Help · Mac

Remote-access monitoring

Off by default. Turn it on in Settings ▸ Remote Access, from the setup assistant’s “Tell me if someone connects”, or from the “Enable in Settings” link on Home.

What it watches

Every few seconds AtControl looks at open network connections and running processes for the tools people use to reach a Mac remotely:

plus two processes — screen sharing (screensharingd) and SSH (sshd-session) — which are seen even when the connection list is not available. A tool that reaches the Mac through its own relay server rather than one of these ports (AnyDesk, Parsec, TeamViewer’s cloud connections and similar) is not seen by the App Store version. The port list is editable: add your own with a name, switch any off.

If macOS withholds the connection list from the app, the ports cannot be read and only Screen Sharing and SSH are still seen, from their processes. The app and the phone both say so rather than report “no connections”.

What you see

• Home and the menu bar: “Remote monitoring on” / “Remote monitoring off”, and a live count when something is connected.
• The Remote page: a red card — “2 active connections · Someone may be watching your screen” — and the list: tool, remote address, port, process, how long, and a history of recent connections you can clear.
• A macOS notification when a connection appears (this is the one place the Mac app asks for notification permission). The alert style is yours to choose.
• On the phone, “Remote access” alerts and — under the “Someone at the Mac” alarm — a connection that opened while nobody was at the keyboard. The Mac’s screen in the app shows the sessions under way — tool, port and how long.
• In the journal: “Remote connection detected” / “Remote connection ended” with tool, address and duration; Stats counts them as Remote sessions. The remote address stays on the Mac: what reaches iCloud and the phone is the tool and the port.

What it is not

It observes; it does not block. It sees the ports and processes it was told about, so a tool on an unusual port is not seen. It is not a firewall and not an intrusion-detection system.