In a number of Mac-using environments, there is often a need for IT staff to remotely connect to a Mac’s screen using Apple’s Remote Desktop application and work with the person on the other end to resolve a problem. However, there can be several technical and human-centric issues with enabling remote assistance:
- Authentication – To enable access using a username and password, that user account must be granted access rights by belonging to a group or by explicitly granting rights to a local account.
- Password rotation – If you’re enabling screensharing via granting access to a local account, the security requirements in most environments mandate that those passwords be changed on a regular basis. However, securely changing the account password on multiple remote Macs can be a management challenge on its own.
- Access privileges – A lot of folks don’t like the idea that someone they don’t know can take over access to their keyboards and screens without the remote customer saying it’s OK for them to do so. Frankly, I’ve been on both sides of this fence and I don’t like it either.
However, there is a way to enable screen sharing using Apple’s Remote Desktop Client and Apple’s Screen Sharing.app which does the following:
- Removes the need for any account to be enabled for screen sharing access
- Mandates that all screen sharing access be approved by the logged-in user
- Does not allow screen sharing access if no user is logged in.
For more details, see below the jump.
To configure Apple’s Remote Desktop Client to allow only explicitly-permitted screen sharing access, use the following procedure:
1. Log into the Mac in question
2. Open System Preferences
3. Select the Sharing preferences
4. Check the Remote Management box to turn on the Remote Desktop Client
5. In the Allow access for: section, select the Only these users: option, but do not select any users.
6. Click the Computer Settings… button.
7. Select the Anyone may request permission to control screen option, then click the OK button.
8. Close System Preferences
You may also configure the Remote Desktop Client using Apple’s kickstart utility. To set the above configuration using the kickstart utility, run the command shown below with root privileges:
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers -setreqperm -reqperm yes
Once the Remote Desktop Client is configured this way, the Remote Desktop Client should not allow any remote user to authenticate successfully, but will allow the logged-in user to permit screen sharing requests from remote users.
To screen share with a remote Mac configured this way, use the following procedures:
Sending a screen sharing request
1. Open the Screen Sharing application
2. Under the Connection menu, select New…
3. In the Connect To: blank, enter the DNS name or IP address of the remote Mac then click the Connect button.
4. When prompted to log in, select By requesting permission.
5. Once By requesting permission is selected, click the Connect button.
6. Wait for the response.
Accepting a screen sharing request
1. On the remote Mac’s screen, a Share Screen Request prompt will appear to the logged-in user.
2. If all appears OK, click the Share Screen button.
Once the request has been accepted, the remote Mac’s screen should appear in the Screen Sharing application.
With this Remote Desktop Client configuration, there must be a logged-in user in order for a screen sharing connection to take place. If no user is logged in, then the By requesting permission option will not appear in the login prompt.
This method only enables the following functions:
- Screen sharing
- The ability to copy files from the remote Mac, by dragging and dropping the file from its location on the remote Mac to a location outside of the Screen Sharing window.
None of the Remote Desktop Client’s other features will be enabled, including the ability to copy files to the remote Mac, pull reports from the remote Mac, or the ability to run commands on the remote Mac.
