macOS Monterey - "Your screen is being observed" lockscreen has evolved to a menu bar notification

[Andrew_N]

This thread is a decent reference to the "feature" on Big Sur, as it's not brought up that much from what I can tell: Solved: Hide "Your screen is being observed" - Jamf Nation Community - 236104

Unfortunately the solution was "you can't" and I would not be surprised if that's the same solution here, just want to confirm before I have to break the bad news to the teams that'll be affected by it.

Now when you remotely screenshare with ARD/VNC, it makes a very obvious popup from the menu bar with icon stating that "Your screen is being controlled" with the IP that it's coming from:

And then on top of that, it says when it stops being observed:

I get that it's for security and can help a little bit, with the off chance that someone sees a connection that's not with an expected IP address (for example we'll be asking folks to watch for any non 172.etc addresses), but most end users won't know or retain that information and generate unnecessary noise and change a lot of behaviors when being observed or not observed. 

I've looked through kickstart, turning off extramenu does something, just makes it so that the end user can't message the observer, thank the Flying Spaghetti Monster for that at least. ShowObserve does nothing and I think to turn off ShowObserve you need to reset privs and then just not use it, if I'm understanding that usage correctly?

As an aside, it's mentioned in the above link, there used to be an option in System Preferences > Sharing to turn off "Show when being observed" (which didn't work for the lockscreen message) and this is just gone now.

But yeah, I'll see if I can find anything for this in the system, for now I looked through online resources and found virtually nothing that reference this specific "feature" with Monterey and literally nothing on how to turn it off. If anyone else has any idea, please share, if anyone finds this thread, hopefully I'll find the answer to share with the class.

[mosermat]

I ran into this when we started upgrading our fleet to Big Sur. We have AppleTV's in our environment and use them solely to airplay Macbooks to AppleTV's. Teachers would sometimes connect to the AppleTV and then lock their macbook screen...then they would see the "Your Screen is being observed." message on the lockscreen. This freaked them out and we got tickets.

This message appears on the login/lock screen when Macbooks are in “Screen Sharing” mode which can happen for multiple reasons:

1. During Airplay (to an AppleTV or another device)
2. When another computer is actively connected via VNC (remote access)
3. If the End-User granted access for another app to use Screen Sharing for a specific reason.

During any of these events mentioned above when Screen Sharing is active, if the Macbook goes to the lock screen (aka Login Screen)…the “Your screen is being observed” message will appear plainly:

If someone connects to another Macbook via VNC there is a small ‘Screen Sharing’ icon that appears on the end-user’s Menu Bar until sharing stops and the 2-second popup message.

Short of disabling Screen Sharing (probably not a serious option) I don't currently know of a way to get rid of this messaging. It's my understanding this is built into MacOS as a security feature. Once I explained this to our Staff we stopped getting asked about it.

[tcam]

The menu item will not alert the user if the menu item is off. (at least in 10.5.2)

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart  -clientopts -setmenuextra no

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent -menu

But even if the menu item is off, the login & lock screen window will still display your are being observed. 

Kind of off topic, but I like how the login banner now displays on the lock screen. 
Maybe in a future update, they can enable 'Show additional information in the menu bar' on the lock screen as well. 

[Andrew_N]

---

@tcam wrote:

The menu item will not alert the user if the menu item is off. (at least in 10.5.2)

But even if the menu item is off, the login & lock screen window will still display your are being observed. 

---

Yeah, I briefly touched on the menuextra, I just bungled the syntax in the message (not on the machine though 😉) option:

"I've looked through kickstart, turning off extramenu does something, just makes it so that the end user can't message the observer, thank the Flying Spaghetti Monster for that at least."

Unfortunately it does nothing else for the menu bar popup on macOS 12 as far as I can tell.

[palmna]

It appears that, as of now, there is no way to disable the "Your screen is being controlled" notification.  Using:

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart  -configure -clientopts -setmenuextra -menuextra no

doesn't enable/disable the notifications, rather it specifies if the ARD menu should be present when the client is not being observed/controlled.  

My suggestion to everyone is to submit feedback directly to Apple about the need to disable these notifications in an enterprise/education environment. 

In the meantime, I'll be stalking this thread to see if anyone finds a workaround. 

[PictureProducti]

Yeah, that message has got to go, it freaks out our users. I use it for IT admin purposes and to check users are following instructions correctly and for problem solving, but when that shows up it looks like we're being nosey and is interpreted as a trust issue.

[DaneLG]

I've found somewhat of a workaround for this, though it's not exactly the best thing you ever did see.

You can prevent this message from popping up by creating a new Restricted Software entry and block the process called SSMenuAgent.  It does cause the process and menu item to continuously launch, but close before producing the "Your screen is being controlled" message.  I haven't extensively tested this so please do so before deploying.

[palmna]

@DaneLG, this is interesting.  I'll definitely do some playing around with this. Thanks for sharing.

[Qwheel]

Tried restricting the SSMenuAgent process.
With and without 'kill the process' ticked.
Each time ARD remote access became flaky and required a system restart to restart processes.

[Andrew_N]

Small Update:

The behavior changed a little in macOS 12.3, no longer getting a pop up saying that someone has control with details, it's now just the menu bar icon.

Also I did try the SSMenuAgent suggestion and it caused ARD to not work while the menu icon would continuously re-appear on the menu bar.

[DaneLG]

Yes, unfortunately the "workaround" isn't flawless at all.  I've removed it from our environment.  But very happy to see that the behavior has changed in 12.3, even if the icon is still there.  Thanks for letting us know!