Ensure Remote Management Is Disabled

HighLevel 1Automatedmacos

Description

Remote Management is the client portion of Apple Remote Desktop (ARD). Remote Management can be used by remote administrators to view the current screen, install software, report on, and generally manage client Macs. The screen sharing options in Remote Management are identical to those in the Screen Sharing section. In fact, only one of the two can be configured. Audit: Passes when no ARDAgent process is running.

How it is checked

Audit method: Shell command

shell

[ -x /usr/bin/sw_vers ] || exit 1
out=$(/bin/ps -axo comm= 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -c ARDAgent || true

Expected output: 0

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources /kickstart -deactivate -stop. GUI: System Settings > General > Sharing > Set Remote Management to disabled.

Properties

Operating systems: macos-15
Tags: macossystem-settings
Reference: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 2.3.3.5 Ensure Remote Management Is Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos