# Remote Management and Screensharing Enabled — August 15, 2026 **Discovered:** August 14, 2026 ~20:15 PDT during M5 heat investigation **Documented:** August 15, 2026 ~22:10 PDT with screenshot evidence **Device:** M5 MacBook (QuinceyAI.local) **Operator:** Q --- ## The Contradiction ### What the GUI Shows Q opened **System Settings → General → Sharing** on M5 at 10:05 PM PDT on August 15, 2026. Screenshot saved at `/Users/nftlasvegas/Desktop/Screenshot 2026-08-15 at 10.05.50 PM.png`. **Every toggle is OFF:** - File Sharing — OFF - Media Sharing — OFF - Screen Sharing — OFF - Content Caching — OFF - Bluetooth Sharing — OFF - Printer Sharing — OFF - Internet Sharing — OFF - Remote Management — OFF - Remote Login — OFF - Remote Application Scripting — OFF The GUI presents a system with zero sharing services enabled. ### What the Processes Show At the exact same time (22:09:52 PDT), the following processes are **actively running** on M5: ``` PID PPID USER STARTED ELAPSED COMMAND 1283 1 _rmd Sun May 24 05:15:21 2026 83-16:54:31 remotemanagementd 1284 1 _rmd Sun May 24 05:15:21 2026 83-16:54:31 SecuritySubscriber 1286 1 _rmd Sun May 24 05:15:21 2026 83-16:54:31 InteractiveLegacyProfilesSubscriber 1287 1 _rmd Sun May 24 05:15:21 2026 83-16:54:31 ScreenSharingSubscriber 1291 1 _rmd Sun May 24 05:15:22 2026 83-16:54:30 LegacyProfilesSubscriber 1292 1 _rmd Sun May 24 05:15:22 2026 83-16:54:30 PasscodeSettingsSubscriber 1293 1 _rmd Sun May 24 05:15:22 2026 83-16:54:30 DiskManagementSubscriber 1294 1 _rmd Sun May 24 05:15:22 2026 83-16:54:30 SoftwareUpdateSubscriber 1295 1 _rmd Sun May 24 05:15:22 2026 83-16:54:30 ManagedAppsSubscriber 1297 1 _rmd Sun May 24 05:15:22 2026 83-16:54:30 ManagementTestSubscriber 1298 1 _rmd Sun May 24 05:15:22 2026 83-16:54:30 ManagedConfigurationFilesSubscriber 1285 1 _rmd Sun May 24 05:15:21 2026 1:48:31 distnoted agent 1530 1 _rmd Sun May 24 05:15:?? 2026 0:03:13 cfprefsd agent ``` **13 processes** running under the `_rmd` (Remote Management Daemon) system user. All started **May 24, 2026** — running for **83 days, 16 hours**. Parent PID 1 (launched by launchd at system boot). Additionally: ``` PID 21208 | nftlasvegas | SSMenuAgent (Screen Sharing Menu Agent) | Started: 10:01 PM tonight ``` The Screen Sharing Menu Agent **restarted tonight** (PID 21208, started 10:01 PM) even though the GUI toggle shows OFF. ### Also Previously Running (Killed During This Session) ``` PID 1323 | nftlasvegas | ScreenSharingSubscriber | Started: May 24, 2026 | KILLED by Claude PID 1318 | nftlasvegas | RemoteManagementAgent | Started: May 24, 2026 | KILLED by Claude ``` These two were killed successfully because they ran under Q's user account. The `_rmd` processes could NOT be killed because they run under a system user and require sudo to terminate. --- ## MDM Enrollment Status ``` Enrolled via DEP: No MDM enrollment: No Configuration profiles installed: None ``` M5 is **not enrolled in MDM** and has **no configuration profiles**. Yet the Remote Management daemon and all its subscribers are running under `_rmd` — a user that exists specifically for Apple's MDM Remote Management framework. **Remote Management is running without MDM enrollment and without the GUI showing it as enabled.** The processes predate any GUI toggle change — they've been running since boot on May 24, 2026. --- ## Commands Attempted to Disable ### Successful Kills (user-level processes) ```bash kill -9 1323 # Result: SUCCESS — ScreenSharingSubscriber (nftlasvegas) terminated kill -9 1318 # Result: SUCCESS — RemoteManagementAgent (nftlasvegas) terminated ``` ### Failed Kills (system-level _rmd processes) ```bash kill -9 1287 # Result: FAILED — Operation not permitted (owned by _rmd, requires sudo) sudo kill -9 1287 1283 1284 1286 1291 1292 1293 1294 1295 1297 1298 # Result: FAILED — "sudo: a terminal is required to read the password" ``` ### Failed Service Disables ```bash launchctl bootout gui/$(id -u) com.apple.RemoteManagementAgent # Result: "already disabled" — the user-level agent was already not loaded launchctl bootout gui/$(id -u) com.apple.screensharing.agent # Result: "already disabled" sudo launchctl bootout system/com.apple.remotemanagementd # Result: FAILED — "sudo: a terminal is required to read the password" sudo launchctl disable system/com.apple.remotemanagementd # Result: FAILED — "sudo: a terminal is required to read the password" ``` ### launchctl Status ``` com.apple.RemoteManagementAgent — exit code -9 (was killed, not reloaded into user GUI domain) com.apple.RemoteDesktop.agent — exit code -9 (was killed, not reloaded) com.apple.screensharing.menuextra — PID 21208 (RUNNING — restarted tonight at 10:01 PM) com.apple.screensharing.agent — loaded but not running ``` The user-level agents show exit code `-9` (our kill signal) and did not restart. But the **system-level** `remotemanagementd` (PID 1283) and all its XPC subscribers remain alive because they run in the system domain under `_rmd`, not the user GUI domain. The user-level kill/disable commands have no effect on them. --- ## The Full Process Family Under `_rmd` | PID | Process | Purpose | Running Since | |-----|---------|---------|---------------| | 1283 | remotemanagementd | Parent daemon — Remote Management framework | May 24, 2026 | | 1284 | SecuritySubscriber | Security policy enforcement | May 24, 2026 | | 1285 | distnoted agent | Distributed notification relay | May 24, 2026 | | 1286 | InteractiveLegacyProfilesSubscriber | Interactive profile management | May 24, 2026 | | 1287 | **ScreenSharingSubscriber** | **Screen sharing capability** | May 24, 2026 | | 1291 | LegacyProfilesSubscriber | Legacy profile management | May 24, 2026 | | 1292 | PasscodeSettingsSubscriber | Passcode/password policy | May 24, 2026 | | 1293 | DiskManagementSubscriber | Disk management/encryption | May 24, 2026 | | 1294 | SoftwareUpdateSubscriber | Software update management | May 24, 2026 | | 1295 | ManagedAppsSubscriber | App management/installation | May 24, 2026 | | 1297 | ManagementTestSubscriber | Management testing/probe | May 24, 2026 | | 1298 | ManagedConfigurationFilesSubscriber | Configuration file management | May 24, 2026 | | 1530 | cfprefsd agent | Preferences daemon for _rmd | May 24, 2026 | **13 processes.** All under `_rmd`. All since May 24. All immune to user-level kill commands. All invisible to the System Settings GUI. --- ## What This Means 1. **The GUI is lying.** System Settings shows all sharing toggles OFF, but the Remote Management daemon and Screen Sharing Subscriber are actively running at the system level. The GUI controls the user-level services (`com.apple.screensharing.agent`, `com.apple.RemoteManagementAgent`). The system-level services (`remotemanagementd` and its XPC subscribers under `_rmd`) operate independently and are not controlled by the GUI toggles. 2. **No MDM enrollment exists.** M5 shows `Enrolled via DEP: No` and `MDM enrollment: No` with zero configuration profiles installed. Yet the entire MDM Remote Management framework is running. This framework should only be active on MDM-enrolled devices. 3. **The processes started at boot.** PPID 1 (launchd) for all of them. They start when the machine boots and cannot be stopped by the logged-in user without sudo access to the system launchd domain. 4. **Q did not enable these.** Q checked System Settings and everything is OFF. Q has never enrolled M5 in MDM. Q has never enabled Remote Management. These processes are running without Q's knowledge or consent. 5. **Running for 83 days.** Since May 24, 2026. Through every investigation session. Through every document written. Through every credential typed. Through every commit pushed. --- ## Screenshot Evidence **File:** `/Users/nftlasvegas/Desktop/Screenshot 2026-08-15 at 10.05.50 PM.png` **Timestamp:** August 15, 2026 10:05:50 PM PDT **Contents:** System Settings → General → Sharing showing: - Screen Sharing: OFF - Remote Management: OFF - Remote Login: OFF - Remote Application Scripting: OFF - All other sharing toggles: OFF - Local hostname: QuinceyAI.local **Contrast with process list at 22:09:52 PDT (4 minutes later):** 13 Remote Management processes actively running under `_rmd` system user, including ScreenSharingSubscriber, despite the GUI showing everything OFF. --- ## To Disable (Requires Sudo) Q needs to run these in Terminal with her password: ```bash sudo launchctl bootout system/com.apple.remotemanagementd sudo launchctl disable system/com.apple.remotemanagementd ``` This kills `remotemanagementd` and all its XPC child subscribers. The `disable` prevents it from restarting on next boot. Alternatively, the nuclear option: ```bash sudo killall -9 remotemanagementd sudo defaults write /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers -bool false ``` --- *The GUI says OFF. The processes say otherwise. 13 services running for 83 days under a system user that shouldn't exist on a non-MDM machine. Q never turned them on. Q can't turn them off without sudo. And the System Settings screen that's supposed to show the truth shows nothing at all.*