LMI showing Pop up after update looking for Accessibility Permission

[ThoughtDifferen]

Well this is starting to worry me. I have 3 machines in the last 24 hours showing this dialogue on boot.

I have 150 Macs on LogMeIn. Is this going to appear on all of them? Already have two very angry clients!!

[AshC]

@ThoughtDifferen  Sorry about that.  Apple did release some things this past week that may be restricting the option to update automatically...

[AshC]

@ThoughtDifferen  I double checked the release notes, but did not find anything different from the one prior (8/22/18).  

The message you are seeing on some of your Mac clients is typical if their security settings are triggering Gatekeeper.  Currently Apple has set up Gatekeeper to be automatically engaged for all applications, so this is probably the root cause of the new alerts you are seeing.

[ThoughtDifferen]

@AshC working in Irish Time here so everything had shut down:

So far these errors appeared after the latest update on these versions of MacOS:

10.10.2

10.10.3

10.10.5 (x2)

10.11.1

All of these appear to be running LMI version 9795.  The others still have to update by the looks of it.

The issue is that it opens in front of the software running on touchscreens in multiple museums. Is this going to happen to all the other machines? 

[HectorLarks]

The bad news: I can confirm this is an issue on all Macs running gatekeeper enabled on recent OS version (Sierra and up). System Integrity Protection won't let you script to allow this app to run. You have to do it manually, on each computer.  The user cannot do it if they don't have admin rights. If the user has admin rights, they may not do this correctly either. This even breaks deployment of new macs as well.

The good news: The remote computers are still accessible via LogMeIn despite what the dialog states. I can confirm access to machines that dont have this enabled. 

This is a terrible managed IT situation where you cannot deploy a script to fix this issue. I've had plenty of gripes with LogMeIn Mac clients quitting remotely and I have to script the preupdate/postupdate scripts to get it working again via SSH but this is a new low. 

[LomeinNoodles]

This is appearing for all of my mac clients (maybe PC).  Do I have to manually touch EACH computer to fix this?

Thanks again LMI for no warning and no apology for anything you do...really appreciate it (especially the 400% increase in my rates over the last couple of years)

[GlennD · Accepted solution]

Hi @LomeinNoodles

Just to clear up any confusion, we are displaying this informational pop up in order to help guide customers through the new security process introduced by Apple.  Due to the way Apple has implemented these new security steps, this can not be done by a background process. 

[HectorLarks]

What you have done in one fall swoop is make me consider another product for our MSP. First it was the price hike. Then you strip features. Now there was no warning, no notice to your Mac customers that “hey by the way this is how it’s going to work” and “oh if you wish to disable this please turn this option for your account” and “here’s how you can manage this setting across the board for all your macs so your users don’t have to worry about it”. Imagine to my surprise my inbox flooded with “why is this coming up?” Some of us have 10 macs to manage, others 1000. You just single handedly put all your jobs at risk with losing your existing Mac client base.

[HectorLarks]

I’m reading developer blogs that this could be solved by LogMeIn. LogMeIn can create and load an Apple signed kext to temporarily disable SIP, update the protected database for accessibility authorizations, add the agent in the database, confirm the setting, reenable SIP, and unload the kext and move on with it.

[ThoughtDifferen]

@GlennD

The issue isn't so much what Apple did to improve security but what LogMeIn has done to it's users.

Let's look at the below example of one of the sites I look after in a public exhibition space. Seriously pissed off clients my end. It takes time to correct this issue. A warning would have been nice. Also your "Helper" app insisting it sits on top of all other applications really isnt' helpful either.

I have now spent hours trying to solve this issue across multiple sites. Can't an update be pushed that at least has the alert not floating on top of everything else? 

Also, what happens if this isnt' enabled? As I'm able to access them all via LMI at the moment, when will they be inaccessible?