Skip to main content

Has anyone figured out an automated way to add apps to the System Preferences -> Security & Privacy -> Privacy -> Accessibility section in Mojave to allow them to control the computer?

We use Bomgar in my environment for remote support, and are running into a less than ideal interaction with Mojave. Users are prompted to allow the Bomgar app to control the computer, but users can only do that if they have administrative privileges, which not many people have in my environment.

I contacted Bomgar about this, and they said it's expected due to security changes Apple made and there's no way around this with their software. I contacted Jamf as well and they told me they were unaware of a way to add an app to this section automatically. I've tried and it does not appear I can grant users the ability to modify this section of System Preferences if they don't have admin privileges, like I can other sections.

I'm hoping someone else may have ideas on this.

check out Jamf's tool to create a Privacy Preferences Policy Control profile and upload to your JSS. You'll want to add Bomgar to the accessibiltiy section, then add an AppleEvent that allows Bomgar to control System Preferences.

You can check out my TeamViewer profile as an example, that's essentially what you'll want, just substitute with Bomgar.

That's great info! That seems to work for me. The weird thing is that when I uploaded the config profile to my Jamf, it shows as completely blank, but appears to work fine.

Is that expected behavior?

Yes @dennisnardi that is expected. 10.7.1 does not yet have a GUI for the PPPC Payload. Once the GUI is put into code, you will see the payload options on the screen.

@dennisnardi I am new to the PPPC utility and was wondering how you configured the Bomgar payload using the GUID. I tried a few different configurations, but the Mac_service_helper.sh remains unchecked in Security & Privacy > Privacy > Accessibility.

@Robkirsch I think you may have to upgrade your Bomgar server. Before the current version (18.2.6.33030), when you jumped to a computer the "Mac_service_helper.sh" script wanted to be run to start the jump session. If you see this in sys prefs, you can probably right click and show in finder. If you do that you may be able to drag it into the PPC utility and set all the settings to use this in the config profile.

Since we upgraded to 18.2.6.33030, it now says the "Bomgar app" instead of "Mac_Service_Helper.sh". I dragged the "bomgar-scc-xxxxxxx.app" from /users/shared into PPC and gave it all the permissions I could. This doesn't actually show up in the Privacy panel in sys prefs, but works perfect. Below is a screenshot of my PPPC for Bomgar:

I have 2 Issues that this tool does not help me with, any ideas ?

1 : I have a simple Bash Script that runs at login, in it, this runs 1 line of AppleScript to pop up a user input box, this fails and the script gives the error "Not authorised to send Apple events to System Events. (-1743)" I have no idea which app to allow, and what to allow it access to.

2 : We deploy a Piece of remote control software called ScreenConnect, this installs and runs OK, but only in View Only, to get full functionality we need need to tick it in the Accessibility Section, where it Auto Populates, the problem is if I use the PPPC Utility, i cannot select the app as it runs from /opt, and even if I browse to the app, it ignores it.

Any Ideas people ?

Ok been playing with the PPPC utility for a while now and its working great except for 2 things Camera and Microphone permissions for Zoom. I loaded Zoom into the PPPC utility and discovered that I only have the deny option for the Camera and Microphone. I said to myself, ok well I'll just go change the flags from "false" to "true" and that'll fix it. Instead, when I load the .mobileconfig profile into JAMF it says this in the failed commands below.

We're trying to prep everything to be seamless for our users to upgrade to 10.14 but things like this are holding us back. Below is the code that PPPC Utility kicks out when I used the deny flags (not sure why to allow doesn't appear). If anyone has any advice I'd love it as I'm hitting my head against the wall on this one. Also as of note I've tried this a few times to see if it was just a fluke and the UUID I know is different than my text below from the image above.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDescription</key>
            <string>To Allow Camera and Microphone settings</string>
            <key>PayloadDisplayName</key>
            <string>Zoom PPPC Settings</string>
            <key>PayloadIdentifier</key>
            <string>10587A41-6D41-4F7C-816C-085C91D5B055</string>
            <key>PayloadOrganization</key>
            <string>Xactly Corp</string>
            <key>PayloadType</key>
            <string>com.apple.TCC.configuration-profile-policy</string>
            <key>PayloadUUID</key>
            <string>E8E46BB2-88AB-44B6-9E3E-FF62731F52DA</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>Services</key>
            <dict>
                <key>Camera</key>
                <array>
                    <dict>
                        <key>Allowed</key>
                        <false/>
                        <key>CodeRequirement</key>
                        <string>identifier "us.zoom.xos" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = BJ4HAAB9B3</string>
                        <key>Comment</key>
                        <string></string>
                        <key>Identifier</key>
                        <string>us.zoom.xos</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                    </dict>
                </array>
                <key>Microphone</key>
                <array>
                    <dict>
                        <key>Allowed</key>
                        <false/>
                        <key>CodeRequirement</key>
                        <string>identifier "us.zoom.xos" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = BJ4HAAB9B3</string>
                        <key>Comment</key>
                        <string></string>
                        <key>Identifier</key>
                        <string>us.zoom.xos</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                    </dict>
                </array>
            </dict>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>To Allow Camera and Microphone settings</string>
    <key>PayloadDisplayName</key>
    <string>Zoom PPPC Settings</string>
    <key>PayloadIdentifier</key>
    <string>10587A41-6D41-4F7C-816C-085C91D5B055</string>
    <key>PayloadOrganization</key>
    <string>Xactly Corp</string>
    <key>PayloadType</key>
    <string>com.apple.TCC.configuration-profile-policy</string>
    <key>PayloadUUID</key>
    <string>2E2AE47A-9AAE-4B8E-B09A-4A2130D6D4E6</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>payloadScope</key>
    <string>system</string>
</dict>
</plist>

