@prujamf I don’t have either of those scenarios setup to test but noticed this recent change note below;
macOS Monterey 12.1
- Screen sharing can now be enabled remotely only by MDM.
https://support.apple.com/en-au/HT212586
Do you enable ARD via Jamf's api as part of your workflow and not just kickstart? Also make sure the following setting is enabled and you scope a PPPC payload as below to devices.
Hello Junjishimazaki/Bol,
Thanks for responding.
Remote Management is enabled via the kickstart command for a local administrator account.
I also scope a PPPC payload with the follow settings:
This how the firewall settings look on an Intel and M1 Mac:
@Bol Thanks for suggesting enabling the three Restrictions for Screenshots, Airplay and Classroom. Unfortunately enabling these had no effect.
Oddly screensharing briefly worked on one of my test M1 Macs after updating the OS from 12.0 to 12.2. Same settings as before. Unfortunately it stopped working as soon as I rebooted the Mac.
Under the Jamf Management Commands I can successfully send "Disable Remote Desktop Command" , but don't get an option to enable again..
Best Regards,
Rob.
Because of Apple's changes, you now need to use MDM / Jamf to do this.
Either press the 'Enable Remote Desktop' button on the computer object in Jamf or you can script the same outcome by using the API (there's scripts on the forums you can try).
No problem at all. I spent some time reading and testing at one site, while I got it working, I don't yet know enough to make the api do what I think it should (uuid -> jamf id).. So for now I've pieced together what I found from the community, really nice information (as usual) at Mr Flounder's blog;
https://derflounder.wordpress.com/2021/12/10/obtaining-checking-and-renewing-bearer-tokens-for-the-j...
Same again from Mr Purves site;
https://richard-purves.com/2021/12/09/jamf-pro-api-for-fun-and-profit/
Then finding what I need from the Jamf developer site;
https://developer.jamf.com/jamf-pro/reference/createcomputercommandbycommandandid
- As a test, I disabled remote desktop in Jamf
- Confirmed black screen during ARD connection
- Sending this command immediately re-connected screen session
/usr/bin/curl --request POST \
--url "${jamfpro_server_address}/JSSResource/computercommands/command/EnableRemoteDesktop/id/$computerID" \
--silent \
--header "Authorization: Bearer $token"
Previously, I would use this to the same effect
/usr/bin/curl -Ssu "${jamfpro_user}:${jamfpro_password}" "${jamfpro_server_address}/JSSResource/computercommands/command/EnableRemoteDesktop/id/${computerID}" -X POST Also to note, for whatever reason while testing on 12.2.1, it no longer displayed the warning message "Your screen is being observed”.
Previously it would show unless I reconnected in succession to the same machine. Even after a reboot and login, hilarious, I'll ignore that and save myself revisiting an old rabbit hole.
This is by design and the changes are noted here;
Your script will handle the ARD settings and allow you to connect fine. Although the blank screen can only be fixed by enabling Remote Desktop via MDM. Add into your script an API call to do this and it will work again.
I have this setup after enrollment as a policy / script and allows me to ARD to a machine, erase & wipe, then after enrollment my original ARD window reconnects again. Not that helpful but it works :D
Hello Bol. First off, thanks for the quick response. I appreciate yours and everyone elses' feedback on this post. 'Still new to this. This has given me something else new to try.
"Although the blank screen can only be fixed by enabling Remote Desktop via MDM. Add into your script an API call to do this and it will work again." -So does this look about right?
==================
#!/bin/sh
#enables screen share for specifiedusers then restarts agent
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers -restart -agent
#specifies user then sets permissions for specified user then restarts agent
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users [user1],[user2] -access -on -privs -all -clientopts -setmenuextra -menuextra no -restart -agent
computerrecord=$( /usr/bin/curl --request GET \
--url "${jamfpro_server_address}/api/v1/computers-inventory?section=USER_AND_LOCATION&filter=udid%3D%3D%22${machineUUID}%22" \
--silent \
--header "Authorization: Bearer $token" )
computerID=$( /usr/bin/osascript -l 'JavaScript' -e "JSON.parse(\`$computerrecord\`).results[0].id" )
==================
My tests so far:
- So from what you did, I disabled remote desktop to my Test-1 machine in Jamf.
- I noticed immediately that it did in fact disable it when I checked my ARD console: I couldn't remote in.
- I also noticed that in Jamf on my Test-1 machine, after a refresh, there was no "Enable Remote Desktop."
- Afterwards following the steps you took, I created a Policy with the following script: unfortunately failed. Maybe I wasn't doing it right.
==========
/usr/bin/curl --request POST \
--url "${jamfpro_server_address}/JSSResource/computercommands/command/EnableRemoteDesktop/id/$computerID" \
--silent \
--header "Authorization: Bearer $token"
=========
3. So I then I saw your reference to the Richard-Purves post on the API script and created another policy with the following script below.
==================
computerrecord=$( /usr/bin/curl --request GET \
--url "${jamfpro_server_address}/api/v1/computers-inventory?section=USER_AND_LOCATION&filter=udid%3D%3D%22${machineUUID}%22" \
--silent \
--header "Authorization: Bearer $token" )
computerID=$( /usr/bin/osascript -l 'JavaScript' -e "JSON.parse(\`$computerrecord\`).results[0].id" )
====================
- When I scoped this to my Test-1 machine, it ran and appeared to have been applied (the machine log indicated that it executed).
- However in Jamf Pro it indicated that it failed.
- BUT! Interesting enough though... My Test-1 machine in Jamf now shows that Enable Remote Desktop. I clicked it and it worked. Once I did that, it does not show “Disable Remote Desktop.”
- Is this a normal behavior?
- How can I disable it so I can test if the my script above will work?
Hello. I'm just getting back into this. Man... Work just get in the way. I finally had a chance to do more testing.
@Bol wrote:I think what it tripping this all up is even without using the API call to enable / disable remote desktop, you ARD code will still change the button behaviour in Jamf Pro.
Yeah... Actually you're right. I tested this out on a couple of machines with just the original code I had below. As mentioned it works, but it goes blank when I initiate an ARD session.
#!/bin/sh
#enables screen share for specifiedusers then restarts agent
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers -restart -agent
#specifies user then sets permissions for specified user then restarts agent
#replace [user1],[user2] with your local account
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users [user1],[user2] -access -on -privs -all -clientopts -setmenuextra -menuextra no -restart -agentSo in Jamf Pro, I went into a computer's Management tab and clicked Disable Remote Desktop button, refresh my screen, then do it again, a few times (which I thought was quirky) until I get the Enable Remote Desktop button. Once I got that, I was able to ARD into the workstation as normal.
More testing...
I was trying to figure out why the API call was failing. It's still not resolved. I still kept on getting errors. I tried what you said, with my limited experience in any API calls.
@Bol wrote:You want your script to first enable via API, then make ARD setting changes after this and it should work.
So tried to place it on two Policies to "first enable via API" then my ARD script: Failed.
I even added all in one Policy: no go.
#!/bin/sh
# required to pull the jamf pro id from API
machineUUID=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | /usr/bin/awk '/IOPlatformUUID/ { gsub(/"/,"",$3); print $3; }')
# API
computerrecord=$( /usr/bin/curl --request GET \
--url "${jamfpro_server_address}/api/v1/computers-inventory?section=USER_AND_LOCATION&filter=udid%3D%3D%22${machineUUID}%22" \
--silent \
--header "Authorization: Bearer $token" )
computerID=$( /usr/bin/osascript -l 'JavaScript' -e "JSON.parse(\`$computerrecord\`).results[0].id" )
#enables screen share for specifiedusers then restarts agent
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers -restart -agent
#specifies user then sets permissions for specified user then restarts agent
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users [user1],[user2] -access -on -privs -all -clientopts -setmenuextra -menuextra no -restart -agent
@Bol wrote:
My workflow is roughly;
Generate Token
Get Jamf Computer ID
Set Apple Remote Desktop via API
Set Apple Remote Desktop via Kickstart
Expire Token
Wow! That's a lot. I'll have to dig into this further.
@Bol wrote:
https://richard-purves.com/2021/12/09/jamf-pro-api-for-fun-and-profit/
To be continued...
