Likewise, I have not. I thought I had it, but Bol has been giving me some things to try. I've been slacking, due to work getting in the way. 😓
-But discovered how I can poke at it remotely to wake it up again by Disable Remote Desktop when I need to, as mentioned above.
To review, here's my current workflow...
1st - a policy to create local admin accounts during my pre-stage enrollment
2nd - my ARD script
Script: Special thanks to "RossMadness." Source Link: https://www.reddit.com/r/macsysadmin/comments/f2recc/apple_remote_desktop_and_jamf_pro/fhec8aj/
==================
#!/bin/sh
#enables screen share for specifiedusers then restarts agent
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers -restart -agent
#specifies user then sets permissions for specified user then restarts agent
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users [user1],[user2] -access -on -privs -all -clientopts -setmenuextra -menuextra no -restart -agent
==================
3rd - workaround, as mentioned above as needed:
In Jamf Pro, I went into a computer's Management tab and clicked Disable Remote Desktop button, refresh my screen, then do it again, a few times (which I thought was quirky) until I get the Enable Remote Desktop button. Once I got that, I was able to ARD into the workstation as normal.
Hello all. I'm just now finally getting back on this. Here's an update...
- Enable Remote Desktop from the Jamf Pro Computer Management:
- So far, the workaround of manually Enable Remote Desktop from the Jamf Pro Computer Management works except for one thing, that's all it is. I can remote to the workstation, however I can initiate a restart, a reboot, etc. from ARD tools. After investigating, I found that the options for the Enable Remote Desktop from the Jamf Pro Computer Management is just an "Observe" and "Control" only. -Plus for "All Users", not for the "Only these users."
- Junjishimazaki's Script Test: Failed Unable to Connect
- I removed an Intel machine and an M1, both with Monterey from my ARD script.
- I disabled Remote Desktop from the Jamf Pro Computer Management for each workstation.
- I created another policy with your script and scoped it out.
- It looked promising. It enabled it, however when I try to establish an ARD session, I get this on both machines:
Thoughts?
- I noticed that your script allowed "All users" with all options.
- "
## Enable ARD options using the kickstart command
$KICK_START_BINARY -activate -configure -access -on -restart -agent -privs -all -allowAccessFor -allUsers
" - I tried to do this below to specify a user that is created during enrollment... Unfortunately it didn't work.
- "
## Enable ARD options using the kickstart command
$KICK_START_BINARY -activate -configure -access -on -restart -agent -privs -all -allowAccessFor -specifiedUsers -users [user1,user2]
"
- "
- "
Any suggestions?
See here in Apple's old docs;
Try setting up like this;
$kickstart -targetdisk / -verbose -uninstall -settings -prefs
$kickstart -targetdisk / -verbose -configure -allowAccessFor -specifiedUsers
$kickstart -targetdisk / -activate -configure -access -on -users "$localUserName" -privs "$privs" -clientopts -setmenuextra -menuextra no -restart -agent -console -menu
Didn't work. Here's everything combined:
#!/bin/bash
jamf_User="$4"
jamf_Pass="$5"
# Get the Jamf instance URL from the computer
jss_Url=$( /usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf.plist jss_url )
#Kick start command
KICK_START_BINARY="/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart"
echo "Enabling ARD..."
# generate base64 ecnrypted password
encoded_creds=$(printf "$jamf_User:$jamf_Pass" | iconv -t ISO-8859-1 | base64 -i -)
# generate an auth token. tr truncates and removes all line feeds
authToken=$( /usr/bin/curl -s "${jss_Url}api/v1/auth/token" -H "authorization: Basic ${encoded_creds}" -X POST | tr -d "\n" )
# parse token, remove expiration date
token=$( /usr/bin/osascript -l 'JavaScript' -e "JSON.parse(\`$authToken\`).token" )
# Get Mac serial number
mac_serial=`system_profiler SPHardwareDataType | awk '/Serial/ {print $4}'`
echo "Mac serial: $mac_serial"
# Get ID of the Mac from Jamf
JAMF_ID=$(curl --header "Authorization: Bearer $token" "${jss_Url}JSSResource/computers/serialnumber/${mac_serial}" -X GET | xmllint --xpath '/computer/general/id/text()' -)
#echo "Jamf ID: $JAMF_ID"
#Send MDM command to enable remote desktop for this mac
/usr/bin/curl --header "Authorization: Bearer $token" "${jss_Url}JSSResource/computercommands/command/EnableRemoteDesktop/id/${JAMF_ID}" -X POST
## Enable ARD options using the kickstart command
$KICK_START_BINARY -activate -configure -access -on -restart -agent -privs -all -allowAccessFor -allUsers
$kickstart -targetdisk / -verbose -uninstall -settings -prefs
$kickstart -targetdisk / -verbose -configure -allowAccessFor -specifiedUsers
$kickstart -targetdisk / -activate -configure -access -on -users "$localUserName" -privs "$privs" -clientopts -setmenuextra -menuextra no -restart -agent -console -menu
# expire the auth token
/usr/bin/curl "${jss_Url}uapi/auth/invalidateToken" --silent --request POST --header "Authorization: Bearer $token"
exit 0
Yes sorry, replace with your local users, I am using a script variable so I can enter the username on the policy page.
Im sorry if it’s been said but are you all scoping these two settings by config profiles also?
I haven’t gone back to see if one or both is still required but I know, at some point of testing, they were both needed to allow ARD to work again in latest macOS builds.
