What are RTProtectionDaemon, AGMService & com.apple.touristd on Mac?

Summary: This post explains three processes on Mac: com.apple.touristd, AGMService, and RTProtectionDaemon.

the touristd AGMService and RTProtectionDeamon on Mac

What is com.apple.touristd?

touristd, first introduced in macOS Sierra, is a process accountable for displaying the "New to Mac" or "Welcome to macOS" notification for users who are new to macOS. When you click Show, it will open your default browser and give you a tour of the features of macOS. A preference file called com.apple.touristd.plist will be generated after you click the Show or Close button on the notification.

The New to Mac notification generated by the touristd process

There are two locations where you can find the plist file. Open Finder, click Go > Go to Folder, then input one of the following paths and press Enter.

~/Library/Application Support/com.apple.touristd/com.apple.touristd.plist
~/Library/Preferences/com.apple.touristd.plist

Where to find the com apple touristd plist file on Mac

You may also notice the touristd process in Activity Monitor or Console logs. If you want to access the touristd process, navigate to Macintosh HD/System/Library/PrivateFrameworks/Tourist.framework/Versions/A/Resources/touristd.

What is AGMService on Mac?

The AGMService process runs in the background to verify that your Mac is running a genuine copy of an Adobe Creative product.

The AGMService process in Activiry Monitor

AGMService using high CPU on Mac

You may find the AGMService using a large amount of CPU in Activity Monitor when your Mac heats up and the fan starts running. That's often caused by the Adobe software you installed on Mac. Even when it's idle, the earlier versions of the Adobe Creative Cloud desktop app still can use excessive CPU or energy on Mac.

To remove AGMService from Activity Monitor, you need to close Adobe if it's currently open. After that, select the AGMService process and other processes relevant to Adobe in Activity Monitor, then click the cross icon at the top and choose Force Quit to get rid of them. If the issue recurs, you need to fully uninstall the Adobe creative suite from your Mac and then reinstall it.

What is RTProtectionDaemon on Mac?

RTProtectionDaemon is a legit background process of Malwarebytes for Mac that's responsible for all malware scans. You can access RTProtectionDaemon by navigating to Macintosh HD/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/, right-clicking on the bundle, and selecting Show Package Contents, then opening Contents/PlugIns/RTProtectionDaemon.app.

RTProtectionDeamon in Activity Monitor

If you want to explore more about the RTProtectionDaemon.app, right-click on it, choose Show Package Contents, and click Contents/MacOS/RTProtectionDaemon.

RTProtectionDaemon consuming High CPU on Mac

When Malwarebytes for Mac is running on your Mac, it may eat up your CPU resources as indicated by the high CPU usage of the RTProtectionDaemon process in Activity Monitor. Here are the solutions to stop RTProtectionDaemon from hogging your Mac's CPU:

Kill the RTProtectionDaemon process in Activity Monitor.
Turn off the active monitoring feature of Malwarebytes by clicking the MalwareBytes icon on your browser's top menubar and choosing Stop Real-Time Protection. (The periodic full scans won't be influenced.)
Completely remove MalwareBytes from your Mac by choosing Uninstall from the Help menu, and then reinstall the latest version.
Set MalwareBytes to use a low CPU usage in Settings > Advanced.
Delete unnecessary Safari extensions.