Chrome Remote Desktop and PPPC

[blairb]

Greetings...

We are facing a possible school closure due to Coronavirus. We are attempting to use Chrome Remote Desktop as a remote support solution, due to ease of use on the user's end.

The issue is that when you first start a support sessions (on the user end) it opens the Privacy pref pane and asks the user to give permission. You have to be an admin to do this, and the vast majority of our affected students aren't admins.

I tried creating a PPPC for the app... but it doesn't work. There appears to be another binary inside the app bundle. Even if I drag that binary to the PPPC utility and check allow, when I distribute the profile, the app appears in the list but is unchecked. Anyone have any ideas?

[pete_c]

No remote screen sharing or recording tools will be allowed without user approval, even if whitelisted by the MDM. That's Apple's spec.

You could publish a 'temporarily promote to admin' task in Self Service, or deploy Privileges.app.

[admin_mcp]

I recently discovered that a standard user is able to check the mark for 'Screen Recording' in Security & Privacy.
Is this a setting in JAMF or is it always been like this?

[Ludeth]

Like @admin.mcp said, standard users should be able to check this box for applications they have the permission to run.

[blairb]

That makes sense. Thanks.

[jsquires3]

We got this working by creating a PPPC profile for the following app within the Chrome Remote Desktop app with Accessibility set to Allow.

/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/RemoteAssistanceHost.app

We also allowed Accessibility for all 4 apps/executables within that MacOS folder just in case.

[DWilliams-cmsd]

Glad to have found this thread. Based on the response above from @jsquires3, was able to create the correct PPPC for Chrome Remote Desktop Host and the two apps contained in the contents:
com.google.chromeremotedesktop.me2me-host
com.google.chrome.remote_desktop.native-messaging-host
com.google.chrome.remote_desktop.remote-assistance-host-v2

Thanks!

[TomDay]

Anyone have the profile available as a download so I don't have to recreate?

[thecrow93]

Or does anyone have a screenshot for example?

[jhaff]

thanks @jsquires3 for the location of the apps. see below for the mobileconfig.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDescription</key>
            <string>ChromeRemoteDesktop</string>
            <key>PayloadDisplayName</key>
            <string>ChromeRemoteDesktop</string>
            <key>PayloadIdentifier</key>
            <string>D21CF3FB-6BDB-475B-82AB-589B05FF007A</string>
            <key>PayloadOrganization</key>
            <string>YourOrg</string>
            <key>PayloadType</key>
            <string>com.apple.TCC.configuration-profile-policy</string>
            <key>PayloadUUID</key>
            <string>E0D9E86A-5BCE-4475-BFB2-4C47119715BB</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>Services</key>
            <dict>
                <key>Accessibility</key>
                <array>
                    <dict>
                        <key>Allowed</key>
                        <true/>
                        <key>CodeRequirement</key>
                        <string>identifier "com.google.chrome.remote_desktop.native-messaging-host" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV</string>
                        <key>Comment</key>
                        <string></string>
                        <key>Identifier</key>
                        <string>com.google.chrome.remote_desktop.native-messaging-host</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                    </dict>
                    <dict>
                        <key>Allowed</key>
                        <true/>
                        <key>CodeRequirement</key>
                        <string>identifier "com.google.chrome.remote_desktop.remote-assistance-host-v2" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV</string>
                        <key>Comment</key>
                        <string></string>
                        <key>Identifier</key>
                        <string>com.google.chrome.remote_desktop.remote-assistance-host-v2</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                    </dict>
                    <dict>
                        <key>Allowed</key>
                        <true/>
                        <key>CodeRequirement</key>
                        <string>identifier "remoting_me2me_host_service" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV</string>
                        <key>Comment</key>
                        <string></string>
                        <key>Identifier</key>
                        <string>/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service</string>
                        <key>IdentifierType</key>
                        <string>path</string>
                    </dict>
                    <dict>
                        <key>Allowed</key>
                        <true/>
                        <key>CodeRequirement</key>
                        <string>identifier "com.google.chromeremotedesktop.me2me-host" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV</string>
                        <key>Comment</key>
                        <string></string>
                        <key>Identifier</key>
                        <string>/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host</string>
                        <key>IdentifierType</key>
                        <string>path</string>
                    </dict>
                </array>
            </dict>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>ChromeRemoteDesktop</string>
    <key>PayloadDisplayName</key>
    <string>ChromeRemoteDesktop</string>
    <key>PayloadIdentifier</key>
    <string>D21CF3FB-6BDB-475B-82AB-589B05FF007A</string>
    <key>PayloadOrganization</key>
    <string>YourOrg</string>
    <key>PayloadType</key>
    <string>com.apple.TCC.configuration-profile-policy</string>
    <key>PayloadUUID</key>
    <string>9BE78520-BA6A-4F7E-8C6B-B120AFC37061</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>payloadScope</key>
    <string>system</string>
</dict>
</plist>

[jsquires3]

@TomDay @thecrow93

I reccommend using Jamf's PPPC Utility to create these profiles. You just need to drag all 4 files within the /Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/ folder into the PPPC Utility application and then change Accessibility to Allow for each of the files. The utility allows you to upload the the profile directly to your JSS instance or you can just save it locally and upload it to your JSS manually.

If you have issues with the utility then here are some screenshots.

[thecrow93]

@jsquires3 That worked for me.

[blairb]

Interestingly when I did the same thing with the PPPC utility, it did put the entries into the pref pane, but it left them all unchecked. I'm assuming this is because there is no Allow option under Screen Capture in PPPC Utility. Does allowing Accessibility somehow allow you to work around not having Screen Recording/Capture set to allow?

Additionally, the screen recording permissions are definitely greyed out on standard accounts for us. Not sure why this is different for us.

[blairb]

Nevermind my response above. I see that Screen Recording is only for Catalina, and that since the local user has to enable it, there's now allow checkbox. 99% of my users are on Mojave, so I'll use accessibility for now. Unfortunately though, I'm not having much luck with that either.

[amckee]

Here's a video I made following @TomDay's instructions.

[mhasman]

Hello!

I am looking at the opposite direction, need to block Chrome Remote Desktop. There is managed key to blocklist the extension itself:

<key>ExtensionInstallBlacklist</key>
<array>
<string>extension_id1</string>
<string>extension_id2</string>
</array>

Question - anybody knows what is Chrome Remote Desktop's extension_id, please?

[alphaps]

I'm not having any luck either. The remote assistance option is still unchecked after the profile is installed. I added all 4 files from/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/ folder and I verified that the profile was installed correctly to my test computer. Is there something that I am missing?

[DWilliams-cmsd]

We ended up getting things to work correctly with three App Access items added to the PPPC payload:

[sebastianl]

I had no luck either. Tried the same steps provided by @jsquires3 with PPPC utility. The checkbox is still unchecked.

[darren_leong]

It seems that most of you have had success pushing the application to machines, but I'm having a bunch of issues.

I used the DMG from Google to push to machines and the policy installs fine, but it appears nothing is actually being installed on client machines. I have FEU set on the policy, i've tried it with FEU on and off. I've also tried the PKG from Google with no luck.

Can someone tell me how their policy is setup to get CRD software onto the machine?

[user-SbqsYoNcXA]

install app in application folder /Applications/

[rblaas]

Did anyone got the PPPC working on Big Sur? I have created a PPPC (with PPPC Utility) for Big Sur but it will not be installed. It throws an error saying the key value is not correct.

(standard)Users on Big Sur are not able to allow screen recording.
PPPC is working just fine on Catalina (a PPPC without the Big Sur Compatibility)