Basic configuration of Jamf Pro 10.31 and TeamViewer

Hi all,

After a some break for blogging and dedicating some of my free time to other hobbies like 3D Printing, I guess it’s about time to do another blog post.

Thanks to Talking Moose for answering a few question I had about this.

This time I’d like to have a look at the new TeamViewer integration in Jamf Pro 10.31. In view of avoiding the post to become too long, I’ll split it in to separate post:

1. Basic configuration of Jamf Pro 10.31 and TeamViewer (this post)
2. Deploying TeamViewer silently with Jamf Pro

It may be weird to move the deployment of TeamViewer to a second post… as you’ll actually need it to test what I’m going to talk about today, however, because it needs some additional scripting I prefer to just do the basics now and install TeamViewer manually on my target test computer.

Don’t worry, while for now we’re going to install TeamViewer manually, I’ll share and discuss the necessary scripting in my second post!

So for now, the basics, let’s go!

First things first… the documentation: https://docs.jamf.com/jamf-pro/administrator-guide/TeamViewer_Integration.html

While I’d recommend to give it a good read, let me highlight a view important items here:

• From a firewall perspective port 5938 needs to be open inbound your target devices
• “TeamViewer integration is site specific. This means Jamf Pro allows you to add one configuration per site. If there are no sites in your environment, you can add a TeamViewer configuration in the full context of your Jamf Pro instance.”
• You’ll need a TeamViewer account with administrative privileges and Jamf Pro user account with Remote Administration privileges
• You’ll need to create a script token for Jamf Pro configured in TeamViewer
• To send Self Service notifications, you must configure them in the Interaction section of the Self Service settings in Jamf Pro. For more information, see Jamf Self Service for macOS Notifications.

So, with those requirements in mind, let’s dive right into it!

First thing to do is to create the script token in TeamViewer. For this you’ll need to login to the TeamViewer Management Console first: https://login.teamviewer.com/LogOn. Navigate to your profile and click edit profile -> apps -> create script token.

Give the token a name and make sure to put the Session Management privileges to Create, view and edit all sessions.

Hit save and copy the token:

Next, we move to Jamf Pro to enable our integration. Jamf Pro Settings -> Global Management -> Remote Administration:

That’s it for the integration! Easy and straight forward! But now, our target devices… What about them?

Well, first of all I mentioned that in this post I’ll just go the lazy way and install TeamViewer manually on my target device, and I’ll talk about silently deploying them in my next post. But in view of your choice for which TeamViewer solution to use, there are a few options:

• Install TeamViewer full
• Install TeamViewer Host
• Do not install anything and let users use the TeamViewer QuickSupport app when needed.

All 3 options do work with the Jamf Pro integration, and it’s up to you to choose what you want to use, or what you are already using within your environment. However, there are a few things to remember:

• Depending the TeamViewer option of your choice, you will need the corresponding PPPC profile pushed to your devices. If not, your end user will need to provide access for screencapture, accessibility and SystemPolicyAllFiles themselves, before you will be able to connect remotely. More about that below, as there are different identifiers for each of the 3 solutions mentioned above.
• While TeamViewer Host allows to configure the endpoint for unattended access the integration via Jamf Pro will always require the end user to open up the session. More about this below, but while the Jamf Pro integration does work with either TeamViewer or TeamViewer Host, remote access will require the end user to be involved.
• Optional: Screencapture can be set to “Allow Standard Users to Allow Access“. This allows, and requires end users without admin privileges to decide if TeamViewer can share the screen. Compliant to Apple’s privacy policies.
• Important: Attempting to deploy the configuration profile with the ScreenCapture setting to computers with macOS 10.15.7 or earlier will cause the profile installation to fail.
• If you choose to use the TeamViewer QuickSupport app, no app needs to be pre-installed. The end user wil be prompted to install the one-time-usage version of TeamViewer when needed. However (!), TeamViewerQS requires a DIFFERENT PPPC profile than the full TeamViewer to TeamViewerQS. See below.

So, before installing TeamViewer, manually or remotely via Jamf Pro, and even if you plan to use TeamViewerQS, make sure to push a profile with the corresponding PPPC payload to your endpoints!

Configure the Privacy Preferences Policy Control payload:

1. In the Identifier field, enter com.teamviewer.TeamViewerQS.
2. From the Identifier type pop-up menu, choose Bundle ID.
3. In the Code Requirement field, enter the following code:
   anchor apple generic and identifier “com.teamviewer.TeamViewerQS” and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = H7UGFBUGV6)
4. In the App or Service table, add the following:
   1. Accessibility with the value Allow—This will grant the Accessibility permission.
   2. SystemPolicyAllFiles with the value Allow—This will grant the Full Disk Access permission.
   3. (Optional, computers with macOS 11 or later only) ScreenCapture with the value Allow Standard Users to Allow Access—This will grant the Screen Recording permission. Users without administrator privileges must decide if TeamViewer can share the screen.

As mentioned above each of the 3 TeamViewer solutions need a DIFFERENT setting for the PPPC profile, with a different Identifier and Code Requirement!

For the Full TeamViewer:

• Identifier: com.teamviewer.TeamViewer
• Code Requirement:

anchor apple generic and identifier "com.teamviewer.TeamViewer" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = H7UGFBUGV6)

For TeamViewerQS:

• Identifier: com.teamviewer.TeamViewerQS

• Code Requirement:

anchor apple generic and identifier "com.teamviewer.TeamViewerQS" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = H7UGFBUGV6)

For TeamViewer Host:

• Identifier: com.teamviewer.TeamViewerHost

• Code Requirement:

anchor apple generic and identifier "com.teamviewer.TeamViewerHost" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = H7UGFBUGV6)

Scope the appropriate PPPC profile to your endpoints and you are ready to go!

Well, apart from installing TeamViewer that is. For testing purposes, and maybe even for real life support, I’d recommend to use TeamViewerQS. Nothing to install!

If you do want to install TeamViewer manually for now: https://www.teamviewer.com/en/download/mac-os/

TeamViewer Host (which I would not recommend in view of this integration, as it does not offer a real benefit compared to the full TeamViewer or TeamViewerQS) can be downloaded at the bottom of the page:

Remember that unattended access is not part of this integration. This can be achieved via additional configuration, but does not really fit in well into the privacy realm when managing end users in my opinion.

With our integration in Jamf Pro done, our PPPC profile pushed and TeamViewer (Host) installed (or not – if you want to use QS), we are fully ready to take this out for a spin!

For this we go to the inventory of the device we want to remote into, go the Management Tab -> Remote Administration and click ‘Start Session‘. If you want you can add a note to keep track of the reason why you initiated the session, for instance an internal support ticket number.

After you started the session, you will see the following options:

To really start the session, 2 things must be done next:

• The administrator needs to click the Administrator URL to connect to the end user’s Mac
• The end user must open up the connection via the End User URL

When the administrator launches the session via the Administrator URL a notification is sent to the end user’s Self Service instructing him/her to navigate to the Bookmarks in Self Service and click the End User URL to start the session. If needed, another Self Service Notification can be send manually:

In the mean time, the administrator will see the following after clicking the admin url:

Note: for the admins you need to install the full TeamViewer app

Once the admin launches TeamViewer, he/she will see the following screen until the end user opens up the connection:

The end user, from his/her side, after clicking the link in Self Service (or shared via any other means, even pigeon post will do… but may delay the process a bit) will go through the following user experience:

Depending whether or not the full TeamViewer (Host) is installed, the end user can launch it or choose to download the QS version. Once loaded, the following popup will appear when the admin requests to connect:

If you correctly configured the PPPC profile (with correct identifier and code requirement for the TeamViewer solution of your choice, see above), the only thing the end user may still have to do (if this is the first time a TeamViewer session is done) is to approve screencapture – aka ‘Screen Recording’:

The other two privileges, Accessibility and Full Disk Access should already be covered by the PPPC profile. Remember that for ‘Screencapture’ we can only set it to “Allow Standard Users to Allow Access“, and not enforce it remotely.

If however you did not configure / push the PPPC profile correctly, the end user will need to approve everything:

If all the above is applied correctly, the session should start.

When the connection is closed, another Self Service notification is sent to inform the end user:

That’s it for now!

As promised, I’l do another post on how to silently install TeamViewer (Host) in my next post.

BONUS QUESTIONS

– Is iOS remote control supported? No, not at the moment

– Can I use an iPad Pro to remote into a Mac? No, feature request I guess

– Can an end user initiated a request for assistance to an internal support team? YES, You can add a link in the Self Service Bookmarks, leveraging TeamViewer’s “QuickSupport and SOS button”: https://community.teamviewer.com/English/kb/articles/3962-quicksupport-and-sos-button

That’s it! As always, if you liked the post, hit the like button, tell your friends about it and leave a comment down below!

Brgds,
TTG