ARD-AD-writeup.txt

Apple Remote Desktop and the screen sharing service on the Macs by default do not allow network accounts to remotely log in. This set of commands will create a screen sharing permission group on the Mac, enable directory logins to remote desktop, and add an AD group (when bound to AD) to the remote desktop permission group.

ARD must already be enabled with screen sharing for this to work, you can't kick off ARD from nothing without GUI interaction as of macOS Mojave but you can modify it.

Original info about how to do this pulled from the following google group: https://groups.google.com/forum/#!msg/macenterprise/-p6pyMPAt04/qRJ_VbIuscQJ


Create the ARD Interact security group:
sudo /usr/sbin/dseditgroup -n /Local/Default -o create com.apple.local.ard_interact

Add an AD group by UUID to the ard_interact group.
sudo dscl localhost -create /Local/Default/Groups/com.apple.local.ard_interact NestedGroups [UID of AD group without brackets]

Configure ARD to allow directory logins. This specific example also enables non Mac VNC viewer access with a generic password (the last part of this command).
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -clientopts -setdirlogins -dirlogins yes -setvncpw -vncpw vncpassword

Restart the ARD Agent
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent