Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Apple Remote Desktop has a "curtain" feature that a remote client can use to lock the screen of the Mac that's being remotely controlled. I use this when I connect to my work Mac from my home Mac. My work Mac's screen shows a big lock icon and a message while I'm remotely controlling it from my home Mac using Apple Remote Desktop (ARD).

Unfortunately, there's a bug of some kind that causes the remote Mac's screen to stay locked, even after I've disconnected from it. (Latest ARD and OS X 10.8.2 on both machines.) When this happens, I come in to work the next day to find the big lock icon and message on my Mac's screen. Despite now being physically present in front of the Mac, I can't find a way to unlock the screen.

I usually try ssh-ing into the Mac from another machine and killing processes. I've tried killing the ARDAgent process, the screen lock process (I can't recall the name), and anything else I can find with "ard" or "remote" in the process name. None of these things seem to unlock the screen. Eventually, I resort to using osascript -e ... to tell all my running applications to gracefully quit, then I run shutdown -r now to reboot the machine.

My question: is there a way to successfully unlock a Mac that's stuck on the ARD lock screen, using ssh or otherwise?


One way to reproduce this: Log in to the target Mac with Remote Desktop, initiate Curtain mode, and then after finishing whatever work was to be done, log out the user on the target Mac while still under Curtain mode. This will leave the Mac inaccessible to the Remote Desktop app and even a physical user of the computer, with the large lock icon still on the screen of the target Mac.

I'm not sure what I'm doing to trigger this situation, but I'm definitely not logging out. Either way, it seems like the solution should be the same.

share|improve this question
1  
Without answering your question directly: Is there a specific reason why you are using ARD instead of Screen Sharing? –  patrix Sep 24 '12 at 14:47
1  
I'm using ARD because Screen Sharing does not have this "curtain" feature, and I don't want people at work to be able to see and access my Mac when I'm not there. –  John Siracusa Sep 24 '12 at 15:39
    
I would have suggested using normal screen sharing and the Virtual display rather than the Hardware one, but as per an outstanding question of my own, it seems to have disappeared under 10.8 as an option when using 10.8 as the client... –  stuffe Sep 26 '12 at 22:24
add comment

6 Answers 6

up vote 7 down vote accepted
+50

I don't have a Mac with ARD to test this, but this sunshine-ard utility suggests it can fix the problem. From a quick glance at the source code, it just sends a CFNotificationCenter message to quit the curtain mode.

I'm not sure if there's a way to hook in to the ARD logout process to have this run every time you disconnect your session, but at the very least you could run it via SSH as necessary.

share|improve this answer
    
That looks promising! I'll try it next time I can reproduce the bug. –  John Siracusa Sep 26 '12 at 23:25
    
Despite many attempts, I still haven't been able to reproduce my bug. Since the bounty expires tomorrow, I'm going to accept this answer based on the assumption that it will work. –  John Siracusa Oct 2 '12 at 13:48
    
I too have not been able to reproduce it, but I did find some documentation on how to use AppleScript to unlock screens and will post that as a separate answer even though this one seems like the best place for the bounty for the code level detail on the inner workings of CFNotificationCenter. –  bmike Oct 2 '12 at 15:23
    
I tried sunshine on a machine that was stuck in the very same scenario described in the question, and it was not able to resolve the problem. –  scottm32768 May 9 '13 at 14:51
    
This worked very nicely for me when someone called our helpdesk having locked and later unlocked a lab of computers, three of which didn't unlock. Copied sunshine to them, ran it, and bang, they unlocked. –  Clinton Blackmore May 31 '13 at 18:01
add comment

I can't reproduce your exact setup as I don't currently have a second machine running 10.8.2 and 3.6.1, but here's what I tried:

From my 10.8.2/3.6.1 admin Mac I locked the screen on my 10.6.8 client, logged out of the client and reproduced the screen locking glitch. I was disconnected from my ARD session and the client remained with the lock screen icon. I ssh'd in to the client and after trying to get some love from 'kickstart' I ran launchctl list which revealed a 'LockScreen' job. Killing it without issuing a signal had no effect but sending it a -9 removed the lock icon from the screen and after a few seconds the loginwindow loaded. You'll have to try it under your conditions in order to verify this same technique works on a locked 10.8.2/3.6.1 machine and when the issue is caused by something other than the user logging out.

share|improve this answer
    
I've definitely killed that process and then seen the lock remain on the screen. I will try it again next time I reproduce the bug, just to be sure. –  John Siracusa Sep 26 '12 at 23:12
    
Good info on a troubleshooting avenue, but killing the process doesn't work. See my applescript to send the unlock programatically. –  bmike Mar 28 at 12:56
add comment

OK, I cannot comment on using ARD, I don't have it, but this may be a suitable workaround, at least in the meantime.

Using normal screen sharing you have the option of using either the hardware display, or the virtual one. This was an easy thing to use on 10.7 but it's been obfuscated rather on 10.8 and the menu item command to switch displays is gone.

To use the virtual display, here's what you need to do. Firstly, have another user to your normal one that has the relevant screen sharing options allowed, then login:

  • If no one is logged into the target machine, you will always get the Hardware display showing the normal login screen
  • If your the user you try to login as is already logged in, then it will always switch to that user and use the hardware display
  • If you login with another user who is not already logged in at the hardware display, you get the following message and the ability to use the virtual display which results in being able to do whatever you like without changing the main screen and with no possibility of anyone being able to watch it

enter image description here

This isn't perfect, you need to ensure your secondary user has the relevant access rights to the files and such that you may need to access, or you may have to adopt the awkward practice of leaving your secondary (or "dummy") user logged in when you leave the desk allowing you to use your primary ID over screen sharing, but it may help.

share|improve this answer
add comment

Apple provides an example of how to script the lock screen in Chapter 9 of the ARD Admin Guide.

Perhaps that script on page 174 could be shortened to just send the unlock sequence:

-- Start commanding the local copy of Remote Desktop
tell application "Remote Desktop"
  -- decide which list to perform this on, in this case it's called
     "WorkMac"
  set these_computers to computer list "WorkMac"
  -- unlock the screen when finished
  execute (make new unlock screen task) on these_computers
end tell 
share|improve this answer
add comment

This fastest solution I have found is to make a SSH connection to a admin account on the remote computer that is locked.

ssh "adminuser"@ip.address/or.computername

Type: ps -ax | grep AppleVNCServer

You want the line that reads something like

/System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/LockScreen.app/Contents/MacOS/LockScreen -session 256 -msgHex 

Jot down the PID that is to the left of this.

then enter:

sudo kill -9 "PID" 

This will force restart the lock screen and make it available again.

I know this is like the post above just explained. It is also done on two 10.8.2 machines running ARD 3.6.1.

share|improve this answer
add comment

For what it's worth, this is a known bug in ARD and has apparently been around for a while. This Apple KB has an article about it, but no suggestion on how to fix it. http://support.apple.com/kb/TS2401

Key part of the document:

If you use Remote Desktop to take control of a client using Curtain mode, then log in or log out on the remote client, the control session will end and you will not be able to take control of the computer again until it is restarted. This occurs on client running Mac OS X v10.5 or later, and will also occur if you Lock the Screen of the client before taking Control.

Resolution

Before logging out, close any windows with sensitive information, end the control session (and Unlock Screen if necessary). Do not log out on the remote client while controlling it in Curtain mode.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.