Ensure Remote Management Is Disabled

AltaNivel 1Automatizadamacos

Descripción

Remote Management is the client portion of Apple Remote Desktop (ARD). Remote Management can be used by remote administrators to view the current screen, install software, report on, and generally manage client Macs. The screen sharing options in Remote Management are identical to those in the Screen Sharing section. In fact, only one of the two can be configured. Audit: Passes when no ARDAgent process is running.

Cómo se verifica

Método de auditoría: Comando de shell

shell

[ -x /usr/bin/sw_vers ] || exit 1
out=$(/bin/ps -axo comm= 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -c ARDAgent || true

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Terminal: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources /kickstart -deactivate -stop. GUI: System Settings > General > Sharing > Set Remote Management to disabled.

Propiedades

Sistemas operativos: macos-26
Etiquetas: macossystem-settings
Referencia: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.3.3.5 Ensure Remote Management Is Disabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos