Stopping LaunchAgents and Daemons I work as admin in a college environment. One of the challenges is to stop the services installed by students with CS major. Some time back they got the admin access and installed launch agents and daemons on some systems.The students have also added some plists as com.apple.myprog.run. The problem is these are not present in the launchagents directory or in the launchdaemons directory. 

So my question is how to find the path for these daemon services.Then next step is how to stop these.  Since some of these could start again and again(based on certain flags).
If you want to stop the item for this boot simply issue an unload command to launchd via launchctl. For a permanent fix add a disabled key into the plist with value true or delete/move the file to a folder where launchd will not scan it automatically.


launchctl unload /System/Library/LaunchAgents/com.apple.AppStoreUpdateAgent.plist


The man page for launchctl has nice documentation for controlling jobs. As for the general defeating of CS majors, you might also consider that they edited the existing apple plists to make them do something you don't expect, so it will prove to be far easier to just reinstall the OS and migrate the user data back from a backup (paying particular note to note re-install any plist files in the /System/Library, /Library space (and perhaps also audit the ~/Library of admin users). Losing admin / root against someone that knows how to change the system is basically game over and the defense (finding and disabling) the changes is very time consuming as opposed to offense (reinstalling the system from a known good source and use configuration management tools to ensure changed files are detected).