{"id":77318,"date":"2026-07-03T05:35:33","date_gmt":"2026-07-03T05:35:33","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=77318"},"modified":"2026-07-03T05:44:21","modified_gmt":"2026-07-03T05:44:21","slug":"macos-screen-sharing-remote-management-troubleshooting-guide","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/macos-screen-sharing-remote-management-troubleshooting-guide\/","title":{"rendered":"macOS Screen Sharing \/ Remote Management Troubleshooting Guide"},"content":{"rendered":"\n

Purpose<\/h2>\n\n\n\n

This guide explains how to troubleshoot macOS Screen Sharing or Remote Management connection issues when connecting from one Mac to another using:<\/p>\n\n\n

vnc:\/\/<TARGET_IP<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Typical symptoms include:<\/p>\n\n\n
Connection failed\nConnection refused\nUsername\/password popup appears but login fails\nScreen Sharing opens but disconnects\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
1. Identify target details<\/h1>\n\n\n\n
Replace these placeholders with your own values:<\/p>\n\n\n
<TARGET_IP<\/span>><\/span>        = IP address of the remote Mac\n<REMOTE_USER<\/span>><\/span>      = username on the remote Mac\n<REMOTE_HOSTNAME<\/span>><\/span>  = hostname of the remote Mac\n<CLIENT_IP<\/span>><\/span>        = IP address of your local Mac\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Example format:<\/p>\n\n\n
Remote Mac IP: <TARGET_IP<\/span>><\/span>\nRemote user: <REMOTE_USER<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
2. Check network reachability<\/h1>\n\n\n\n
From the client Mac:<\/p>\n\n\n
ping -c 4 <TARGET_IP<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Expected result:<\/p>\n\n\n
0.0<\/span>% packet<\/span> loss<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
If ping fails, check:<\/p>\n\n\n
Remote Mac is powered on\nRemote Mac is not sleeping\nBoth Macs are on reachable networks\nVPN\/routing is correct\nIP address has not changed\nFirewall is not blocking ICMP\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
3. Check Screen Sharing port<\/h1>\n\n\n\n
macOS Screen Sharing \/ VNC uses TCP port 5900<\/code>.<\/p>\n\n\n\n
From the client Mac:<\/p>\n\n\n
nc -vz <TARGET_IP<\/span>><\/span> 5900\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Result interpretation<\/h2>\n\n\n\n
Result<\/th>Meaning<\/th><\/tr><\/thead>
succeeded<\/code><\/td>Screen Sharing \/ Remote Management is listening<\/td><\/tr>
Connection refused<\/code><\/td>Remote Mac is reachable, but Screen Sharing is not enabled\/listening<\/td><\/tr>
timed out<\/code><\/td>Firewall, routing, VPN, or network ACL may be blocking traffic<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
If port 5900<\/code> is refused, continue with the next steps.<\/p>\n\n\n\n
\n\n\n\n
4. Check SSH access<\/h1>\n\n\n\n
If SSH is enabled:<\/p>\n\n\n
ssh <REMOTE_USER<\/span>><\/span>@<TARGET_IP<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
If SSH works, you can troubleshoot the remote Mac without physical access.<\/p>\n\n\n\n
If SSH does not work, enable Remote Login<\/strong> locally on the remote Mac:<\/p>\n\n\n
System Settings \u2192 General \u2192 Sharing \u2192 Remote Login\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
5. Enable Remote Management from terminal<\/h1>\n\n\n\n
On the remote Mac over SSH:<\/p>\n\n\n
REMOTE_USER=\"<REMOTE_USER>\"<\/span>\n\nsudo \/System\/Library\/CoreServices\/RemoteManagement\/ARDAgent.app\/Contents\/Resources\/kickstart \\\n-activate \\\n-configure \\\n-access -on \\\n-users \"$REMOTE_USER\"<\/span> \\\n-privs -all \\\n-restart -agent \\\n-menu\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Expected output may include:<\/p>\n\n\n
Activated Remote Management.\nSet user remote control privileges.\nSet user remote access.\nDone.\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
6. Confirm port 5900 is listening<\/h1>\n\n\n\n
On the remote Mac:<\/p>\n\n\n
