WindowManager Screen Recording Purple dot appears on application changes

Question

WindowManager Screen Recording Purple dot appears on application changes

Hello,

Whenever I change my application I see a purple dot beside control centre icon which then clicked shows WindowManager Screen Recording under a Privacy Segment. I tried in settings with Privacy, Sharing and more but didn't found anything. Also I remember there was some feature in saw in Mac that allowed me to automatically take screen recordings or shots and save them somewhere to view my activity without screenshotting myself, but I can't seem to remember where I got the glimpse of it or perhaps I turned it on and now I don't remember where to turn it off or I assumed that but about auto recording. But that purple dot every time popup's is getting but frustrating.

I am using MacOS 15.1 (24B83)

Thank you.

MacBook Pro 14″

Posted on Nov 11, 2024 7:36 AM

Reply

Answer 1

Top-ranking reply

PRP_53

Level 10

91,867 points

Nov 20, 2024 1:18 AM in response to Allogarage

Allogarage wrote:

I think it's when you quit or switch application with Stage Manager enabled.

It is used to make a snapshot of the app, don't you think ?

Apple may removed this annoying alert, you could think you have a spyware installed that record your screen ...

Adware or Malware generally do not just appear on the computer

It would require Expressed Permission given by the user to Install on the computer

That could only be grated by the User to have Manually Entered the User Account Password

Spyware ?

Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature.

So I dare say, unless the user is a High Value Target - doubtful it is spyware

Reply

Answer 2

Nov 20, 2024 12:13 AM in response to VitalJeevanjot

I think it's when you quit or switch application with Stage Manager enabled.

It is used to make a snapshot of the app, don't you think ?

Apple may removed this annoying alert, you could think you have a spyware installed that record your screen ...

Reply

Answer 3

Nov 19, 2024 12:30 AM in response to sanozie

Of course, you can't use your mac without Window Manager - that is, literally, what you manages your windows, or more generally, the user interface.

I don't know why you have it screen recording, though. It's a mystery.

Reply

Answer 4

PRP_53

Level 10

91,867 points

Nov 19, 2024 1:19 AM in response to VitalJeevanjot

Barring a more full disclosure of when is running on this computer via the usage of Etrecheck application and posting the report

when this issue in occurring

Open the Activity Monitor application

Make sure to use View >> View All Processes

What process or processes are using the Most CPU and Memory.

When I examined the " WindowsManager" process

In the below, I see various open files directly tied to WindowsManager process

The Last entry is of interest.

It seems related to Allow which could be related to Allowing a Process or possible Allowing a Third Party Device access to say a Microphone ?

/System/Library/CoreServices/WindowManager.app/Contents/MacOS/WindowManager

/Library/Preferences/Logging/.plist-cache.XaUpS1n5

/usr/share/icu/icudt74l.dat

/System/Library/Frameworks/Foundation.framework/Versions/C/Resources/FoundationErrors.loctable

/System/Library/CoreServices/WindowManager.app/Contents/Resources/InfoPlist.loctable

/System/Library/CoreServices/SystemVersion.bundle/English.lproj/SystemVersion.strings

/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/SystemAppearance.car

/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/Aqua.car

/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/FauxVibrantLight.car

/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/VibrantLight.car

/System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Resources/AppleKeyboardLayouts-L.dat

/System/Library/Caches/com.apple.IntlDataCache.le.kbdx

/System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Resources/InfoPlist.loctable

/private/var/db/analyticsd/events.allowlist

Reply

Answer 5

Nov 20, 2024 5:20 AM in response to PRP_53

Ok, I just tested, and it’s indeed Stage Manager that activates the screenshot capture when switching between apps or when launching or closing an app. And I repeat, yes, this alert can be concerning—I spent several hours thinking it was spyware/malware/trojan (choose whichever you prefer since you’re so particular). This alert should be removed by Apple because it can mislead users. There’s no need to worry about this alert.

Reply

Answer 6

PRP_53

Level 10

91,867 points

Nov 18, 2024 1:54 AM in response to VitalJeevanjot

Use Control Center on Mac

Privacy indicators, which can be dots or arrows, are located to the right of Control Center. An orange dot next to the Control Center icon in the menu bar indicates the microphone on your Mac is in use; a green dot indicates a camera is in use; a purple dot ➡️ indicates the system audio is being recorded; and an arrow ⬅️ indicates your location is in use. Only one privacy indicator dot is shown at a time. For example, if both the microphone and a camera are in use, you see only a green dot.

Reply

Answer 7

Yura607

Level 1

15 points

Nov 18, 2024 1:25 AM in response to VitalJeevanjot

The same here. Just switching between apps results in a WindowManager screen recording. WTF?

MacOS 15.0.1 (24A348)

Reply

Answer 8

Nov 18, 2024 5:48 AM in response to PRP_53

Thanks for information,

I see the dot appears with screenshot taken under Screenshot, That's perfectly fine. But when it appears under WindowManager then I don't know why and how to stop it, that's the reason of the query.

Reply

Answer 9

sanozie

Level 1

8 points

Nov 19, 2024 12:12 AM in response to Luis Sequeira1

Currently in safe mode, can confirm it still happens.

Also checked the running process for WindowManager, seems to be a MacOS Core Service. Force quitting the process does nothing, it just starts up again.

I hope Apple releases a fix for this soon 🥲

Reply

Answer 10

Nov 20, 2024 3:40 AM in response to VitalJeevanjot

Thanks to everyone for their information sharing.

I checked with Safe mode and as pointed it still Happens

I updated to macOS 15.1.1 and still happens

I checked permissions and haven't granted any app any unauthorised permission but I can't say on lower level. I installed Zoom and Microsoft Teams on different occasions and these are not on App Store but I uninstalled them sooner when there use wan't required.

I keep my Mac Clean as much as I can.

So nothing is found so far except as I mentioned before in my memory I did seem to remember that there was some option in Mac that will keep me informed of the apps I use or my macOS usage for security purpose and I did turned it on but now I don't know where it is or how to find it and no new screenshots for this are showing in my screenshot folder where I might to have set this.

Reply

Answer 11

Nov 20, 2024 6:13 AM in response to Allogarage

Thank you @Allogarage , That is indeed the reason why this was occurring and of course I trust Apple products in a way that I feel such minor hiccups can be solved with continuous use of device.

I did tried with Stage Manager turning it off and on but I didn't restarted the device after turning it off which put it behind back to try again of it later when I am in a streak of doing device restarts with each setting change but now I learned it can happen like that even on macOS some settings require restarts to take effect.

Also that's the word, 'Snapshot' I guess I assumed it differently :)

Reply