Apple Remote Desktop

[Tinribs]

Hi All,

I'm trying to enable ARD on our music MACS without having to physically go to each MAC and set the relevant settings. I can see them on ARD but when I logon as our global admin user the config profile for some reason is kicking in and denying me access to the users and the sharing bits of System Admin. When you're in front of a physical mac you can bypass this by pressing shift as you logon and choosing disable preferences when prompted.

 

Is there a way to do this when logging on via ARD?

Alternatively, all I need to do is create a local user and give that user remote access for full control etc - I just don't want to have to visit all 30 computers and do it manually - if there's a way for a not mac knowledgeable person to do this then that would be good to know. I've seen pages of DSCL commands etc - I don't really understand them! I'm familiar (to a small extent) with scripting in DOS etc but not MAC OS, Unix and so on..

 

TIA

Mark P.

[Arthur]

Have you got a policy to set the Privacy Preferences Policy Control for ARD in your MDM?

 

https://support.apple.com/en-us/HT209161

Edited July 22, 2019 by Arthur

[bald_pig]

You should just be able to hold shift when logging in, ARD just VNC's onto the mac, you're controlling it the same as you're sitting in front of it.

[Tinribs]

Just tried it again to make sure - definitely not working. Not sure if it makes a difference but I'm VNC'd onto our Mac server from my computer then remoting from that server to one of the workstations. Pressing shift whilst logging on this way seems to be ignored....

[Tinribs]

Nope - no MDM

[AntonioRocco]

There's no way of enabling ARD remotely without either (a) enabling the service from the beginning when building your mac 'golden image' prior to deploying it. Some of the recommended Mac deployment methods are: DeployStudio, NetBoot, AutoDMG etc. Hopefully you may be familiar with at least one of these? If you're using SCCM and you've enabled the Mac Client part of SCCM then you should be able to use that instead using the details outlined below.

 

Quick question: did you or have you enabled SSH on all your Macs by any chance?

 

If NO then again you'd have to enable it from the beginning as their's no way of enabling that remotely either. AFAIK and unless someone else offers something that works for your situation then your only alternative is to go to each one in turn, log in as the local admin and enable the service from the Sharing Preferences Pane.

 

Tip: Hold down the option/alt key when you click the first check box from the options button when you enable the service as this will tick all the check boxes at the same time.

 

If YES then launch Terminal on the Mac you use for administering all your other macs and make sure you're in the same subnet as those Macs first. From the Shell Menu select New Remote Connection. In the Service section for SSH you should see the Macs Bonjour names in the Server section. Select one first and in the User field at the bottom of the window key in the local admin user's name (lower case letters). Click Connect and a new Terminal window will open warning you about RSA key fingerprints. Key in the word yes followed by the carriage return and you'll then be prompted for that users password which you won't see being typed. If successfully connected you should see:

 

Last login: the date

name-of-Mac-you've-connected-to:~localusername

 

To enable ARD use this command:

 

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent

 

Followed by the carriage return.

 

The admin part of the command above should be changed to what you've configured as the localadmin user name for all your Macs. If you'd used local admin then change the above to localadmin. Don't create another local admin user as Apple 'Best Practices" recommends you do it this way. Besides you'd have to go round each Mac in turn to create yet another user.

 

You can copy/paste the above into the terminal window.

 

Do this for each Mac in turn.

 

If you've used DeployStudio before to deploy your golden image to all your Macs and you're familiar with it, you could define a one-time workflow with a single script that enables both services. SSH is very useful when troubleshooting and a great means of communicating with your Macs other than ARD. It's also a great way of restarting the ARDAgent when it plays up - which it will - occasionally.

 

Defining a script that will do this will look like this:

 

#!/bin/sh

 

#Enabling SSH & Remote Management

 

systemsetup -setremotelogin yes

 

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent

 

exit 0

 

Again you can copy/paste the above into one of the sample scripts. Make a copy of the sample script first before overwriting it and name it something meaningful.

 

DSCL stands for Directory Services Command Line and is a very powerful tool in not only interrogating homogenous directory services such as Open Directory and Active Directory but also in creating, editing and deleting users. Either locally or on a directory server such as Apple's Open Directory. So be careful using it! You can't edit, create or delete users in Active Directory using DSCL.

 

The Catch22 with DSCL is you need to enable SSH or ARD first before you can use it remotely on your Macs.

 

Does this help?

 

Antonio Rocco (ACN)

Edited July 25, 2019 by AntonioRocco