sudo<\/span> lsof<\/span> -nP<\/span> -iTCP<\/span>:5900<\/span> -sTCP<\/span>:LISTEN<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Expected output may show launchd<\/code>, screensharingd<\/code>, or ARDAgent<\/code>.<\/p>\n\n\n\n
Example:<\/p>\n\n\n
COMMAND<\/span>   PID<\/span>   USER<\/span>   NAME<\/span>\nlaunchd<\/span>   1     root<\/span>   TCP<\/span> *:5900<\/span> (LISTEN<\/span>)\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
This is normal on macOS because launchd<\/code> can listen first and start the actual service when a connection arrives.<\/p>\n\n\n\n
\n\n\n\n
7. Connect from client Mac<\/h1>\n\n\n\n
From the client Mac:<\/p>\n\n\n
open \"vnc:\/\/<TARGET_IP<\/span>><\/span>\"\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Or force the username:<\/p>\n\n\n
open \"vnc:\/\/<REMOTE_USER<\/span>><\/span>@<TARGET_IP<\/span>><\/span>\"\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
When prompted, use:<\/p>\n\n\n
Username<\/span>: <REMOTE_USER>\nPassword<\/span>: remote Mac user password\n<\/code><\/span>Code language:<\/span> HTTP<\/span> (<\/span>http<\/span>)<\/span><\/small><\/pre>\n\n\n
Important: this is the password for the remote Mac user<\/strong>, not the local Mac user.<\/p>\n\n\n\n
\n\n\n\n
8. Verify user permissions<\/h1>\n\n\n\n
On the remote Mac:<\/p>\n\n\n
whoami\ngroups\n<\/code><\/span><\/pre>\n\n\n
Check whether the user is an admin:<\/p>\n\n\n
groups <REMOTE_USER<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
The user should ideally be in:<\/p>\n\n\n
admin<\/span>\ncom<\/span>.apple<\/span>.access_screensharing<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Check Screen Sharing group membership:<\/p>\n\n\n
sudo dscl . -read \/Groups\/com.apple.access_screensharing GroupMembership\n<\/code><\/span><\/pre>\n\n\n
Add the user if needed:<\/p>\n\n\n
sudo<\/span> dseditgroup<\/span> -o<\/span> edit<\/span> -a<\/span> <REMOTE_USER<\/span>> -t<\/span> user<\/span> com<\/span>.apple<\/span>.access_screensharing<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Restart the agent:<\/p>\n\n\n
sudo \/System\/Library\/CoreServices\/RemoteManagement\/ARDAgent.app\/Contents\/Resources\/kickstart -restart -agent\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
9. Check if the user account is valid for GUI access<\/h1>\n\n\n\n
On the remote Mac:<\/p>\n\n\n
dscl . -read \/Users\/<REMOTE_USER<\/span>><\/span> UserShell NFSHomeDirectory IsHidden AuthenticationAuthority\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Healthy examples:<\/p>\n\n\n
UserShell: \/bin\/<\/span>zsh\nNFSHomeDirectory<\/span>: \/Users\/<\/span><REMOTE_USER<\/span>><\/span>\n<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
If IsHidden<\/code> returns:<\/p>\n\n\n
No such key: IsHidden\n<\/code><\/span><\/pre>\n\n\n
That is usually fine. It means the account is not explicitly hidden.<\/p>\n\n\n\n
\n\n\n\n
10. Watch Screen Sharing logs<\/h1>\n\n\n\n
On the remote Mac, run:<\/p>\n\n\n
sudo log stream --style compact --info --predicate 'process CONTAINS[c] \"screensharing\" OR process CONTAINS[c] \"ARDAgent\" OR process == \"loginwindow\" OR eventMessage CONTAINS[c] \"VNC\" OR eventMessage CONTAINS[c] \"authenticate\"'<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Then try connecting again from the client Mac.<\/p>\n\n\n\n
Look for messages like:<\/p>\n\n\n
Authentication: FAILED\nbad authentication occurred\nvalid admin\nscreenCaptureFlag 0\nkTCCServiceScreenCapture\n<\/code><\/span><\/pre>\n\n\n
These help identify whether the issue is:<\/p>\n\n\n
wrong credentials\nmissing user permission\nprivacy\/TCC issue\nMDM restriction\nScreenCapture permission issue\nRemote Management policy issue\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
11. Test legacy VNC password<\/h1>\n\n\n\n
This is useful only as a temporary diagnostic test.<\/p>\n\n\n\n
On the remote Mac:<\/p>\n\n\n
