How to unlock a Mac that's been locked with Apple Remote Desktop's "curtain" screen lock

Question

Apple Remote Desktop has a "curtain" feature that a remote client can use to lock the screen of the Mac that's being remotely controlled. I use this when I connect to my work Mac from my home Mac. My work Mac's screen shows a big lock icon and a message while I'm remotely controlling it from my home Mac using Apple Remote Desktop (ARD).

Unfortunately, there's a bug of some kind that causes the remote Mac's screen to stay locked, even after I've disconnected from it. (Latest ARD and OS X 10.8.2 on both machines.) When this happens, I come in to work the next day to find the big lock icon and message on my Mac's screen. Despite now being physically present in front of the Mac, I can't find a way to unlock the screen.

I usually try ssh-ing into the Mac from another machine and killing processes. I've tried killing the ARDAgent process, the screen lock process (I can't recall the name), and anything else I can find with "ard" or "remote" in the process name. None of these things seem to unlock the screen. Eventually, I resort to using osascript -e ... to tell all my running applications to gracefully quit, then I run shutdown -r now to reboot the machine.

My question: is there a way to successfully unlock a Mac that's stuck on the ARD lock screen, using ssh or otherwise?

---

One way to reproduce this: Log in to the target Mac with Remote Desktop, initiate Curtain mode, and then after finishing whatever work was to be done, log out the user on the target Mac while still under Curtain mode. This will leave the Mac inaccessible to the Remote Desktop app and even a physical user of the computer, with the large lock icon still on the screen of the target Mac.

I'm not sure what I'm doing to trigger this situation, but I'm definitely not logging out. Either way, it seems like the solution should be the same.

Answer 1

I don't have a Mac with ARD to test this, but this sunshine-ard utility suggests it can fix the problem. From a quick glance at the source code, it just sends a CFNotificationCenter message to quit the curtain mode.

I'm not sure if there's a way to hook in to the ARD logout process to have this run every time you disconnect your session, but at the very least you could run it via SSH as necessary.

Answer 2

This fastest solution I have found is to make a SSH connection to a admin account on the remote computer that is locked.

ssh "adminuser"@ip.address/or.computername

Type: ps -ax | grep AppleVNCServer

You want the line that reads something like

/System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/LockScreen.app/Contents/MacOS/LockScreen -session 256 -msgHex 

Jot down the PID that is to the left of this.

then enter:

sudo kill -9 "PID" 

This will force restart the lock screen and make it available again.

I know this is like the post above just explained. It is also done on two 10.8.2 machines running ARD 3.6.1.

Answer 3

For what it's worth, this is a known bug in ARD and has apparently been around for a while. This Apple KB has an article about it, but no suggestion on how to fix it. http://support.apple.com/kb/TS2401

Key part of the document:

If you use Remote Desktop to take control of a client using Curtain mode, then log in or log out on the remote client, the control session will end and you will not be able to take control of the computer again until it is restarted. This occurs on client running Mac OS X v10.5 or later, and will also occur if you Lock the Screen of the client before taking Control.

Resolution

Before logging out, close any windows with sensitive information, end the control session (and Unlock Screen if necessary). Do not log out on the remote client while controlling it in Curtain mode.

Answer 4

If you're on El Capitan, the above instructions involving killing the lock screen won't work. There's some process that keeps starting it up and I was unable to find it using launchctl list. I also tried to shut down ARD via my ssh login but that didn't work either. Apparently the LockScreen.app and ARD are decoupled processes or something. I wound up having to do a shutdown -r now to force a reboot. I'm pretty pissed that Apple hasn't fixed this bug or provided a workaround that, you know, actually works AFTER the fact.

Answer 5

Apple provides an example of how to script the lock screen in Chapter 9 of the ARD Admin Guide.

As you already have osascript access, I would send the unlock command.

-- Start commanding the local copy of Remote Desktop
tell application "Remote Desktop"
  -- decide which list to perform this on, in this case it's called
     "WorkMac"
  set these_computers to computer list "WorkMac"
  -- unlock the screen when finished
  execute (make new unlock screen task) on these_computers
end tell 

Answer 6

OK, I cannot comment on using ARD, I don't have it, but this may be a suitable workaround, at least in the meantime.

Using normal screen sharing you have the option of using either the hardware display, or the virtual one. This was an easy thing to use on 10.7 but it's been obfuscated rather on 10.8 and the menu item command to switch displays is gone.

To use the virtual display, here's what you need to do. Firstly, have another user to your normal one that has the relevant screen sharing options allowed, then login:

• If no one is logged into the target machine, you will always get the Hardware display showing the normal login screen
• If your the user you try to login as is already logged in, then it will always switch to that user and use the hardware display
• If you login with another user who is not already logged in at the hardware display, you get the following message and the ability to use the virtual display which results in being able to do whatever you like without changing the main screen and with no possibility of anyone being able to watch it

This isn't perfect, you need to ensure your secondary user has the relevant access rights to the files and such that you may need to access, or you may have to adopt the awkward practice of leaving your secondary (or "dummy") user logged in when you leave the desk allowing you to use your primary ID over screen sharing, but it may help.

Answer 7

I can't reproduce your exact setup as I don't currently have a second machine running 10.8.2 and 3.6.1, but here's what I tried:

From my 10.8.2/3.6.1 admin Mac I locked the screen on my 10.6.8 client, logged out of the client and reproduced the screen locking glitch. I was disconnected from my ARD session and the client remained with the lock screen icon. I ssh'd in to the client and after trying to get some love from 'kickstart' I ran launchctl list which revealed a 'LockScreen' job. Killing it without issuing a signal had no effect but sending it a -9 removed the lock icon from the screen and after a few seconds the loginwindow loaded. You'll have to try it under your conditions in order to verify this same technique works on a locked 10.8.2/3.6.1 machine and when the issue is caused by something other than the user logging out.

Answer 8

Make a simple shell script like this:

#!/bin/sh
# Make ARD sane again
LOCK=`ps -ax | grep LockScreen.app | awk {'print $1'}`
ARD=`ps -ax | grep AppleVNCServer | awk {'print $1'}`
sudo kill -9 $LOCK $ARD
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent

Answer 9

In the Remote Desktop app, open the system list and highlight a remote machine that shows a status of "Locked Screen." Pull down the Interact menu and choose "Unlock Screen..."

You'll immediately see the system's status change from "Locked Screen" to "Available." You can then initiate a new curtain mode connection.

Answer 10

What worked for me is:

1. Connect via ssh user@host
2. Run sudo pkill loginwindow