Is my screen being shared?! With whom?

Question

For the last few days I've been getting a message on my lock screen

Unlocking with Apple Watch is not available with your screen is being shared

A tad worrisome but I sort of disregarded and chalked it up to maybe a go2meeting screenshare not properly telling the os it's done or my some bug related to my secondary monitor being attached.

But I got it this morning after a full restart and without my secondary monitor attached. Now I'm kinda worried! Is my screen being shared with someone?! How would I even know?!

note that screen sharing is off:

Answer 1

If you are connected to an external display or projector through USB, HDMI, miniDisplay/firewire, Thunderbolt or even wirelessly, DON'T WORRY! It is just an Apple bug thats been reported. You don't need to worry about that but unfortunately, you can not unlock your mac with your Apple Watch while connected. Disconnect all externals and retry and see if it works.

If not, YOU SHOULD WORRY. It could be one of these:

• Screen sharing is on try turning it on and off again. Then Click on Computer settings and turn off all options there.
• Remote Management try turning it on and off again.
• Check open ports and activities of your computer and see if there is any suspicious activities and kill them.
• It could be spyware. You can create another user account and logout and login there and see if the issue is persists. If so, you should probably wipe your computer and install all software (including the OS itself) if you want to completely sure about cleanness of your system and not restore it from backup after. Just copy the files you need and don't restore from your Time Machine backup.

Answer 2

I would also double-check remote login and remote management. If you think you're being monitored check the activity monitor for anything out of the ordinary and you can also run a virus/malware scan on your system. If nothing comes up you're probably fine and it could just be some weird bug. If you're still worried about it you can change all your passwords (including your Wi-Fi access key if you're on your home network) and then restart your computer and your router. If you have access to your router you can also check to see if someone is on it that shouldn't be on it.

Another thing you can do is check which ports are open (nmap can do this if you're unsure how) and turn off any sharing protocols such as ARD (apple remote desktop)

If you do all of this I would be quite surprised if your screen was still being monitored!