What is nbagent on macOS?

Last updated: 2026-07-31

What it is

nbagent is a user-level background agent supplied and signed by Apple as part of macOS. Its executable is stored inside Apple’s private Noticeboard framework at /System/Library/PrivateFrameworks/Noticeboard.framework/Versions/A/Resources/nbagent.app/Contents/MacOS/nbagent, and its bundle identifier is com.apple.nbagent.

The name refers to Noticeboard, not NetBIOS. nbagent works with the Software Update framework to poll Apple’s Noticeboard catalog, retrieve notification assets, and present notices related to system updates, operating-system upgrades, or Apple product information. “Noticeboard” describes the catalog-and-notification system behind that work.

This is narrower than managing the complete software-update process. nbagent is not the primary service responsible for downloading or installing an entire macOS update. Update detection, preparation, and installation involve other parts of Software Update. Seeing nbagent active therefore does not mean that a full operating-system package is being downloaded.

The verified Apple component should be found at the system path above and carry Apple’s platform signature. A program using the same process name from another path does not automatically have the same identity and should be checked separately.

Why it talks to the network

launchd schedules nbagent to perform a maintenance poll about once every 24 hours. That scheduled check is not its only possible trigger. nbagent may also wake when an existing Noticeboard notification is delivered, clicked, postponed for a later reminder, or removed. Other system components can request a poll through XPC as well.

During this work, nbagent contacts categories of services associated with Apple’s software-update catalog and content distribution. It needs the catalog to learn which Noticeboard material is available and the distribution service to obtain the relevant notification resources. These resources support the notices nbagent handles; they are not, by themselves, evidence that nbagent is fetching a complete macOS installer.

There is no verified, public list of every hostname used specifically by nbagent on current macOS systems. Apple’s wider software-update infrastructure uses multiple services, but it would be inaccurate to attribute every domain associated with Apple software updates directly to nbagent. If a firewall or network monitor shows a particular destination, that observation should be treated as evidence from that Mac rather than expanded into a universal nbagent domain list.

How much traffic is normal

Apple has not published a normal traffic range for nbagent, and reliable measurements of its notification-resource sizes are not available. There is therefore no defensible fixed allowance in kilobytes, megabytes, or any other unit.

Its verified duties suggest a low-frequency, burst-like pattern: an occasional catalog check followed, when needed, by transfers of notification resources. That traffic would normally be much smaller than a complete macOS update package because nbagent is handling catalog and notice material rather than the full update. This is a qualitative expectation, not a measured limit.

A quiet period is also unsurprising because the scheduled maintenance poll is only about daily, while the other wake-ups depend on Noticeboard events or an internal XPC request. Conversely, a single short burst does not prove that macOS is downloading an operating-system update. Without a published range, the useful comparison is nbagent’s behavior over time on the same Mac, not an invented universal threshold.

Can you turn it off

The practical recommendation is to keep nbagent available. Apple does not provide a dedicated System Settings switch for nbagent or Noticeboard catalog polling, so there is no supported settings path to follow.

A third-party firewall can block its connections, but blocking is not the same as cleanly disabling the underlying service. If nbagent cannot reach the relevant catalog or content service, its notification resources may stop refreshing. The result can be missed notices about system updates or upgrades, including notices that might have been useful.

Blocking nbagent also does not guarantee that every software-update notification will disappear. Modern macOS update detection and notification do not depend on nbagent alone, and other Software Update services continue to have their own roles. For the same reason, blocking nbagent does not formally turn off automatic updates or the operating system’s other update checks.

There is no verified basis for describing the block as risk-free or as a supported way to remove only unwanted promotional notices. It changes one notification path without providing a complete, Apple-supported update-control mechanism.

What people get wrong

• “nbagent handles normal website push notifications.” That is not its verified primary function. The local executable links directly to SoftwareUpdate.framework and contains logic for Noticeboard catalog polling and notification-resource installation. Safari website notifications are a different use case and have not been established as nbagent’s main responsibility.

• “The ‘nb’ in nbagent means NetBIOS.” Here, “NB” refers to Noticeboard. The macOS service associated with NetBIOS is netbiosd, which is a different process with a different purpose.

• “nbagent downloads or installs the entire macOS update.” nbagent deals with the Noticeboard catalog and associated notification assets. Detecting, preparing, downloading, and installing complete updates involves other Software Update services. Activity from nbagent alone is not proof of a full update transfer.

• “It is always safe to block because it only removes annoying advertising.” Apple provides no supported nbagent-off switch, and the verified scope is not limited to advertising. Blocking its catalog and resource traffic can prevent useful system-update or operating-system-upgrade notices from refreshing.

• “Blocking nbagent disables every update prompt and automatic update.” nbagent is only one part of a broader system. Update checks and notifications do not rely exclusively on it, so blocking this process cannot be treated as a comprehensive update setting.

• “nbagent is a third-party application or malware.” The copy in Apple’s read-only system framework, carrying Apple’s platform signature, is a macOS component. The name alone is not enough to authenticate an arbitrary executable, however. If an nbagent process comes from another location, verify that copy independently rather than assuming it is the Apple component.

Seeing what it actually used

To answer this for your own Mac, use Bytetally’s per-process statistics and inspect the sent and received traffic attributed to nbagent. Observe it across enough time to include its roughly daily maintenance poll, then compare individual bursts instead of relying on an unsupported universal limit. This gives you a local measurement without guessing at resource sizes or hostnames.

Related processes

Common questions