The value proposition

Notes on Windows Client

The hidden risk of security solutions

Replacing Windows system files or components is dangerous and can lead to future problems because of Windows Updates, which could ultimately break your OS installs to the extent that computers can no longer boot. A significant advantage to the Admin By Request client software is that it does not change or replace any system files or components. It uses only what is already built into Windows and only interfaces well documented by Microsoft. And because of this, it also does not consume any resources at all, unless it is invoked.

User Account Control

User Account Control (UAC) is still enforced (if enabled) to maintain the extra layer of security. If the user needs to run an application during an Admin Session, the user still has to envoke "Run as administrator" directly or indirectly and enter own credentials. This is intentional to avoid reducing the security level. Admin By Request does not replace or tap into UAC for the reasons stated in the previous section.

Tampering protecting Admin Sessions

The administrators group and policy registry keys will be snapshotted before the session starts and restored after a session ends. The Local Users and Groups snap-in in Computer Management will also be removed during admin sessions. If the user finds other ways to manipulate users or groups in the administrators group, these will simply be removed at the end of the session. If the user tried to uninstall Admin By Request during a session, Windows Installer will show an error message saying that Admin By Request cannot be uninstalled during an active session.

Backdoor accounts

If the user has a local admin account that no one knows about, this is not a problem. Because when a user logs on interactively, rights are simply revoked at logon. The reason all accounts are not revoked in general right away, is because you may have service accounts that you want to continue to have administrative rights. Service accounts would not be used for interactive logons and therefore righs are never revoked. You can exclude specific interactive accounts from revokation. Refer to our FAQ page for more information.

Legacy applications

Some legacy Windows applications require local administrator rights, simply because they were written back in the day, when everything was open and using the same folder for application files and data was the norm. Or settings were mistakenly written to HKEY_LOCAL_MACHINE. This in effect prevents you from taking away administrator rights. But you can make a whitelist of applications with Admin By Request in the portal, which will automatically elevate these applications on-the-fly without users doing anything. You can also create blacklists of programs you never want the user to run, such as cmd.exe or regedit.exe.

Learning mode

Maybe your company took over another company, so you have no idea, which legacy applications users have to run as administrator on Windows to do their work and users cannot be expected to know that they would have to invoke "Run As Administrator" to make it work. For this, we have a feature called Learning Mode that you can configure in the portal. It's kind of a pre-production mode, where you install the Admin By Request client, but it doesn't do anything but sit there and "listen" to which applications users start as administrator. Then after a period of time, you can go through the collected list in the portal and click a whitelist button on relevant applications. Once you are ready to go live, you simply disable Leaning Mode again and Admin By Request starts revoking admin rights.

Notes on Mac Client

Tampering protection

On Mac, tampering is not realistically possible. When users get an administrator session, the user's role is not actually changed from user to admin. The user is granted all administrator rights - except the right to add, modify or delete user accounts. Therefore, there is no case, where the user can create a new account or change its own role and become permanent administrator. The user can also not uninstall Admin By Request, as the only program, to keep the administrator session open forever. Furthermore, all settings, configuration and program files are monitored during administrator sessions. If the user tries to remove or change any of the Admin By Request files, these are restored right away.

Downgrading users

Note that on Mac, users are not downgraded from Admin to User role by default, but can be enabled through settings. The reason is that set ups vary from company to company. A typical set up would be to have a fixed named Admin service account and then on each Mac have a specific User account for the end-user.

If you have users that are in the Admin role, you can enable the revoking admin rights setting. But you have to specify the name(s) of your service account(s) in the portal to avoid downgrading all accounts. There is a built in "last admin check" to avoid cutting yourself off to service computers without Admin By Request. If revoking admin rights (downgrading from Admin to User) leaves no accounts left as Admin, the downgrade fails. The only exception is that if the Mac is domain joined, in which case a domain administrator can always log on and this check it not done. Please refer to the Mac section of the frequently asked questions page for more information.