LogMeIn host installer setup and deployment in JAMF

Follow the instruction below to create a LogMeIn host deployment in JAMF.

Sign in to LogMeIn Central and download the LogMeIn host package installer with deployment information:

Important: If you do not have a deployment package, then create a new one first.
1. On the Deploy Installation Package page, select the Installer Mac package (.pkg) deployment method.
2. Select Download package.
  Your .pkg installer will be downloaded in a .zip archive format. Do not unpack it; you will use it in JAMF Pro.
Open JAMF Pro.
Select the gear icon in the top right to open All settings.
Go to Computer Management > Packages.
Select +New to upload the new installer.
Under Filename, browse to the LogMeInPkgInstallerMac.zip file.
Select Save to upload the file.
In JAMF Pro, go to Computers > Policies and select +New to create a new policy.
1. Enter a Display name, such as “Deploy - App - LogMeIn Host"
2. Change the trigger and execution frequency to match how you would like the installer to deploy.
3. Go to Options > Packages and select Configure.
4. Browse to the downloaded LogMeInPkgInstallerMac.zip installer and select add.
  
  If you want your app to be deployed silently to a group of (or all) users or computers, then use the Scope section to specify the target groups, users, or devices. To make your app available in the Self Service app for all MacBook Users, in the Self Service section, select Make the policy available in Self Service.
5. Select Save at the bottom and your app will begin to deploy to the defined users.

Configuration Profile Setup (Privacy Preference Policy Control)

In JAMF Pro, go to Computers > Configuration Profiles and select +New.
Add a Display name.

Under Privacy Preference Policy Control, select Configure and set the following:.

Add the following app identifier: com.logmein.logmeinserver
Set identifier type to Bundle ID

In the Code Requirement field, set the following:

identifier "com.logmein.logmeinserver" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GFNFVT632V

Add Accessibility and SystemPolicyAllFiles under App or Service.
Change Accessibility to Allow.
Change SystemPolicyAllFiles to Allow.

Select the + sign next to app access to add the following identifier:

identifier name: com.logmein.logmeinguiagent
Set identifier type to Bundle ID

In the Code Requirement field, set the following:

identifier "com.logmein.logmeinguiagent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GFNFVT632V

Add Accessibility and ScreenCapture under App or Service.
Change Accessibility to Allow.
Change ScreenCapture to Allow Standard User to Allow Access.
Define the proper scope.

If you want your Configuration Profile to be deployed silently to a group of (or all) users or computers, then use the Scope section to specify the target groups, users, or devices.
Select Save at the bottom and your profile will begin to deploy.

Configure kext support

Select Approved Kernel Extensions Payload.
Select Configure.
Fill in the dialog as follows:
- Display Name: LogMeIn Host
- Team ID: GFNFVT632V
Save your changes.

Restrictions and consents

After deployment, the computer can go online. You can connect via file transfer, command prompt, and so on, but remote control will work only in very limited mode and without remote sound, mouse and keyboard control.

To allow full functionality of remote control, the user needs to approve the Microphone and ScreenCapture consents on the host machine manually.

These cannot be approved automatically via JAMF due to Apple's restrictions, but can be applied by non-admin users too, if it is set in the JAMF policy. (ScreenCapture should be set to Allow Standard User to Allow Access as described above.)

To allow full remote control, do the following:

When prompted, start process. Access for microphone pop up. Select OK.
In the Screen Recording dialog, select Open System Settings.
Enable LMIGUIAgent.
After LMIGUIAgent is enabled, restart the application. Select Quit & Reopen.

Now LogMeIn has full remote control capability.