Warning

Exposing Screen Sharing to the public internet invites brute-force attacks. Use VPN or SSH tunnels.

What you will achieve

Enable Screen Sharing for remote help or admin access without exposing your Mac to the internet raw.

Screen Sharing is macOS VNC server for remote view/control on LAN. Convenient for family tech support; dangerous if exposed to internet raw. Pair with VPN or SSH tunnel; limit users; disable when idle. Messages screen share is simpler for one-off help.

1) Enable locally

System Settings → General → Sharing → Screen Sharing — on.
Click Info — limit users to specific accounts; avoid Everyone.
Note Mac name for vnc://hostname.local on LAN.

2) Authentication

Users need Mac account credentials or you generate VNC password in Screen Sharing settings — prefer Mac accounts with strong passwords and 2FA on Apple ID separately.

3) Do not port-forward VNC

Default VNC is not encrypted like SSH tunnel. Use VPN, Tailscale, or Apple Remote Desktop over secure channel — never naked port 5900 on router.

4) Alternative: SSH tunnel

ssh -L 5900:localhost:5900 user@mac-hostname

Connect Screen Sharing to localhost after SSH authenticated.

5) Audit access

Disable Screen Sharing when not needed. Check Firewall allows only while service on. Review login items for remote tools (TeamViewer, AnyDesk).

6) Observe vs control

Screen Sharing allows full control by default — grant observe-only in sharing prefs if helper only needs to watch. Ask mode in Messages is lighter for one-off help without opening port.

7) Wake on LAN limitations

Mac asleep on Wi‑Fi often unreachable — enable Wake for network access or use wired Ethernet for headless Mac mini server you screen-share into.

8) Log review

Console filter screensharing after sessions — confirm disconnect and no foreign IPs if you tunnel incorrectly.

Verify

Trusted device connects on LAN or VPN; connection refused from public internet; sharing off when idle.

Additional troubleshooting notes

If steps above do not resolve the issue on the first attempt, reboot once, confirm System Settings → General → Software Update is current, and retry with a second administrator account to rule out profile or keychain corruption in your daily user. Document exact error text from Console.app with timestamp — vague “it still fails” without logs wastes support time. On Apple Silicon, re-test after full shutdown (not just restart) because firmware and Thunderbolt controllers reset only on cold boot. Intel Macs should repeat test in Safe Mode to bypass third-party login items. Before erase or keychain reset, verify Time Machine or clone backup completed — batch 3 guides assume Monterey/Ventura/Sonoma/Sequoia paths in System Settings; search Spotlight for renamed panes if your macOS version labels differ slightly.