How can I find out which program is trying to restart my Mac? From time to time I log into my server through screen sharing to find this warning:



There is a program trying to restart my server, and I can't for the  life of me figure out which one is the culprit. Sometimes the restart attempt gets blocked by the OS when other users are connected through the file sharing service, but other times (e.g. at night and during the weekends, when no one is in the office) the restart goes through. This drove me crazy when performing long backups overnight and coming to work in the morning to find a failed backup and no trace of what went wrong in the logs.

So now I'd like to get to the bottom of it.

pmset -g told me that autorestart was set to 1. I manually set it to 0 with pmset -a autorestart 0. This was a couple of weeks ago and I thought to have fixed the issue this way. But today I logged in to the same warning above, so something is still trying to restart the computer. autorestart is still correctly set to 0.

I have to confess I don't know where to look. Is there any tool I can use to find out where this warning is coming from?

Running macOS 10.12.4 and macOS Server 5.3.

I'm thankful for any pointer.
If you have Xcode installed, you can use Accessibility Inspector (full path below) to find information on any user interface element. Click on the “crosshairs’ icon in the window's menu bar and watch the informative display as you mouse over various UI elements.

In your case, however, it will show what process displayed the dialog, which is not necessarily the process that is trying to restart your mac. But you won't know until you try.

/Applications/Xcode.app/Contents/Applications/Accessibility Inspector.app