Remote Desktop (macOS)

PLAN AVAILABILITY COMPONENT. DO NOT EDIT ME

Overview

PDQ Connect offers Remote Desktop functionality, accessible via the Device Details page, which allows you to connect and offer fully unattended remote desktop functionality or remote assistance. This article covers installing and running Remote Desktop on macOS client devices.

Remote Desktop for macOS is currently in Early Access. Features and behavior may change as development continues.

Install remote desktop agent

On the left navigation bar, click Devices, and then click the name of the device you would like to connect to remotely.

On the device details page, click Remote desktop.

If this is your first time connecting to this device, note the status at the bottom of the tab, which indicates Remote desktop agent not installed. Click the button labeled Install remote desktop agent to begin the installation.

Apple Silicon (M-series) Macs: The Remote Desktop agent is Intel-based and does not have a native ARM version yet. On Apple Silicon Macs (M1, M2, M3, and later), Rosetta 2 must be installed for the agent to run. An ARM-native version of the RD agent is actively in development and expected to be released later this year.

A circular progress indicator will appear, along with the notice Installing agent:

When the installation process is complete, a message will appear indicating Agent installed successfully.

Note that the status at the bottom of the window will also indicate that the agent is installed.

If preferred, you can bulk-install the Remote Desktop agent onto multiple (or all) devices in your organization. See Bulk agent installation for details.

The remote desktop agent makes use of a separate agent made by ISL Online (a PDQ.com company) with additional connectivity requirements - see Remote Desktop Troubleshooting and Connection Tester for details.

Install local viewer app

If you are connecting from a computer running macOS, see: Install Remote Desktop local viewer app (macOS).

If you are connecting from a Windows computer, see section Install local viewer app (Windows).

Configuring permissions on macOS client

Due to differences in Apple's security model, the Remote Desktop setup experience is slightly different on macOS than it is on Windows. End-users will need to manually grant the Remote Desktop application access to specific macOS system services.

To remotely access macOS devices you need to enable TCC (Transparency, Consent, and Control) for the PDQ Remote Desktop application (ISLAlwaysOn.app) on macOS. On the initial install, the client device user will be required to enable macOS permissions for the application.

After starting the first session, when prompted, click “Open System Settings”.

Under System Settings > Privacy & Security > Accessibility, toggle "ISLAlwaysOn" to "On". This enables remote control capabilities.

Under System Settings > Privacy & Security > Full Disk Access, toggle "ISLAlwaysOn" to "On". This enables file transfer capabilities.

Under System Settings > Privacy & Security > Screen & System Audio Recording, toggle "ISLAlwaysOn" to "On". This enables remote screen viewing capabilities.

Note: These setting names/paths may be slightly different on older versions of macOS.

Note: For a more automated setup, use an MDM service such as SimpleMDM to configure these permissions using a Privacy Preferences configuration profile. For instructions on building the configuration profile with an MDM service, see this guide. Scroll to the bottom of this article for an example profile.

Starting a remote session on macOS devices

To start a remote session on a macOS target device, click "Start Remote Session".

Warnings and notifications:

Depending on your Remote Desktop org settings, you may have the option (or be required) to Notify logged-in user that remote session is starting. A preview of that notification will appear. If your org or user display names do not appear correct, you may update them - see Remote Desktop organization settings for details.
Depending on your browser security settings, you may receive a pop-up asking if you want to open the link in the PDQ RD Viewer Program. The exact appearance and wording of this warning may vary by browser, but click to continue. The PDQ RD Viewer will launch.

When Notify logged-in user that remote session is starting is checked, on the target device, the user should see a prompt:

When the user accepts this prompt, the viewing device should now be connected to the client device.

