Enable Remote Management with Managed Preference

[EightQuarterBit]

Anyone here know how to enable Remote Management (and only for one user) via a managed preference?

[Matt · Accepted solution]

Why not just make a login script?

#!/bin/sh

# adminUser = Admin User Name for Remote Acces

adminUser="youruser"

##################################
# Do Not Modify Below This Line  #
##################################

if [ "$4" != "" ] && [ "$adminUser" == "" ];then
    adminUser=$4
fi

# DEFINE CONTROL SETTINGS

privs="-DeleteFiles -ControlObserve -TextMessages -OpenQuitApps -GenerateReports -RestartShutDown -SendFiles -ChangeSettings"

# Do Not Modify Below This Line

if [ "$adminUser" != "" ]; then
    /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers
    /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -access -on -privs $privs -users $adminUser
fi

[EightQuarterBit]

Worked like a charm. Many thanks, good sir!

[JimAllsop]

How would I do this for several users? (Ie I only want my tier 3 help desk techs to be able to remote into the senior execs computers. So enabling the standard administrator account won't work. Can't do it via AD either cause only systems and myself as the help desk manager are domain admins. So I need to be able to add 4 users to remote access.

[chriscollins]

@JimAllsop, in his script, at the adminUser variable, just add more usernames separated with commas.

adminUser="user1,user2,user3"

[JimAllsop]

Thanks!! I'm new to writing scripts! Thanks once again.

[asd_alozano]

Hi.

I am new to this Casper Suite and I would appreciate any help that i can get.

How do i go about turning off remote login and remote management for all local/domain users and only enable it for localadmin? (admin account name = localadmin).

Can this be done in the background?

Thanks.

[mjohnston]

@chriscollins , So can user1, user2, user3 be AD users or do they have to already have a local profile on the machine I'm setting up?

Scenario: I have 6 Mac minis connected to 6 TV's used for monitoring for different teams. I'm trying to avoid using wireless keyboards and mice as they will get confused or misplaced etc...
I only want to allow members of each team to be able to remote to their corresponding mac mini / TV.
Would be anywhere between 2-6 people may need access to each mac mini.

Would be happy for any input anyone has.
Thanks,
Matt

[slatert]

This script works perfectly to enable remote when using DEP imaging, Prestage with a payload of a hidden user. Thanks!

[Garrett]

What would we enter in for adminUser if we want this script to just be installed for all users on the machine?

[quedayone]

Yes I would like to add ad group "domain admins". That would be cool.

[stephaniemm77]

Does this script still work in 10.14?

[maffettb]

@stephaniemm77 Yes, just tested this on a DEP machine running 10.14.5 and it seems to have worked for me.

[blackholemac]

I would test that workflow thoroughly using every function of ARD. I once thought that something similar to this would work and later found that it would not. It would only allow observation. I do know that this workflow will work if you add in the following PPPC profile from my screenshot here.

[maffettb]

Oh yes, sorry should have specified...I'm kind of lucky that the school I work for has ignored macs entirely until now. Annoying for me to figure out stuff and make it work with their windows network but I get to start from scratch. I do have that PPPC profile as part of my base config profile that is part of pre-stage enrollment.
So, DEP, PPPC, and then yes, that script is working on 10.14.5 for screen control and sharing. Jamf Remote is also following the JAMF user privileges in regards to asking end user permission before taking control or just giving control without prompt.
I started down this rabbit hole since JAMF Remote for some reason just failed to screen share on my network unless remote management was on.

[mwiese1]

This script is awesome and we still use it in our environment. Has anyone looked into / figured out how to accomplish this via Config Profile?