Help

Log Jamf user who enables remote desktop

wsievers
New Contributor

Posted on ‎02-03-2023 11:37 AM

Hello Everyone, 

 

I am having an issue with one of our technicians leaving Remote Desktop enabled. I thought that Jamf Pro would log the username of the Jamf user who enables it but the field is blank under management history. See attached picture. 

Screenshot 2023-02-03 at 2.31.38 PM.png

Is there a way through a smart group/script after so much time has elapsed that it would auto disable remote desktop? 

 

Thank you! 

0 Kudos
2 REPLIES 2

jtrant
Valued Contributor

‎02-03-2023 01:43 PM - edited ‎02-03-2023 01:45 PM

Change Management logs these actions, and you can output to a syslog server of your choice?

Take a look under System > Change Management inside Jamf Pro. Your search criteria would be "EnableRemoteDesktop" and "DisableRemoteDesktop".

There is no option to automatically disable Remote Desktop via MDM, but you could potentially create an EA to capture the status and a script to disable. If I remember correctly though, Apple have deprecated some of those Terminal commands in favor of MDM.

0 Kudos

AJPinto
Honored Contributor III

Posted on ‎02-06-2023 05:50 AM

Remote desktop can be disabled with CLI. For JAMF to be able to turn Remote Desktop off after a period of time, JAMF would need to know time has passed since it was abled. I am not aware of a way to see when Remote Desktop was enabled, but that does not mean you could not create a way.

 

  1. Create a smart group to read if Remote Desktop is enabled.
  2. Create a policy to run on check in targeting all devices with Remote Desktop enabled, to place a "flag file" somewhere on the disk and echo the date in to that file.
  3. Make an extension attribute to read for the presense of that file and if exists read the date.
  4. Make a smart group targeting devices with that file and so many days past the given date.
  5. Target a policy to disable Remote Desktop and remove the flag at the smart group created in step 4.

Note, a flag file is just a text document you are placing on a device for JAMF to look for. Its like the device raising a flag.To make life easier do not reuse flag files for multiple purposes.

 

The work flow. 

  1. Your tech or anyone enables Remote Desktop
  2. Recon runs at some point and sees Remote Desktop is enabled
  3. Your smart group adds the Mac to the smart group seeing Remote Desktop is enabled
  4. Your policy will run to drop the flag because the Mac is now in the scope because its in that Remote Desktop group
  5. XYZ days pass the Mac will be added to the smart group for the flag file being so old
  6. Policy will run to disable Remote Desktop and remove the flag because it was added to the scope

 

 

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate

 

You could also do this with JAMF API, but its probably best not to.

Disable Remote Desktop | Apple Developer Documentation

0 Kudos