Jamf Pro Remote Control macOS?

[ukmercenary]

Is it possible to use Jamf Pro to remote onto a enrolled Macbook? and if so how? 

[jbisgett]

If you are on the same physical network, you can use the Jamf Remote app that is part of the Jamf administrator app bundle (Jamf Admin, Jamf Remote, Composer).

If the end user is on a remote network, then you would need to implement the TeamViewer integration (so long as your Jamf Pro instance was at least on 10.31). A valid TeamViewer subscription would be required.

https://hcsonline.com/images/PDFs/Integrate_TeamViewer_with__Jamf.pdf

https://community.teamviewer.com/English/kb/articles/108810-jamf-pro-integration-installation-and-us...

[Hugonaut · Accepted solution]

I do not recommend using Jamf Remote as Jamf has added features (in Jamf Pro Dashboard) under Jamf System Settings -> Global Management -> Remote Administration -- for 3rd Parties (& Hopefully a new App from Jamf to replace Remote...) BECAUSE Jamf is removing Jamf Remote from its suite.

Per Jamf in a lot of the recent release notes - https://docs.jamf.com/10.36.0/jamf-pro/release-notes/Deprecations_and_Removals.html

• Jamf Remote—Jamf will stop distributing Jamf Remote in a future release of Jamf Pro (estimated removal date: May-July 2022). Disclaimer: Screen Sharing workflow using Jamf Remote has been deprecated. It is recommended to use TeamViewer for remote administration. For instructions on how to integrate TeamViewer with Jamf Pro, see "TeamViewer Integration" in the Jamf Pro Documentation.

[jpeters21]

not after the removal of the Jamf Remote tool.. which is not in your Jamf pro console, its in the same pack as Composer. 

I think the company Line is now you can use ARD or get a Team Viewer license. 

[pete_c]

Sort of.  You can use Jamf Pro's "Jamf Remote" application to open a new VNC session to a Jamf-enrolled Mac on a reachable subnet, but it's pretty bare-bones and this functionality hasn't seen significant investment or updates in quite some time.  Compared to other Mac-centric RMMs like Addigy, Jamf's lack of any remote access solution is embarrassing.

If you often need to remotely connect to an off-site device, you're much better off deploying a purpose-built solution, such as Splashtop or LogMeIn/GoTo.

[ukmercenary]

Thanks! I got the user up and running now anyway but thanks. 

[jpeters21]

does a "valued contributor" get to mark themselves as the Accepted Answer or does Jamf just more inherently select them? I just see a growing trend 

[Hugonaut]

(I think) Valued Contributor status is predicated upon Kudos (I've been a forum junkie here for a few years) - the author/creator/op chooses which reply to label as the "Accepted Solution".

[mhasman]

IMO the best part of Jamf Remote is ability to manage/control remote access privileges from Jamf PRO; tools might be provided to non-admins, techs, IT Security with no using any 3rd part services or taking care of any extra solutions.

2nd, I like the ability to push packages, policies, scripts which are already on Jamf PRO to single or multiply Macs without capturing IPs and keeping local copy of packages, scripts - comparing to ARD, TeamViewer

3rd (but I can see how it might be #1) is security. Integration to Jamf PRO means no extra tools to manage security issues, access rights, hidden admin accounts, shared passwords, etc. 

Jamf Remote is simple, deeply integrated tools, powerful enough for 99% of needed remote tasks, and secured. I only wish it has a little better, modern interface. 

[jcarr]

You can send the 'Enable Remote Desktop' command via Jamf Pro (see Remote Commands for Computers).  This will allow you to use either Screen Sharing (free, included with macOS) or Apple Remote Desktop.   Be aware that this remote command enables Remote Desktop for ALL users on the system.  You may want to run a script prior to sending this command that will limit the scope of the Remote Management settings using kickstart.  Here's an example:

#!/bin/sh

# ARD User short named passed to this script from Jamf Pro policy as parameter $4

logger "$0: Configure Apple Remote Desktop access for $4."

usermissing=`finger -ms $4 2>&1 1>/dev/null | wc -l`

if [ ${usermissing} -eq 1 ]; then
	echo "User $4 not found."
	logger "$0: User $4 not found."
	exit 1
fi

# Hide ARD user from login window

dscl . create /Users/$4 IsHidden 1

# Configure Apple Remote Desktop access only for specified users

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -allowAccessFor -specifiedUsers

# Configure Apple Remote Desktop Agent for ARD user specified by parameter $4

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users $4 -access -on -privs -all -clientopts -setmenuextra -menuextra yes

# Hide 'Other' from Login Window

defaults write /Library/Preferences/com.apple.loginwindow SHOWOTHERUSERS_MANAGED -bool false

exit 0

[mhasman]

Thank you @jcarr 

Yes, I use similar command to set remote access and remote management:

sudo -S /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -activate -access -on -privs -all -allowaccessfor -allusers -restart -agent

But Screen Sharing and ARD are not as Enterprise-friendly as Jamf Remote. To use Screen Sharing and ARD, you have to know, or find out, or request IP for remote access session, then provide ID and password or request the access, etc. With Jamf Remote, Jamf admin just needs to grand nesessary access level for account on Jamf Pro side; it works great with LDAP accounts added to Jamf PRO; techs can use their LAN passwords with no other additional accounts/passwords, easy find remote Macs by end-user names, Mac names, etc. 

Just compare how many steps it takes to deploy, setup ARD vs. Jamf Remote for tech being able to access to Mac; compare how many steps/time it takes to find needed Mac, remote with Screen Share vs. ADR vs. Jamf Remote. With TeamViewer, even worth - see the demo session video on JNUC 2021; it makes user to download, install within any single remote session... joke? 

Sure, any of those might work well for small setups. When there are big number of managed devices, offices, locations - and techs needed to have remote access ability - Jamf Remote wins. IMO

[mhasman]

UPD. I was reviving your script. Seems like there is standalone account on any Mac (sent as $4) with simple password to be shared with anyone needs remote access to your Macs. Not sure if your Security team is OK with that setup, seems like serious security issue for me. See how different it works with Jamf Remote