Notes on Windows Client

User Account Control

User Account Control (UAC) is still enforced (if enabled) to maintain the extra layer of security. If the user needs to run an application elevated, the user still has to select "Run as administrator" and enter own credentials. If the user starts Windows Installer or similar, the installer will automatically ask for elevation and trigger the UAC prompt to continue.

Tampering protection

The administrators group and policy registry keys will be snapshotted before the session starts and restored after a session ends. If the user tries to add other users or groups to the administrators group, these will simply be removed at the end of the session. If the user tried to uninstall Admin By Request during a session, Windows Installer will show an error message saying that Admin By Request cannot be uninstalled during an active session.

Backdoor accounts

If the user has a local admin account that no one knows about, this is not a problem. Because when a user logs on, rights are simply revoked. The reason all accounts are not revoked in general, is because you may have service accounts that you want to continue to have administrative rights. Refer to our FAQ page for more information.

Legacy applications

Some legacy Windows applications require local administrator rights, simply because they were written back in the day, when everything was open and using the same folder for application files and data was the norm. Or settings were mistakenly written to HKEY_LOCAL_MACHINE. This in effect prevents you from taking away administrator rights. But you can make a whitelist of applications with Admin By Request in the portal, which will automatically elevate these applications on-the-fly without users doing anything. You can also create blacklists of programs you never want the user to run, such as cmd.exe or regedit.exe.

Learning mode

Maybe your company took over another company, so you have no idea, which legacy applications users have to run as administrator to work. For this, we have a feature called Learning Mode that you can configure in the portal. It's kind of a pre-production mode, where you install the Admin By Request client, but it doesn't do anything but sit there and "listen" to which applications users start as administrator. Then after a period of time, you can go through the collected list in the portal and click a whitelist button on relevant applications. Once you are ready to go live, you simply disable Leaning Mode again and Admin By Request starts revoking admin rights.

The hidden risk of security solutions

Replacing Windows system files or components can lead to future problems because of Windows Updates, which could ultimately break your OS installs to the extent that computers can no longer boot. A significant advantage to the Admin By Request client software is that it does not change or replace any system files or components. It uses only what is already built into Windows. It also does not consume any system resources, unless it is invoked.

Notes on Mac Client

Tampering protection

On Mac, tampering is not realistically possible. When users get an administrator session, the user's role is not actually changed from user to admin. The user is granted all administrator rights - except the right to add, modify or delete user accounts. Therefore, there is no case, where the user can create a new account or change its own role and become permanent administrator. The user can also not uninstall Admin By Request, as the only program, to keep the administrator session open forever. Furthermore, all settings, configuration and program files are monitored during administrator sessions. If the user tries to remove or change any of the Admin By Request files, these are restored right away.

Downgrading users

Note that on Mac, users are not downgraded from Admin to User role by default, but can be enabled through settings. The reason is that set ups vary from company to company. A typical set up would be to have a fixed named Admin service account and then on each Mac have a specific User account for the end-user.

If you have users that are in the Admin role, you can enable the revoking admin rights setting. But you have to specify the name(s) of your service account(s) in the portal to avoid downgrading all accounts. There is a built in "last admin check" to avoid cutting yourself off to service computers without Admin By Request. If revoking admin rights (downgrading from Admin to User) leaves no accounts left as Admin, the downgrade fails. The only exception is that if the Mac is domain joined, in which case a domain administrator can always log on and this check it not done. Please refer to the Mac section of the frequently asked questions page for more information.