How to check whether someone has connected to your Mac remotely

First, a distinction that decides which of these commands is useful to you. macOS has two completely separate doors: Remote Login, which is SSH and gives someone a command line, and Screen Sharing, which is VNC and gives them your desktop. They are recorded in different places, so a check that clears one tells you nothing about the other. On top of both sits whatever third-party remote tool you installed, which keeps its own records or, more often, does not.

The short answer: last and log show will tell you about SSH and Screen Sharing, and nothing built into macOS will tell you about a third-party remote tool, which is the gap most people are actually worried about. That is a deliberate design choice on our part - Servey, the app we make, keeps its own readable activity log on your Mac and never uploads it - but the built-in commands come first, because they cover the doors that are open on every Mac whether you installed anything or not.

Which commands should I run first?

Start with last, because it is the one with real history behind it and the output is readable without any special knowledge. Typing last in Terminal prints login sessions newest first, and a remote SSH login shows the source address in the third column. A local login at the keyboard shows a console entry instead. If you see an address you do not recognise, that is a genuine finding rather than noise, and it is worth acting on.

• last -20 - the most recent login sessions, with a source address for remote ones.
• who - who is logged in right now, this second.
• log show --predicate 'process == "screensharingd"' --last 24h - screen sharing activity in the last day.

The last of those is the one people are usually looking for, and it is also the one that disappoints. The unified log is where macOS records screen sharing, but it is a rolling buffer sized for debugging rather than for auditing. On a busy Mac it can roll over in hours. If something happened last month, that record is gone, and no amount of cleverness with predicates will bring it back.

Then check what is currently switched on, in System Settings under General and then Sharing. Turn off anything you are not deliberately using, and treat Remote Management being on as worth investigating on its own - it is the Apple Remote Desktop agent and is not something a home user enables by accident.

Why does none of this cover the app I actually use?

Because a third-party remote tool does not go through Remote Login or Screen Sharing at all. It runs its own agent with its own connection, so it appears in none of the commands above. Whether there is any record of a session depends entirely on whether that vendor decided to keep one and show it to you. Business tiers of the big tools usually do, because auditing is something companies pay for. The consumer tiers most people run frequently do not, or keep it on the vendor's servers rather than yours.

This is a strange gap when you think about it. The software with the deepest access to your machine is the software least likely to tell you when it was used. It is also the reason the sensible advice about unused remote access tools is to remove them rather than leave them installed and switched off - an agent you never check is an agent you would not notice being used.

What Servey records, and where it keeps it

Servey keeps its own activity log on the Mac, written for a person reading it afterwards rather than for debugging. It records the things that actually happened: the Mac coming online, which device connected and over which path, every incorrect master password attempt and any resulting lockout, every device approval and removal, when the screen was being shared, when Privacy Mode was on, and every session opened, resumed, ended or timed out. Heartbeats, polling and retries are deliberately left out, because a log nobody can read at a glance is a wall rather than an audit trail.

Two properties matter more than the list itself. It lives on your Mac and is never uploaded to us, so it is a record you hold rather than one you request from a vendor. And it is the counterpart to the controls above it: The app asks for a master password set on the Mac and makes you approve each new device on the Mac itself, and this is what answers the question those controls raise but cannot answer on their own - who connected, when, and what did they do.

It is a record of the app, not of your Mac in general. It will not tell you about an SSH login or a Screen Sharing session, so the commands earlier in this article are still the right tools for those. Servey is Apple-only, needs macOS 15.3 and iOS or iPadOS 18.5, and launches soon rather than today.

What should I do if I find something I did not expect?

Take the machine off the network first, then turn off Screen Sharing, Remote Login and Remote Management, and change your Apple Account and Mac login passwords from a device you trust. The full sequence is in the FAQ below. One thing worth knowing before you panic: a remote login from an unfamiliar address is a real signal, but an entry mentioning screensharingd often is not, because macOS uses that machinery for its own features and plenty of people have alarmed themselves reading a normal log.