The only restriction that can be automatically applied after enrollment is SSH. This is an option you select when creating quickadd packages, imaging configurations or using recon.

If ARD access is being changed when the Mac enrols, there is likely a script, policy or config profile that is changing it.

Is there a script that can change it back?

You can use these two commands to set it how you need it:

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -allowAccessFor -specifiedUsers

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -users username -privs -all

Just replace username with the short name of the user that should have access.

@christinehunt1

Try this

#!/bin/sh



/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -users ACCOUNTUSERNAMEHERE -access -on -privs -all -restart

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers -restart

edit:

@davidacland beat me to it

You can also have Apple Remote Desktop provide the needed kickstart commands:

https://derflounder.wordpress.com/2013/03/07/using-apple-remote-desktop-admin-to-help-script-ard-kickstart-options/

the enrolled system probably had their Screen Sharing service reconfigured to comply with whatever has been set for use with Casper Remote, and took out anything previously set for Remote Management.

Thanks for the scripts. Do I run both of them?

Just one or the other should do it.

Thanks. I'll give it a whirl.