MacOS
View all Worklets
MacOSmacOS

macOS - Software Lifecycle - Restart Splashtop Streamer Service

Restart the Splashtop Streamer launch daemon on macOS endpoints to recover remote access without a reboot

Worklet Details

What the Splashtop Streamer restart Worklet does

This Automox Worklet™ keeps the Splashtop Streamer launch daemon alive on macOS endpoints. The Worklet looks for a running Splashtop Streamer process with pgrep -x, and when the process is missing it reloads com.splashtop.streamer.plist through launchctl. Remote support sessions reconnect within seconds of remediation, with no end user interaction and no reboot.

The remediation script targets the system-level LaunchDaemon at /Library/LaunchDaemons/com.splashtop.streamer.plist, which is where the standard Splashtop Streamer installer registers the daemon. If that plist is present, the Worklet calls launchctl bootout system followed by launchctl bootstrap system to recycle the daemon cleanly. If the plist is missing, the Worklet falls back to open -a "Splashtop Streamer", which covers Macs where the application is installed but the daemon was removed or never registered.

After waiting 10 seconds for the service to initialize, the Worklet re-checks pgrep for the Splashtop Streamer process and exits with code 0 on success or 2 on failure. The non-zero exit surfaces in Automox activity logs, so a Mac that cannot self-recover (corrupt installation, revoked TCC grants, missing kernel extension approval) is flagged for hands-on follow-up instead of disappearing into a green compliance report.

Why recycle the Splashtop Streamer service on Mac

Splashtop Streamer is the last-mile remote access path for MSPs and internal IT teams that support distributed Mac fleets. When the daemon stops – after a macOS update, a low-memory pressure event, or a third-party security tool killing the process – the endpoint goes dark to the help desk until someone walks up to it. For unattended servers, lab Macs, signage, and remote-employee laptops, that walk-up cost is the support ticket.

Scheduling this Worklet against the Mac fleet recycles Splashtop Streamer on every endpoint where the SRStreamer daemon has dropped, so the remote support channel is restored before the user notices it left. Recurring evaluation catches the daemon any time macOS, a security tool, or a low-memory pressure event takes it down again.

How Splashtop Streamer recovery works

  1. Evaluation phase: The Worklet runs pgrep -x "Splashtop Streamer" on the endpoint. A live PID returns exit code 0 and marks the endpoint compliant; no remediation is scheduled. A missing process returns exit code 2, which Automox treats as non-compliant and queues the remediation script.

  2. Remediation phase: The Worklet checks for /Library/LaunchDaemons/com.splashtop.streamer.plist. When the plist exists, it calls launchctl bootout system <plist> to tear down the daemon, sleeps 3 seconds, then calls launchctl bootstrap system <plist> to reload it in the system domain. When the plist is missing, the Worklet falls back to open -a "Splashtop Streamer" to launch the GUI application directly. After a 10-second initialization wait, pgrep -x re-checks for the process and the script exits 0 on recovery or 2 on failure.

Splashtop Streamer restart requirements

  • macOS endpoint with Splashtop Streamer for Mac installed and previously enrolled with the Splashtop console

  • /Library/LaunchDaemons/com.splashtop.streamer.plist present from a standard installer run; the Worklet falls back to launching the application if the plist is missing

  • Root context for the Automox agent so launchctl bootout system and launchctl bootstrap system can manage the system domain

  • Network reachability to relay.splashtop.com (and any region-specific Splashtop relay) for the Streamer to re-register after restart

  • pgrep available on the endpoint (shipped by default on macOS 10.12 Sierra and later); no extra packages required

Expected Splashtop Streamer state after remediation

On a successful run, pgrep -x "Splashtop Streamer" returns a live PID, the Splashtop console shows the endpoint as Online, and the Worklet exits 0. Subsequent evaluations find the process running and report compliance without applying remediation again, so the policy is safe to schedule hourly or daily on every Mac under Automox management.

Validate by reviewing the policy run output for the "Splashtop Streamer restarted successfully" line, then confirm the endpoint appears as Online in the Splashtop console and that a test remote session connects. If the Worklet exits 2, inspect /var/log/system.log for launchctl errors, confirm that the LaunchDaemon plist is owned by root:wheel with mode 0644, and verify that the Splashtop Streamer application bundle is intact under /Applications. A persistent exit 2 across reboots usually points to a corrupt installation; pair this Worklet with the Splashtop Streamer install or repair Worklet to recover those endpoints.

View in app
evalutation image
remediation image

Consider Worklets your easy button

What's a Worklet?

A Worklet is an automation script, written in Bash or PowerShell, designed for seamless execution on endpoints – at scale – within the Automox platform. Worklets deploy named-CVE mitigations within hours of disclosure, perform configuration, remediation, and install or remove applications and settings across Windows, macOS, and Linux.

do more with worklets