@HappyTrails @kwoodard
I went back and test, I believe only the PPPC profile was required for ARD. I couldn't find all the docs but from what I understand;
- Kickstart to setup privileges & users
- MDM / API to enable remote desktop
- Config profile to allow interaction of remote management via kickstart
Here's what I'm using in a policy triggered on startup, it will get applied soon after enrolment and can connect straight after. Please test before copy / pasting in your environment as I know there's some overkill elements to what I'm doing.
There was a lot of testing at the time and once it was all solid, i didn't get the chance to go back through and see what wasn't required. Also I removed the config profile and it did indeed break the workflow, so for me it was still a required step.
You can replace $4 / $5 with your own values, I enter these on the policy the script it added too.
#!/bin/bash
# B0L ARD Screen Share / Remote Desktop via Jamf Pro API
# - Added bearer token support as Classic API due for retirement
# - Added print of access group (to see who can ARD)
# - Removed hard code of Jamf Pro URL for plist preference
# - Overkill add Jamf Pro into groups / SSH / ScreenShare
# Note: -ShowObserve has no effect as of macOS 12.3
# https://ss64.com/osx/kickstart.html
error=0
jamfbin=$(/usr/bin/which jamf)
jamfpro_server_address=$(/usr/bin/defaults read /Library/Preferences/com.jamfsoftware.jamf jss_url); jamfpro_server_address=${jamfpro_server_address%%/}
encodedCredentials="$4"
localUserName="$5"
group=com.apple.access_screensharing
machineUUID=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | /usr/bin/awk '/IOPlatformUUID/ { gsub(/"/,"",$3); print $3; }')
kickstart="/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart"
privs="-DeleteFiles -ControlObserve -TextMessages -OpenQuitApps -GenerateReports -RestartShutDown -SendFiles -ChangeSettings"
# Old one Liner
# $kickstart -activate -configure -access -on -users user -privs -all -clientopts -setmenuextra -menuextra no -restart -agent -menu
GenerateAuthToken () {
authToken=$( /usr/bin/curl "${jamfpro_server_address}/uapi/auth/tokens" \
--silent \
--request POST \
--header "Authorization: Basic $encodedCredentials" )
token=$( /usr/bin/awk -F \" '{ print $4 }' <<< "$authToken" | /usr/bin/xargs )
}
ExpireAuthToken () {
/usr/bin/curl "${jamfpro_server_address}/uapi/auth/invalidateToken" \
--silent \
--request POST \
--header "Authorization: Bearer $token"
}
GetJamfProComputerID () {
computerrecord=$( /usr/bin/curl --request GET \
--url "${jamfpro_server_address}/api/v1/computers-inventory?section=USER_AND_LOCATION&filter=udid%3D%3D%22${machineUUID}%22" \
--silent \
--header "Authorization: Bearer $token" )
computerID=$( /usr/bin/osascript -l 'JavaScript' -e "JSON.parse(\`$computerrecord\`).results[0].id" )
}
SetJamfProConfig () {
/usr/sbin/dseditgroup -o edit -a "$localUserName" -t user admin
/usr/sbin/dseditgroup -o edit -a "$localUserName" -t user com.apple.access_ssh
/usr/sbin/dseditgroup -o edit -a "$localUserName" -t user com.apple.access_screensharing
/usr/sbin/systemsetup -f -setremotelogin on
$jamfbin startSSH
}
SetAppleRemoteDesktopViaAPI () {
/usr/bin/curl --request POST \
--url "${jamfpro_server_address}/JSSResource/computercommands/command/EnableRemoteDesktop/id/$computerID" \
--silent \
--header "Authorization: Bearer $token"
}
SetAppleRemoteDesktopViaKickstart () {
# https://support.apple.com/en-au/HT201710
/usr/bin/defaults write /Library/Preferences/com.apple.RemoteManagement allowInsecureDH -bool TRUE
$kickstart -targetdisk / -verbose -uninstall -settings -prefs
$kickstart -targetdisk / -verbose -configure -allowAccessFor -specifiedUsers
$kickstart -targetdisk / -activate -configure -access -on -users $localUserName -privs $privs -clientopts -setmenuextra -menuextra no -setwbem -wbem yes -restart -agent -console -menu
}
GetGroupMembership () {
echo "Screen sharing ACL members:";
for i in $(dscl . list /users); do [[ $(id -nG "$i" | grep $group) ]] && echo "$i"". "; done
# $kickstart -computerinfo -1 "$text"
}
GenerateAuthToken
GetJamfProComputerID
SetAppleRemoteDesktopViaAPI
SetJamfProConfig
SetAppleRemoteDesktopViaKickstart
GetGroupMembership
ExpireAuthToken
exit $error
ps. How do we format code script for bash!?
Wait a second, I’m confused.
If you are leaving out the remote management command in the script, are you then using the ‘enable remote desktop’ button in Jamf for this computer record?
If the device is enrolled in MDM, then it must have enable Remote Desktop enabled via MDM also to work. (Either script : api or Jamf)
https://support.apple.com/en-us/HT209161
I will give that a try and report back. I am going to grab a second laptop that I have that also has this issue and bring it along with me as I setup these new Mac's. Work on it while provisioning... It's so frustrating.
Ok well that's everything I have done to get my fleet working.
If I was in your situation, I would be starting from scratch;
- Enroll a new machine and exclude all profiles / restrictions apart from these two;
Also if you are using ARD to connect from your machine, remove any reference or saved computer from ARD before trying to connect again.
As of right now, I am able to use ARD or the screen sharing app to connect
