What is NRDUpdated on Mac, and can I turn it off?

Last updated: 2026-07-31

What it is

NRDUpdated is an Apple-supplied macOS service whose formal name is the “Network Recovery on Disk Update daemon.” Despite the word “Network” in that name, its documented responsibility is not limited to cloud-based Internet Recovery. It keeps the System Recovery environment stored on the Mac’s disk up to date.

The service is installed at /usr/libexec/NRDUpdated and uses the code-signing identifier com.apple.mobile.NRDUpdated. Apple also supplies its system LaunchDaemon configuration. These local system artifacts identify NRDUpdated as a built-in platform component, not an application added by third-party software.

NRDUpdated is not intended to be launched manually. launchd starts it when the system needs it, and it runs under the dedicated _softwareupdate account. Its appearance in Activity Monitor therefore does not, by itself, indicate that anything unusual has been installed or that a user started it.

Why it talks to the network

NRDUpdated uses Apple’s MobileAsset and software-update infrastructure to obtain the component that handles recovery updates. Specifically, it queries for and downloads the MobileAsset type com.apple.MobileAsset.RecoveryOSUpdateBrain. That component, described as the update brain, then performs the workflow for querying, downloading, and installing updates to the recovery environment.

Verified triggers include an on-demand software-update request, a periodic scan when background activity is allowed, and a new scan after an update component is missing, outdated, or has failed. Apple has not published the exact scheduling interval, so a particular scan should not be described as hourly, daily, or tied to another fixed cadence without separate evidence.

The remote side can be identified at a general level as Apple’s MobileAsset catalogs, software-update catalogs, and associated content-distribution infrastructure. Apple has not published a stable list of hostnames specifically for NRDUpdated, so seeing it connect does not justify assigning every Apple update hostname to this one process. Some device-authorization traffic in the wider update workflow may also be performed by other macOS services rather than NRDUpdated itself.

How much traffic is normal

There is no verified normal byte range for NRDUpdated, and Apple does not publish one. A quiet Mac will usually show no continuous transfer from the daemon. When it is only checking for available updates, the activity should mainly consist of a relatively small amount of catalog and metadata traffic.

A more noticeable download can occur when NRDUpdated needs to fetch the RecoveryOS update brain or when the recovery update workflow obtains system components. That burst is better compared with a system-component update than with an ordinary web request. However, there is no reliable basis for assigning it a specific number of megabytes or gigabytes.

It also has not been verified that NRDUpdated directly downloads an entire recovery image. The update brain it loads, or another helper participating in the workflow, may perform some of the actual transfers. Process attribution therefore matters: a large update-related download happening at the same time is not automatically proof that every byte belongs to NRDUpdated.

Can you turn it off

Apple does not provide a separate NRDUpdated switch in System Settings, so there is no supported settings path to follow. It is part of the operating system’s recovery-update mechanism rather than an independently configurable background application.

Forcibly stopping or persistently blocking NRDUpdated removes the normal update guarantee for the on-disk System Recovery environment. It may also interfere with later macOS update work or preparation for recovery. That does not mean the existing recovery environment is proven to fail immediately; the more accurate consequence is that it can become outdated over time.

Force-quitting the daemon in Activity Monitor is also not a permanent configuration change. At most, it may interrupt or reset a single stuck update session. Because launchd manages the service, macOS can start NRDUpdated again when the system next requires it.

What people get wrong

• “NRDUpdated is malware, cracked software, or a third-party program.” It is an Apple component. The executable supplied with macOS, its Apple code-signing identity, and its system LaunchDaemon all support that identification.

• “It only manages cloud-based Internet Recovery.” That description is too narrow. Apple calls it the Network Recovery on Disk Update daemon, and the local manual page says its job concerns the Mac’s on-disk System Recovery environment.

• “If it is running, it must be downloading the entire macOS installer.” Running does not establish that. NRDUpdated may be scanning a MobileAsset catalog, loading the RecoveryOS update brain, or performing a status check without downloading a complete installer.

• “It is a permanent telemetry uploader sending user data.” There is no reliable evidence for that claim. Its verified role is recovery-system updating. The update protocol may exchange metadata required for compatibility checks and device authorization, but Apple has not published the specific fields involved.

• “Permanently disabling it is a safe network optimization.” Apple provides no independent off switch, and disabling it trades away the normal ability to keep System Recovery current. The immediate recovery environment may continue to work, but it can gradually fall behind available updates.

• “Force Quit in Activity Monitor is a long-term fix.” A force quit can only affect the current process or update session. It does not remove the LaunchDaemon, and launchd can start NRDUpdated again when macOS needs it.

Seeing what it actually used

If NRDUpdated appears during a traffic spike, first measure the process rather than estimating from the system-wide total. Bytetally’s per-process statistics can show how much traffic was attributed to NRDUpdated and when the transfer occurred. Compare an idle period, a metadata-only check, and any later burst before deciding whether the activity is exceptional.

Related processes

Common questions