TeamViewer: macOS Client Setup
What
FileWave version 14.7 introduced a TeamViewer integration that requires endpoint prerequisites on each supported platform. The majority of these have been left untouched, but may be altered, allowing slightly more work (if desired) but much greater control.
When/Why
TeamViewer is used to remotely control your clients, providing access to a device for troubleshooting or assisting a user. TeamViewer for macOS differs from other OSs since it requires a few privacy permissions before allowing TeamViewer to be installed.
How
Prerequisites for macOS client devices must be met for TeamViewer to work seamlessly:
-
General TeamViewer Prerequisites are met, ensuring that clients are set to allow remote control
-
Profile for TeamViewer Host - Notifications, Accessibility, and Full Admin Access
- *TeamViewer Full Client Application is installed on the device initiating the session.
*The TeamViewer Full Client application is only necessary for computers that need to remotely connect to other computers. You can download the TeamViewer Full Client here: https://www.teamviewer.com/en-us/download/portal/
The below describes the process for deploying and configuring the TeamViewer Host application. The Host application is only allowed to accept connections and not initiate them, and is highly recommended for client deployment.
TCC Profile for TeamViewer Host - Accessibility, Notifications, Screen Recording, and Full Admin Access
Screen Recording is a macOS privacy permission that controls whether an application can capture the contents of the screen. By default, standard users cannot approve this permission without administrator privileges.
The current configuration profile allows standard users to approve Screen Recording access without requiring administrator privileges. This option is supported starting with macOS 11 (Big Sur).
Privacy Settings Profiles
Permissions to allow TeamViewer access rights.
TCC Profile for TeamViewer Host (Allow Standard and Admin Users Screen Recording):
Profile - TeamViewerHost Admin and Standard User.fileset.zip
TCC Profile for TeamViewer Host (Administrator Only Screen Recording):
Profile - TeamViewerHost Admin Only.fileset.zip
Both Profiles also include settings for Notifications:
Managing Notifications and allowing standard users to access Screen Recording require macOS 11 or later.
TeamViewer Host Fileset
The included Fileset utilizes a settings file, set to install the software silently. This Fileset is current at the time of this article's publishing date.
Current TeamViewer Fileset: TeamViewer Host Install for macOS.fileset.zip
Fileset Contents:
The choices.xml file is configured to install the .pkg silently.
Requirement Script:
If the software is already installed and its services are running, applying new privacy settings payloads requires restarting the software's service. The attached Fileset includes a Requirement Script that checks whether the configuration profile has been installed before activating TeamViewer, eliminating the need to restart the TeamViewer Host service.
The check_tv_profile.sh script checks whether either of the two provided configuration profiles has been installed. Once a matching profile is detected, the Fileset can proceed with activation.
If you use configuration profiles with different Profile IDs, you'll need to update the script accordingly.
-
Double-click the Fileset.
-
Locate and select
check_tv_profile.shin one of the numbered subfolders under/var/scripts/. -
Open Get Info and select the Executable view.
The Launch Arguments contain the two supported Profile IDs: one for the Allow Admin and Standard Users configuration and one for the Admin Only configuration.
No changes are needed if you're using either of the provided profiles. If you're using a custom profile with a different Profile ID, update the corresponding Launch Argument to match.
Activation Script:
The script in this case is installing the PKG. Note that the script allows the specification of the 'choices.xml' file when executed.
#!/bin/zsh
installer -applyChoiceChangesXML /usr/local/etc/TeamViewer/choices.xml -pkg "/usr/local/etc/TeamViewer/Install TeamViewerHost.pkg" -target /
exit 0Postflight
This script provides examples of configuring the TeamViewer Host. Three settings are configured, which may be removed/not changed by selecting the Postflight Script and deleting the file from the Fileset:
Possible Values:
| Setting | Value | Outcome |
| Security_Adminrights | 0 | Any user may change settings |
| 1 (Recommended) | Only administrators may change settings | |
| Security_PasswordStrength |
3 (Recommended) | No password - Will not allow other devices outside of the FileWave API to connect |
| 2 | 10 Character Password | |
| 1 | 6 Character Password | |
| 0 | 8 Character Password | |
| Always_Online |
0 | False: TeamViewer will not start again if it's forced to close |
| 1 (Recommended) | True: TeamViewer will start again if it's forced to close |
Setting No Password for password strength prevents anything other than FileWave from connecting to devices through TeamViewer Host.
Preference changes require TeamViewer to reload: Security_Adminrights is still used by the TeamViewer Host configuration shown here, but TeamViewer must restart or the device must reboot before a newly written preference is enforced. If standard users can still edit settings immediately after deployment, restart TeamViewer Host, verify the latest Fileset/Profile package is installed, then test again.
Post-Uninstallation Script:
The 'mac_teamviewer_uninstaller.sh' script uninstalls TeamViewer if an association or deployment no longer exists.
Updates
The software should auto-update to the latest version. If you would like the latest installer, you can download it from https://go.filewave.com/tvhost. If you're on a macOS system, the PKG will download. If you're on Windows, the EXE will download.
Don't forget to upgrade the full TeamViewer version on the Admin device.
No comments to display
Can you confirm that Security_Adminrights is still a valid .plist key? I didn't see it referenced within the "com.teamviewer.teamviewer.preferences.plist" file. After setting the key to "1", standard users are still able to edit the TeamViewer settings.
In reply to #1
This value does indeed work as suggested in the current text. However, the TeamViewer process must be restarted after setting the value.
If you have an older version of our provided Fileset and Profiles, this did have issues, but the latest posted version should work as written.
No comments to display