Remote Login Always On

OrganicBooks wrote:

For nearly a week every time I go to Sharing prefs. "Remote Login" is always checked—though I uncheck it every time. Yesterday I used this terminal command to shut it down and, while it confirmed it had, the check mark is still there.

sudo

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate

Removed preference to start ARD after reboot.

Unfortunately this weirdness coincides with discovery of two new devices on our network outside our IP-range, unaccounted for after a careful audit, etc. I looked to see if the Remote Login malady is a known bug and didn't find anything. Would love to hear any ideas including all the ways the switch to turn it on (see Terminal response) can get activated.

Call Customer Support (800) MY–APPLE (800–692–7753)

or on line https://getsupport.apple.com/

Outside the USA—Contact Apple for support and service by phone

See a list of Apple phone numbers around the world.

Contact Apple for support and service - Apple Support

That terminal command doesn't have anything to do with Remote Login. Remote Login is the sshd process.

The most likely explanation is that you have installed one or more of the many "security", "clean up", or hacking apps that are so popular.

I'm sure those two devices are totally benign.

Are you Macs managed with MDM? Could there possibly be a policy set to enable Remote Login so you can administer them remotely?