you can check in System Settings=> Privacy and Security.

Scroll down until you find the Local Network settings, and look in those. For my new M5 MacBook Air computer there was almost nothing there, but on my other Macs there is a list of applications and processes that can "find and communicate with devices on your local network." Sounds a lot like your "unknown" error message, right?

Each item listed there can be turned off. You will want to handle this thoughtfully since some of them, like items for printers or scanners, do need to access the network and devices on it. For instance I see various Epson items for the two printer/scanners that we have on the network, I see a DropboxFileProvider item (which I want and need), I see Microsoft 365 apps. Even so, find each item on your Mac (often an app in the Applications Folder, but sometimes these apps are hidden somewhere else, so the FindAnyFile tool is useful here as it will search where Spotlight does not go) and inspect it for being some ancient no longer used version or some other issue, and turn it off if you want to test. You can also cross reference these items with the list of items in the Etrecheck report; if Etrecheck indicates a specific item was not properly signed, you might consider deleting or uninstalling it. An outdated or incorrect item in this Local Network settings area can easily cause those error messages.

Also check in System Settings => General => Login Items & Extensions for anything that strikes you as odd, or for things that you are not familiar with.

Look in Printers and Scanners for any no longer used devices that might have a leftover process or driver.

Finally, you can look in the Network settings. Choose Firewall => Options, and look over the items listed which allow or block incoming connections. Lots will be listed and you won't understand what all of them are for, but some will definitely look outdated. For instance, we recently recycled our Canon Printer/Scanner that dated from 2010 (!), and I see the Canon IJScanner1.app, canonijnetwork.bundle still listed there so I plan to turn those off and find them and remove them, wherever they are. It was in this list that I found that the Firewall was blocking Microsoft Messenger, even though Microsoft Messenger has been gone for over 15 years and no longer exists, but that leftover reference caused the "unknown" error message.

I agree with MrHoffman to use EtreCheck. You have a process listed in one of your Launch Folders that will be identified as Not Signed and will need to be removed. Usually this is an old app that was installed on a previous OS and has just continued to be migrated over to newer OS versions. If you are unable to find it yourself in the EtreCheck report, feel free to post it here. It contains no personal information and you don't have to pay anything to do that.

https://discussions.apple.com/docs/DOC-250000211

Your Mac is protecting a process from running on your computer because it has not been Signed or it has an improperly configured plist, and that is a good thing.

etresoft wrote:

I'm certainly not going to tell you everything's fine with the operating system. I know that's not true. But in this particular case, the problem is a 3rd party app.

I have found that Etrecheck can help sort things like this out. The full disk access version (paid version) works best for this.

In my case, I got a new M5 MacBook Air. It's for my wife to use when we travel; her normal computer is a 2021 iMac which is still on Sonoma because she does not like me to update or upgrade. Since the customer is always right, I try to respect her wishes, although at some point Microsoft will force the upgrade of her iMac OS since our MS-365 subscription will require a more recent OS. (All my other Macs are fully updated to the latest version they can take.)

In any case, I used Migration Assistant (Setup Assistant, on first boot), and migrated over accounts and settings, but only files, no apps. So all apps were installed fresh. So far, these non-Apple apps include only Firefox, Dropbox, and MS-365 (subscription). Dropbox and MS-365 do create some background processes, mostly for update checks and file sync (for Dropbox).

I did see that "allow <unknown> to find files on the network" initially with this new Mac that had very little installed. The notification appeared only when logging out or shutting down. So I surmised that something "leftover" was migrated over. It actually helps to review carefully the Etrecheck Report. Mine did not provide any information about unsigned apps and the like, after all the Mac is very new with little installed so far. However the Etrecheck Report did show this:

Firewall Blocked Apps: Microsoft/com.microsoft.Messenger

I thought this might be a clue. Although the Microsoft Messenger app no longer exists, I did find a com.microsoft.Messenger plist file dated 2010 and also a similarly named file in a cache folder, also dating from 2010. I deleted both of these and emptied the Trash, and so far have not seen any repeat of that "allow 'unknown'" notification.

It might return but so far has not.

