ConnectWise Control (ScreenConnect) - Agent Upgrade
Scheduled Maintenance Report for Addigy
Postmortem

Findings

Following the update performed on Saturday, ConnectWise Control (ScreenConnect) may generate a pop-up instructing users how to approve the application, on a specific subset of devices, in order for the ConnectWise Control application to function properly.

This is not an Addigy controlled pop-up but a ConnectWise Controlled Pop-up, as you may be aware.

Unfortunately, we have no control over these pop-up messages, but do extensively test to try and identify if they will generate on machines to provide advance notifications of such behavior. During our testing and rollout, we did not see any of these symptoms. Upon release, a subset of devices within specific customer environments were prompted to approve ConnectWise Control.

Based on the current reports we have received, users who have been previously prompted to approve Screen Recording/Accessibility, but never approved it may receive another prompt to approve Screen Recording or Accessibility.

Testing

Based on our testing:

1. If the device had ConnectWise Control (ScreenConnect) approved, they should continue working as normal and should not get a pop up.

2. If the device was never prompted for screen recording prior to the update, they should continue working as normal and should not get a pop up.

3. If the device never used ConnectWise Control (ScreenConnect) before, it WILL require Screen Recording and Accessibility access to function. The pop-up in reference was documented in January of 2021 as a new pop-up controlled by ScreenConnect: (https://support.addigy.com/support/solutions/articles/8000081088)

Expected Behavior

Addigy automatically attempts to whitelist Accessibility if the device is enrolled in Addigy MDM and has User Approval.

Unfortunately, by Apple Design only the user can approve Screen Recording on macOS 10.14+ Devices:

1. Accessibility - Automatically whitelisted via Addigy MDM if enrolled.

2. Screen Recording - Manually requires enablement

There is no way to prevent these prompts aside from removing ConnectWise Control or encouraging the user to approve ScreenRecording.

Remediation

  • If you wish for the user to not receive these prompts again, we recommend encouraging the User to approve Screen Recording and Accessibility (if it is not already whitelisted). If this is not approved, these pop-ups will appear again on the device when attempting to use ConnectWise Control (ScreenConnect).

  • If you do not use ConnectWise Control (ScreenConnect), we recommend disabling this integration as users will most likely get pop-ups for a tool they and you are unfamiliar with. You can disable this integration in Account > Integrations > ConnectWise Control, it will remove ConnectWise Control within the next 30 minutes or next Policy Deployment, whichever comes first. 

Alternatively, you can disable it per policy, in Policies > Policy Name > Integrations > ConnectWise Control Integration.

Note: Uninstalling ScreenConnect will remove User Approved Screen Recording and PPPC Settings will need to be re-established if you would like to use it in the future.

  • If the device is not enrolled in Addigy MDM or it does not have User Approved MDM, there is a good chance pop-ups like this may happen again, and we encourage you to review devices that do not have User Approved MDM or Addigy MDM, and encourage the User to enroll or approve the MDM Profile.

You can identify these machines using the Device Fact > "Approved MDM" "Has Approved MDM". Please Note again, that no tool can automatically whitelist Screen Recording, however, other pop-ups may appear from lack of permission on these devices when User Approved MDM is missing.

Additional Support or Information

We are here to help clarify any further questions around these prompts. If we require reaching out to ConnectWise, we can help facilitate that as well.

Currently, We have been unable to reproduce certain pop-up behavior in our environments, and it most likely will not happen to all your machines.

However, if you have specific device names you would like us to review, please submit a ticket to support@addigy.com and let us know which machines and if we may pull the logs from the device(s).

Posted May 11, 2021 - 12:37 UTC

Completed
The scheduled maintenance has been completed.

UPDATE: Following the release of the ConnectWise Control Agent Update (https://status.addigy.com/incidents/rppkn3gwnstt) performed this Saturday Morning, there have been limited reports of users being prompted to provide ConnectWise Control appropriate permissions, if it did not previously have permissions. If you experience this please create a support ticket at support@addigy.com for further review.
Posted May 08, 2021 - 11:31 UTC
In progress
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Posted May 08, 2021 - 11:03 UTC
Scheduled
Addigy's ConnectWise Control (ScreenConnect) Integration will roll out the new Agent Update on Saturday, May 8 2021 at 07:00 AM US Eastern Time (11:00 UTC)

This maintenance will queue the Agent Upgrade for ConnectWise Control. If the devices are offline, they will upgrade when they come online.

This will update the ConnectWise Control (ScreenConnect) Agent to 21.4.2455.7731.
The following release notes will detail more information of these changes and be available following the release:
https://releases.addigy.com/AM-8191
https://releases.addigy.com/AM-8210

Note: The Server was previously upgraded and details are available in the following release note: https://releases.addigy.com/AM-8209
Posted May 06, 2021 - 17:32 UTC
This scheduled maintenance affected: Addigy Cloud Interface.