sudo \/System\/Library\/CoreServices\/RemoteManagement\/ARDAgent.app\/Contents\/Resources\/kickstart \\\n-configure \\\n-clientopts \\\n-setvnclegacy -vnclegacy yes \\\n-setvncpw -vncpw Temp1234\n<\/code><\/span><\/pre>\n\n\n
Then from the client Mac:<\/p>\n\n\n
open \"vnc:\/\/<TARGET_IP<\/span>><\/span>\"\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Try:<\/p>\n\n\n
Username<\/span>: leave blank if possible\nPassword<\/span>: Temp1234\n<\/code><\/span>Code language:<\/span> HTTP<\/span> (<\/span>http<\/span>)<\/span><\/small><\/pre>\n\n\n
If username is required:<\/p>\n\n\n
Username<\/span>: <REMOTE_USER>\nPassword<\/span>: Temp1234\n<\/code><\/span>Code language:<\/span> HTTP<\/span> (<\/span>http<\/span>)<\/span><\/small><\/pre>\n\n\n
Result interpretation<\/h2>\n\n\n\n
Result<\/th>Meaning<\/th><\/tr><\/thead>
Legacy VNC works<\/td>Account-based Screen Sharing auth may be broken<\/td><\/tr>
Legacy VNC also fails<\/td>Likely MDM\/TCC\/ScreenCapture\/Remote Management policy issue<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Disable legacy VNC after testing:<\/p>\n\n\n
sudo \/System\/Library\/CoreServices\/RemoteManagement\/ARDAgent.app\/Contents\/Resources\/kickstart \\\n-configure \\\n-clientopts \\\n-setvnclegacy -vnclegacy no\n<\/code><\/span><\/pre>\n\n\n
Do not leave legacy VNC enabled.<\/p>\n\n\n\n
\n\n\n\n
12. Check MDM enrollment<\/h1>\n\n\n\n
On the remote Mac:<\/p>\n\n\n
sudo profiles status -type enrollment\n<\/code><\/span><\/pre>\n\n\n
Possible output:<\/p>\n\n\n
Enrolled via DEP: Yes\nMDM enrollment: Yes\n<\/code><\/span><\/pre>\n\n\n
If the Mac is MDM-managed, local kickstart<\/code> commands may not be enough. MDM profiles can control Screen Sharing, Remote Management, privacy permissions, firewall, login window behavior, and PPPC\/TCC permissions.<\/p>\n\n\n\n
\n\n\n\n
13. List installed configuration profiles<\/h1>\n\n\n
sudo profiles list<\/span> -type configuration\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Look for profiles related to:<\/p>\n\n\n
PPPC\nPrivacy\nRestrictions\nLogin Window\nFirewall\nRemote Management\nSecurity\nMDM\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
14. Inspect privacy \/ PPPC \/ TCC profiles<\/h1>\n\n\n\n
Dump profile details:<\/p>\n\n\n
sudo system_profiler SPConfigurationProfileDataType > \/tmp\/<\/span>profile-details.txt\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Search for remote access and screen permissions:<\/p>\n\n\n
grep -iE \"Remote Desktop|RemoteManagement|Remote Management|ARD|ARDAgent|ScreenCapture|Screen Capture|Screen Recording|screensharing|ScreensharingAgent|AppleVNC|ListenEvent|PostEvent|Accessibility|Deny|Allow|Authorization\"<\/span> \/tmp\/profile-details.txt -C 12<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
You want to know whether the MDM profile allows or denies:<\/p>\n\n\n
ScreenCapture\nListenEvent\nPostEvent\nAccessibility\nARDAgent\nScreensharingAgent\nAppleVNCServer\nRemote Management\nApple Remote Desktop\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
15. Check local TCC database<\/h1>\n\n\n\n
On the remote Mac:<\/p>\n\n\n
sudo sqlite3 \"\/Library\/Application Support\/com.apple.TCC\/TCC.db\"<\/span> \\\n'.headers on'<\/span> \\\n'.mode column'<\/span> \\\n'select service, client, client_type, auth_value, auth_reason, flags, datetime(last_modified,\"unixepoch\",\"localtime\") as modified\n from access\n where service like \"%Screen%\"\n    or service like \"%Listen%\"\n    or service like \"%Post%\"\n    or service like \"%Accessibility%\"\n order by service, client;'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Important services:<\/p>\n\n\n\n
Service<\/th>Meaning<\/th><\/tr><\/thead>
kTCCServiceScreenCapture<\/code><\/td>Screen capture \/ screen recording<\/td><\/tr>
kTCCServiceListenEvent<\/code><\/td>Observe input events<\/td><\/tr>
kTCCServicePostEvent<\/code><\/td>Control keyboard\/mouse<\/td><\/tr>
kTCCServiceAccessibility<\/code><\/td>Accessibility control<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n
16. Check MDM TCC overrides<\/h1>\n\n\n
sudo ls -l \"\/Library\/Application Support\/com.apple.TCC\/\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Then:<\/p>\n\n\n
sudo plutil -p \"\/Library\/Application Support\/com.apple.TCC\/MDMOverrides.plist\"<\/span> 2<\/span>>\/dev\/<\/span>null<\/span> | \\\ngrep -iE \"ScreenCapture|Screen|ListenEvent|PostEvent|Accessibility|ARDAgent|screensharing|Remote|AppleVNC|Deny|Allow\"<\/span> -C 8<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
If MDM overrides exist and do not allow Apple Remote Desktop \/ Screen Sharing components, IT may need to update the MDM policy.<\/p>\n\n\n\n
\n\n\n\n
17. Check Login Window profile<\/h1>\n\n\n\n
If a Login Window profile is installed:<\/p>\n\n\n
sudo profiles show -type configuration > \/tmp\/<\/span>all-profiles.txt 2<\/span>>&1<\/span>\n\ngrep -iE \"loginwindow|Autologin|allowed|denied|authorized|users|groups|Disable|Deny|Allow\"<\/span> \/tmp\/all-profiles.txt -C 10<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Login Window profiles may affect:<\/p>\n\n\n
autologin\nallowed users\nlogin display behavior\nremote login\/session behavior\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
18. Check firewall profile<\/h1>\n\n\n
sudo profiles show -type configuration > \/tmp\/<\/span>all-profiles.txt 2<\/span>>&1<\/span>\n\ngrep -iE \"firewall|stealth|block|allow|screen|remote|5900|sharing|ARD|VNC\"<\/span> \/tmp\/all-profiles.txt -C 10<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Also check listening port again:<\/p>\n\n\n
sudo<\/span> lsof<\/span> -nP<\/span> -iTCP<\/span>:5900<\/span> -sTCP<\/span>:LISTEN<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
If 5900<\/code> is listening and the connection reaches the login popup, firewall is less likely to be the main issue.<\/p>\n\n\n\n
\n\n\n\n
19. Common root causes<\/h1>\n\n\n\n
Symptom<\/th>Likely cause<\/th><\/tr><\/thead>
Ping fails<\/td>Network, VPN, sleep, wrong IP<\/td><\/tr>
Ping works, 5900 refused<\/td>Screen Sharing\/Remote Management disabled<\/td><\/tr>
5900 works, login popup appears, password fails<\/td>User permission, auth, MDM, or privacy issue<\/td><\/tr>
User is admin and allowed, but login still fails<\/td>MDM\/PPPC\/TCC policy likely<\/td><\/tr>
Legacy VNC also fails<\/td>Strong sign of MDM\/ScreenCapture\/Remote Desktop policy issue<\/td><\/tr>
Screen connects but black screen<\/td>ScreenCapture \/ display \/ headless Mac issue<\/td><\/tr>
Can view but not control<\/td>PostEvent \/ Accessibility \/ Remote Management control permission issue<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n
20. Full diagnostic collection script<\/h1>\n\n\n\n
Run this on the remote Mac:<\/p>\n\n\n
echo<\/span> \"=== Host Info ===\"<\/span>\nhostname\nscutil --get ComputerName\nscutil --get LocalHostName\nsw_vers\ndate\n\necho<\/span>\necho<\/span> \"=== Listening Ports ===\"<\/span>\nsudo lsof -nP -iTCP:5900<\/span> -sTCP:LISTEN\nsudo lsof -nP -iTCP:22<\/span> -sTCP:LISTEN\n\necho<\/span>\necho<\/span> \"=== User Info ===\"<\/span>\nwhoami\nid <REMOTE_USER>\ngroups <REMOTE_USER>\n\necho<\/span>\necho<\/span> \"=== Screen Sharing Group ===\"<\/span>\nsudo dscl . -read \/Groups\/com.apple.access_screensharing GroupMembership\n\necho<\/span>\necho<\/span> \"=== User Record ===\"<\/span>\ndscl . -read \/Users\/<REMOTE_USER> UserShell NFSHomeDirectory IsHidden AuthenticationAuthority 2<\/span>>&1<\/span>\n\necho<\/span>\necho<\/span> \"=== ARD \/ Screen Sharing Processes ===\"<\/span>\nps aux | egrep \"screensharingd|ARDAgent|ScreensharingAgent\"<\/span> | grep -v grep\n\necho<\/span>\necho<\/span> \"=== MDM Enrollment ===\"<\/span>\nsudo profiles status -type enrollment\n\necho<\/span>\necho<\/span> \"=== Configuration Profiles ===\"<\/span>\nsudo profiles list<\/span> -type configuration\n\necho<\/span>\necho<\/span> \"=== Profile Details Search ===\"<\/span>\nsudo system_profiler SPConfigurationProfileDataType > \/tmp\/profile-details.txt\ngrep -iE \"Remote Desktop|RemoteManagement|Remote Management|ARD|ARDAgent|ScreenCapture|Screen Capture|Screen Recording|screensharing|ScreensharingAgent|AppleVNC|ListenEvent|PostEvent|Accessibility|Deny|Allow|Authorization\"<\/span> \/tmp\/profile-details.txt -C 12<\/span>\n\necho<\/span>\necho<\/span> \"=== TCC Database ===\"<\/span>\nsudo sqlite3 \"\/Library\/Application Support\/com.apple.TCC\/TCC.db\"<\/span> \\\n'.headers on'<\/span> \\\n'.mode column'<\/span> \\\n'select service, client, client_type, auth_value, auth_reason, flags, datetime(last_modified,\"unixepoch\",\"localtime\") as modified\n from access\n where service like \"%Screen%\"\n    or service like \"%Listen%\"\n    or service like \"%Post%\"\n    or service like \"%Accessibility%\"\n order by service, client;'<\/span>\n\necho<\/span>\necho<\/span> \"=== MDM Overrides ===\"<\/span>\nsudo plutil -p \"\/Library\/Application Support\/com.apple.TCC\/MDMOverrides.plist\"<\/span> 2<\/span>>\/dev\/null<\/span> | \\\ngrep -iE \"ScreenCapture|Screen|ListenEvent|PostEvent|Accessibility|ARDAgent|screensharing|Remote|AppleVNC|Deny|Allow\"<\/span> -C 8<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
21. Escalation message for IT<\/h1>\n\n\n
Hi IT,\n\nI am trying to connect to a managed Mac using macOS Screen Sharing \/ Remote Management.\n\nI verified the following:\n\nNetwork:\n- ping works\n- SSH works\n- port 5900<\/span> is listening\n- Screen Sharing reaches the remote Mac and shows the login popup\n\nUser\/permission:\n- the remote user is valid\n- the remote user is an admin\n- the remote user is in<\/span> com.apple.access_screensharing\n- Remote Management was enabled using kickstart\n- ARDAgent was restarted\n\nFailure<\/span>:\n- Screen Sharing login still fails\n- temporary legacy VNC password auth was also tested and failed\n- logs show Screen Sharing authentication failure\n\nMDM<\/span>:\n- the Mac is DEP\/MDM enrolled\n- configuration profiles include PPPC\/privacy, restrictions, login window<\/span>, and firewall policies\n- I do<\/span> not see a clear PPPC\/TCC allow entry for<\/span> Apple Remote Desktop \/ ARDAgent \/ ScreensharingAgent \/ AppleVNCServer\n\nCan you please check MDM policy for<\/span> this<\/span> Mac and confirm:\n\n1.<\/span> Apple Remote Desktop \/ Remote Management is enabled via MDM, not only local kickstart\n2.<\/span> Observe + Control permissions are enabled\n3.<\/span> PPPC\/TCC allows ScreenCapture, ListenEvent, PostEvent, and Accessibility for<\/span> Apple Remote Desktop \/ ARDAgent \/ ScreensharingAgent \/ AppleVNCServer\n4.<\/span> No restriction, login window<\/span>, or firewall profile is blocking Screen Sharing\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
22. Final takeaway<\/h1>\n\n\n\n
When macOS Screen Sharing fails, troubleshoot in this order:<\/p>\n\n\n
Network \u2192 Port 5900 \u2192 SSH \u2192 Remote Management \u2192 User permissions \u2192 Logs \u2192 Legacy VNC test \u2192 MDM\/PPPC\/TCC policy\n<\/code><\/span><\/pre>\n\n\n
If all local checks pass but both normal Screen Sharing and legacy VNC fail, the issue is usually outside the local user account and should be handled by the MDM\/IT team.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Purpose This guide explains how to troubleshoot macOS Screen Sharing or Remote Management connection issues when connecting from one Mac to another using: Typical symptoms include: 1…. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-77318","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=77318"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77318\/revisions"}],"predecessor-version":[{"id":77321,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77318\/revisions\/77321"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=77318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=77318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=77318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}