My point is that in addition to the obvious "unsigned files" and the like that Etrecheck finds and lets the user know about, it finds other things as well that can provide valuable insights. I don't know which of those two files was causing this, but Etrecheck did point me in the right direction. I did have to use FindAnyFile to actually find those files as they were buried in the System Folder (not the user System folder) and somewhat obscure. Maybe this is a minor flaw in Setup/Migration Assistant that brought over those files and then Golden Gate somehow keyed off them. Since neither was an app nor an extension, I was a bit surprised about this but there is a lot in the modern macOS that I do not understand. I do know that sometimes anomalies can occur when the macOS "remembers" something that it should not be using anymore, and in this case it might have been those obscure files from 2010 for an app that no longer exists (hence maybe the reason it was called "unknown" in the Notification).

Pay particular attention to the install date of those Launch processes too in the EtreCheck report. Along with some being Not Signed, you may still find some older pieces of Software with a plist that has not been correctly formatted to display the package name. Typically these are so old, you are not even using them anymore or they have not been updated for many years and now being flagged by the system. Those remain in the Launch folders when the app itself is deleted, instead of using the uninstaller provided with the app, since they were probably installed with their Installer.

Nowadays, installers are not needed since all the Launch files can be included in the App Bundle, but some Developers are slow to adopt this preferred method. Without having to use an Installer, you just need to delete the App and all of their Launch processes are deleted as well since they are in the App Bundle, and not being installed in those locations on your computer.

You have one or more apps running in the background that are trying to query your local devices, printers, other computers, etc. This could be some kind of "fingerprinting" effort to uniquely identify you and your internet activity.

It probably isn't ExpressVPN. If they wanted to sell your data, they have tons of it. This is some other app that could be trying to identify you regardless of your VPN.

Obviously it's difficult to identify which app this is. The reason Apple says "unknown" is because the app isn't signed or has otherwise scrambled its identity. This is common practice. Certain popular apps use an auto-updating process that actually doesn't delete the old versions, and reuses low-level identifiers. This confuses the operating system so it can't tell which app it is, hence the "unknown".

You certainly won't find it in console. You can look in System Settings > Privacy & Security and look for Local network. Usually apps that exhibit this problem will be listed multiple times.

Tried entirely removing the VPN app?

Tried removing the VPN?

If not… Please download and run EtreCheck (the free version, don’t need the paid version here), and use the Share to share the results to the Mac clipboard. Then open a new reply here, and press the Additional Text button (the button that looks like a printed page), and paste and post the hardware and software configuration report here. From that, we can get a little more detail about what is installed and what is running here.

Please post the full report according to the following:

Copy the report

and after clicking on the Reply button use the Additional Text button to paste the report in your reply.

Then we can examine the report and see if we can determine the cause of the problem.

I can't find anything that I KNOW of running in the background. I've looked at Activity Monitor...NADA. I looked in Console to see what was being activated when I "wake up" my Mac after being away for a while. This whole problem started with "Golden Gate" which, to me, is "Broken Gate". It has dorked up more than just my Mac and MacBook. At least I got my Synology NAS figured out and it logs on just fine. I moved my printer from wireless to wired to see if that will help. Nope. I'm gonna contact ExpressVPN to see if they might know, although I don't think it is the issue since I don't have it set to auto log on or anything.

Win W wrote:

I can't find anything that I KNOW of running in the background. I've looked at Activity Monitor...NADA. I looked in Console to see what was being activated when I "wake up" my Mac after being away for a while.

You won't be able to find these things in Activity Monitor, and especially not in Console.

This whole problem started with "Golden Gate" which, to me, is "Broken Gate".

I'm certainly not going to tell you everything's fine with the operating system. I know that's not true. But in this particular case, the problem is a 3rd party app.

Win W wrote:

TA DA! That found the problem...I hope. It went right to a legitimate program that did not have a digital "signature". That's OK! Let's see how well this works out.

Great to hear, thanks for the update!

Thanks, Steve! I finally wound wound up having to buy the full version of the software you recommended. At first I thought it had cleaned up one piece of software that was unsigned, and that was causing the issue. It worked for about 24 hours and now it’s come back again with the “Unknown “. So now that I own the paid version of this software, everyone’s recommended. I’ll go back and see if I can find something else that seems to be causing this very annoying problem. I really appreciate everyone’s help, and I’m always open to suggestions. Thanks again

TA DA! That found the problem...I hope. It went right to a legitimate program that did not have a digital "signature". That's OK! Let's see how well this works out.

Now, if I could just get the CarPlay Siri and Messages issue sorted out, I'll be good to go!