38

The active window on my machine occasionally loses focus. The active app remains the same -- if I was in Chrome before, I'm still in Chrome now -- but the active window is no longer active. No window is active. This is frustrating; it happened while typing this question, and my keystrokes suddenly stopped registering.

I believe that some other app is stealing focus, but that it itself has no UI to display, so the active window becomes not active, but the active app remains active.

The question is: How do I track down the offending app, so that I can angrily delete it? Normally in cases of focus theft, the culprit is obvious, because it has focus. In this case, I'm stumped.

Josh Bleecher Snyder
  • 483
  • 1
  • 4
  • 5
  • You could try the `Apple > Force Quit...` menu to see if there is anything running that shouldn't be. – Michael Frank Mar 26 '14 at 21:18
  • 1
    @MichaelFrank It won't show applications that have no menu bar (e.g. those with `LSUIElement` set to `true` in `Info.plist`). Those are perfectly capable of that behavior. – Daniel Beck Mar 27 '14 at 00:08
  • @DanielBeck Ahh, gotcha. That's handy to know. – Michael Frank Mar 27 '14 at 00:09
  • 1
    FYI, I asked basically this same question on Apple SE: [Is there a way to detect what program is stealing focus on my Mac?](http://apple.stackexchange.com/questions/123730/is-there-a-way-to-detect-what-program-is-stealing-focus-on-my-mac) – Kevin Reid Mar 27 '14 at 00:12
  • `tell application "System Events" to display alert ((name of first application process whose frontmost is true) as string)` unfortunately does not consider processes without menu bar. – Daniel Beck Mar 27 '14 at 00:15
  • Does searching the list of applications started on login help? *System Preferences » Users & Groups » (Your Username) » Login Items* – Daniel Beck Mar 27 '14 at 00:16
  • @DanielBeck this is a work laptop. It has all kinds of stuff running on it, many of them installed not by me. I'm afraid that inspection is unlikely to reveal the answer I need. I looked at the Login Items, but they all have a menu bar. I suppose I could write a script to trawl through my hard drive, parse `Info.plist` for `LSUIElement` set to `false`, and start there... – Josh Bleecher Snyder Mar 27 '14 at 19:20
  • Worked great. AirServer was stealing my focus. WHY!!!! – Be Kind To New Users Apr 24 '19 at 23:14

2 Answers2

55

Here's a script that will tell you which app is activating without telling you. I adapted it from an answer to @KevinReid's question over on Apple SE.

Leave it running in a terminal, wait for the rogue app to steal focus, and see which app is listed last. (For me: Google Drive. Others have reported Symantec AV stuff.)

#!/usr/bin/python                                                                                                       
    
try:
    from AppKit import NSWorkspace
except ImportError:
    print("Can't import AppKit -- try `pip install PyObjC`")
    print("(see instructions for running in a venv with PyObjC)")
    exit(1)
    
from datetime import datetime
from time import sleep
    
last_active_name = None
while True:
    active_app = NSWorkspace.sharedWorkspace().activeApplication()
    if active_app['NSApplicationName'] != last_active_name:
        last_active_name = active_app['NSApplicationName']
        print('%s: %s [%s]' % (
            datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
            active_app['NSApplicationName'],
            active_app['NSApplicationPath']
        ))
    sleep(1)

Note [2022]: newer versions of macOS don't ship with the PyObjC bindings this script needs. If you get an ImportError, follow these steps to run the script:

  1. Create a directory, and save the script above into it as "focus-stealer.py"
  2. In a terminal in that directory enter these commands: 
    /usr/bin/python3 -m venv venv
./venv/bin/python -m pip install PyObjC
    (This creates a new, isolated Python virtual environment, just for this script, and installs PyObjC into it. This avoids modifying your system Python installation or needing to use sudo.)
  3. Now you can run the script. In a terminal in that same directory run: 
    ./venv/bin/python ./focus-stealer.py
    (In the future, you can skip directly to this step—no need to reinstall things.)
medmunds
  • 666
  • 6
  • 9
  • This script tells me my culprit is `Google Drive [/Applications/Google Drive.app]` – MarkHu Apr 06 '15 at 19:58
  • The culprit for me ended up being Symantec. – Josh Bleecher Snyder Jun 19 '15 at 21:29
  • 1
    In my case it is SecurityAgent [/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle] – Ed Randall Mar 09 '18 at 12:53
  • Offending app was Microsoft Update Assistant. I much appreciate this answer, this problem has been driving me nuts for a while. – jamesbev Jan 04 '19 at 15:25
  • 2
    My culprit was JetBrains Toolbox [/Applications/JetBrains Toolbox.app/Contents/jetbrains-toolbox-cef.app], was trying to update itself and crashing in the process. Thank you sooooooo much!! It was also consuming a huge amount of resources. – Gabriel Mar 22 '19 at 11:00
  • For me it was Air Display Helper. Also, I mis-indented the sleep(1) when copy-pasting this, causing it to furiously loop without sleeping and nearly melted my computer. – tboyce12 May 30 '19 at 19:52
  • @EdRandall Did you find a way to deal with SecurityAgent stealing focus? – Mike Oct 16 '19 at 16:51
  • @Mike yes, complained to our desktop support team . – Ed Randall Oct 16 '19 at 17:06
  • So if it's `SystemUIServer` how do I further identify which menu widget it is (suspecting zScaler) – dlamblin Apr 30 '20 at 03:17
  • 2
    Thank you so much for the script. In my case it was Corel's updater (CUH.app). [More on this](https://beesbuzz.biz/blog/7337-Corel-Update-Helper-focus-stealing). – Dae Mar 26 '21 at 13:17
  • Thanks, it was `CUH [/Library/Preferences/com.corel.CUH/CUH.app]` in my case – Joe Black Dec 08 '21 at 09:22
  • Amazing script. in my case it was `/Applications/GlobalProtect.app` (VPN client). – rottweiler Feb 17 '22 at 16:39
  • for me, it was `cisco packet tracer ` – Harsh Jadon Nov 15 '22 at 03:54
  • I am getting Can't import AppKit -- maybe you're running python from brew? I tried the recommendation, but still doesnt work. Try running with Apple's /usr/bin/python instead. Mac OS 13.0.1 – Vidal Graupera Nov 24 '22 at 19:21
  • @VidalGraupera looks like Apple no longer includes the PyObjC bindings with the system Python. I updated the answer with info for how to get them. – medmunds Dec 19 '22 at 19:09
  • Thank you @medmunds !:) – Vidal Graupera Jan 02 '23 at 00:28
1

This will sound silly and absurdly simple... I had the same problem with my laptop when I used the trackpad or built in keyboard. Had two separate laptops give similar experiences after being exposed to a bit of moisture (yes, I spilled on the keyboard).

Adding peripheral mouse and keyboard resolved it for me.

Paul E
  • 81
  • 1
  • 5