@daniel_ross That's expected behavior. You can only deny, unfortunately. I get why you can't pre-approve this, but for orgs that use multiple chat/conference apps your users can get dialog fatigue.

@HNTIT I've got the same problem with ScreenConnect 6.6. I'll updated to 6.8 at test soon. The application located in /opt/screenconnect-.app doesn't look like its signed.

@sshort, that's what I thought and also found a similar article. Luckily its only two prompts so nothing too crazy.

Love all the information on this though!

I know this post is a month old now but I have a question. I created a config in PPPC for Zoom and TeamViewer. It successfully uploaded into Jamf Pro (I am on 10.8) but it's blank. I pushed it to a few machines and it successfully installs but the preferences didn't seem to change at all. Is there something I am missing?

@dmitchell It's expected that you won't see anything in the Jamf UI for a custom uploaded profile. You can always visit System Preferences > Profiles on a device the profile is installed on to confirm the contents.

When you say the preferences don't change, do you mean that nothing appears in the Privacy section in Security & Privacy? That's expected, anything enforced from a profile doesn't appear, just user-approved stuff. That may change in the future, but as of 10.14.1 you won't see anything.

If you mean that you pushed the profile and the app isn't recognizing the whitelisted items you placed in the profile, that's expected if the app was run/launched before the profile is installed.

@sshort Thanks, it definitely worked.

@HNTIT, I'm dealing with the same issue. Tried using the PPPC profile creation tool but it seems to ignore the ScreenConnect application. Did you ever manage to find a work around or a solution to the issue?

Thanks

I have the same issue, is there any word from Bomgar support on this?

This is the error I get.

@kericson Do you know the file path of the mac_service_helper.sh? You can create a profile that whitelists that for Accessibility using a file path vs a bundle ID.

You might also need an AppleEvent for the script to control System Preferences (seems to be common with accessibility requests. Otherwise the app "adds itself" to the user-facing list in System Preferences, but the box remains unchecked/disabled).

Heres the location:

There's no way to add this since it's inside the bomgar jump client .app I'm using the JAMF PPPC Utility.

I am also seeing the PPPC application ignore the app for Connectwise (Screenconnect) remote control software, and have been unable to find what criteria may be missing. Connectwise doesn't sign their app, though they claim they will work on that in a future release, which seems like that could be the issue.

Very frustrating that there isn't a better way to manage this.

I upgraded Bomgar to the newest and the issue is now fixed.

@kericson @Robkirsch

I have the exact same issue trying to whitelist Bomgar. Haven't had any luck trying to codesign the mac_service_helper.sh by itself either.

Any luck figuring it out? Does updating your Bomgar server to the latest version resolve it? We're behind a bit.

Yes upgrading to the latest seems to fix the issue. Check their site there are release notes about Mojave support on the newest.

@dmitchell Do you mind sharing your configuration for the TeamViewer PPPC configuration profile you successfully created?

I am struggling to get one to work in my test environment. Attached is a screen shot of my current config.

Update

Never mind.

I used the PPPC Utility to create the profile. Saved it and uploaded it to the JSS. That work flow seems to work well for the common man.

Update2

I also created a 7m screen cast which shows the workflow visually. Perhaps this will help visual learners get started using these new workflows: https://youtu.be/-IAhZLanHvU

Attached screenshots show the working config. Should someone else run into this problem.

@bcrockett ha, I was just going to respond. Looks like you got it.

Terms & ConditionsCookie settings