Additional Prompts

Depending on the macOS version running on the client device, the user may see various additional prompts to allow the service to run, or to continue running in the background. These prompts can be accepted. Some examples are shown below:

[Optional] Privacy Preferences (TCC) profile for deployment with MDM services:

MDM services allow you to deploy configuration profiles to automatically configure application's access settings for system services. This is ideal for silent deployments. Here is an example Privacy Preferences (TCC) configuration profile to configure these settings:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Privacy Preferences Policy Control</string>
<key>PayloadIdentifier</key>
<string>com.apple.TCC.configuration-profile-policy.162404C1-BFAE-448C-8829-B9936DA244CE</string>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadUUID</key>
<string>162404C1-BFAE-448C-8829-B9936DA244CE</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>Services</key>
<dict>
<key>Accessibility</key>
<array>
<dict>
<key>Allowed</key>
<true/>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>identifier "com.islonline.islalwayson.main" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF</string>
<key>Identifier</key>
<string>/Library/Application Support/ISLAlwaysOn/ISLAlwaysOn</string>
<key>IdentifierType</key>
<string>path</string>
<key>StaticCode</key>
<false/>
</dict>
<dict>
<key>Allowed</key>
<true/>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>identifier "com.islonline.isllight.issc_daemon" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF</string>
<key>Identifier</key>
<string>/Library/Application Support/ISL Online/ISSC Daemon/issc_daemon</string>
<key>IdentifierType</key>
<string>path</string>
<key>StaticCode</key>
<false/>
</dict>
<dict>
<key>Allowed</key>
<true/>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>identifier "com.islonline.islnetworkstart.dmg" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF
identifier "com.islonline.islnetworkstart.dmg" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF
</string>
<key>Identifier</key>
<string>com.islonline.islnetworkstart.dmg</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>StaticCode</key>
<false/>
</dict>
</array>
<key>ScreenCapture</key>
<array>
<dict>
<key>Authorization</key>
<string>AllowStandardUserToSetSystemService</string>
<key>CodeRequirement</key>
<string> identifier "com.islonline.islalwayson.main" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF</string>
<key>Identifier</key>
<string>/Library/Application Support/ISLAlwaysOn/ISLAlwaysOn</string>
<key>IdentifierType</key>
<string>path</string>
<key>StaticCode</key>
<false/>
</dict>
<dict>
<key>Authorization</key>
<string>AllowStandardUserToSetSystemService</string>
<key>CodeRequirement</key>
<string>identifier "com.islonline.isllight.issc_daemon" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF</string>
<key>Identifier</key>
<string> /Library/Application Support/ISL Online/ISSC Daemon/issc_daemon</string>
<key>IdentifierType</key>
<string>path</string>
<key>StaticCode</key>
<false/>
</dict>
<dict>
<key>Authorization</key>
<string>AllowStandardUserToSetSystemService</string>
<key>CodeRequirement</key>
<string>identifier "com.islonline.islnetworkstart.dmg" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF
identifier "com.islonline.islnetworkstart.dmg" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF
identifier "com.islonline.islnetworkstart.dmg" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF
identifier "com.islonline.islnetworkstart.dmg" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF
identifier "com.islonline.islnetworkstart.dmg" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GP5P6H7RRF
</string>
<key>Identifier</key>
<string> com.islonline.islnetworkstart.dmg</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>StaticCode</key>
<false/>
</dict>
</array>
</dict>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>PDQ Connect Remote Desktop TCC</string>
<key>PayloadIdentifier</key>
<string>admin-MacBook-Pro.180DD42A-DA9D-4CA1-9E5D-06B900DA8ABE</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>180DD42A-DA9D-4CA1-9E5D-06B900DA8ABE</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

Remote Desktop (Windows)

Remote Desktop local viewer settings

Remote Desktop organization settings and bulk agent installation

Remote Desktop Troubleshooting and Connection Tester

Eric McCann

Updated July 15, 2026 19:55

Overview

Install remote desktop agent

Install local viewer app

Configuring permissions on macOS client

Starting a remote session on macOS devices

Warnings and notifications:

Additional Prompts

[Optional] Privacy Preferences (TCC) profile for deployment with MDM services:

Related articles:

Related articles