Which translates to \u201cWe will clean that little pig!\u201d Or in other words: This may be a difficult task, but we are going to make it work!<\/p>\n\n\n\n
And it was on hitting send that it suddenly occurred to me that our pig cleaning prowess was very much a FastTrack Software \u2018unique sales proposition\u2019.<\/p>\n\n\n\n
PAM Competitors: Care Not Included<\/h2>\n\n\n\n
If you have ever tried to wash a piglet, you will know just how challenging a task it can be to do. You need intelligence to outsmart it. Speed to catch it. Balance to stay\u2026 upright. Dexterity to keep hold of the wriggly little thing. And all the while you need 360 degrees of threat awareness just in case mummy pig appears from the darkness and decides to \u2018join in\u2019.<\/p>\n\n\n\n
So trust me. This is no easy task to perform, and it requires great technical skill to successfully complete.<\/p>\n\n\n\n
Seasoned piglet cleaners will tell you that it\u2019s not only about the technicalities. There is also a critical non-technical skill that must be mastered too.<\/p>\n\n\n\n
The skill\u2026 of care.<\/p>\n\n\n\n
It is of upmost importance to calm your little piggy down in order to reduce its stress and anxiety as much as possible. Achieve this and the job will be far easier to perform, you end up with a much cleaner piglet and the whole process might even be\u2026 enjoyable.<\/p>\n\n\n\n
If you are thinking that the challenge of removing Local Admin Rights from your staff sounds very much like cleaning a piglet, then congratulations, you\u2019ve cannily figured out where I am going with this blog!<\/p>\n\n\n\n
How many conversations have I had with customers who have come from failed PAM projects using alternative products \u2013 products which technically might have worked, however crucially, on the product box they didn\u2019t read the small print: \u2018Care not included\u2019.<\/p>\n\n\n\n
The implementation team completely forgot that at the end of the day, it\u2019s real live humans that are using computers and many of these humans consider that Local Admin is not just a security right, but their human<\/strong> right<\/strong>!<\/p>\n\n\n\n Whenever I am talking to customers about their Admin By Request project, where the removal of Local Admin Rights are involved, I always make an important point to cover the human and emotional aspect of rights removal. It sometimes gets a laugh, but to the user who comes in to work the next morning, finds their rights gone and that they now have to grovel to the helpdesk to \u2018approve\u2019 permission to elevate Visual Studio\u2026 it\u2019s no laughing matter.<\/p>\n\n\n\n So lets look at two different strategies for \u2018cleaning the piglet\u2019 that is, Local Admin Rights removal\u2026.<\/p>\n\n\n\n With Admin By Request, it\u2019s always been possible to deploy with the \u2018revoke\u2019 feature switched OFF. As such, a user with existing Local Admin rights does not have their rights revoked and therefore, the agent runs \u2018silently\u2019 without introducing any new dialogues or change in user behavior at all. A major change in functionality introduced in version 7.3 is that now we fully log all application elevations performed by the user \u2013 even when the user is still a \u2018permanent\u2019 local admin.<\/p>\n\n\n\n Setting up Admin By Request not to revoke rights is super simple \u2013 just switch it OFF before deployment.<\/em><\/p>\n\n\n\n This capability is not entirely new, as it existed before in the controversial feature known as \u2018Learning Mode\u2019. That Learning Mode would stealthily log all user elevation activity without impacting at all their behavior, was a wonderful thing. The idea was that you could really learn and understand what users were doing before you revoked their rights. My own experience on projects making use of Learning mode taught me that doing this greatly improved the implementation experience for both deployer and \u2018deploy-ee!\u2019<\/p>\n\n\n\n There were, however, a couple of issues with how Learning Mode worked.<\/p>\n\n\n\n Logs were not as complete or as well structed as those found in the main audit log, nor were they available for query via the API. It was also (and this was a bit scary) possible to block critical executables from running at all, globally, simply by clicking a gigantic \u2018blacklist\u2019 button by accident. Blanket blocking LogonUI.exe by mistake would not make for a good start to your week!<\/p>\n\n\n\n Learning Mode served a great purpose<\/em>, but did not present logs in the most usable & useful manner.<\/em><\/p>\n\n\n\n Yes, the time has come for me to move on as chief Learning Mode cheerleader! I recognize now that with Admin By Request 7.3 we can now log interactive elevations before rights have been pulled, and those logs are far easier to interrogate being in the audit log. Plus, as they are in the main Audit Log, you can export them via our API to your SEIM or report on them with Power BI. This is now a much better solution than the old Learning Mode.<\/p>\n\n\n\n With Admin By Request 7.3, users that retain their Local Admin rights (shown in red) have elevations fully logged in our main audit log which is a big improvement from the old \u2018Learning Mode\u2019.<\/em><\/p>\n\n\n\n All this said, you might be thinking, why on earth would you deploy a tool whose main function is manage Local Admin rights, and choose to deploy it with these management functionalities all switched off? Well, the answer is\u2026. because you care! In choosing to initially disable revoke you care to learn about what users are doing, so that you can know what will happen to their lives (and yours!) when you eventually pull the Local Admin plug.<\/p>\n\n\n\n When running as a \u2018permanent local admin\u2019 the Admin By Request tray icon is red, not green.<\/em><\/p>\n\n\n\n With a list of \u2018popular\u2019 applications that everyone agrees can be elevated without the need for SecOps to approve, these \u2018pre-approval\u2019 rules can all be \u2018learnt in\u2019 in via the Admin By Request portal well before the big day. The result: the big day becomes… no big deal, and people carry on pretty much as they always had. Not a squeal to be heard.<\/p>\n\n\n\n The other angle on this is that you might also want to identify certain elevation \u2018activity\u2019 that would be considered as being highly inappropriate and potentially compliance wrecking. The stream of misdemeanors is logged and later reported to important people in suits. If there is \u2018trouble at mill\u2019 when it comes time to revoke admin rights, staff can be served with the evidence of the sort of stuff that has been going on.<\/p>\n\n\n\n Faced with the facts, there would be general acceptance that these sorts of things really can\u2019t be allowed for the good of the business. The point is made, common sense prevails and \u2018revoke without the revolt\u2019 is achieved.<\/p>\n\n\n\n The \u2018Disable Revoke\u2019 strategy may give you 10\/10 happy piglet points, but it has one potential drawback you should be aware of. Whilst you are running Admin By Request with revoke disabled, with all of Admin By Requests features turned off save the logging, you are just as much at risk being kicked in the behind by the \u2018angry sow\u2019 of malware \u2013 than before you deployed Admin By Request to your endpoints.<\/p>\n\n\n\n Yes, it would be an ironic and very unlucky co-incidence, but it could happen. People upstairs would be justified to ask, why, after investing in and deploying Admin By Request could the unfortunate incident have been \u2018allowed\u2019 to happen. The response of \u2018We wanted to perform a user impact assessment to learn what users were doing before revoking their rights\u2019<\/em> \u2026might not be met with a sympathetic response!<\/p>\n\n\n\n So the other way to clean your piggie, is to deploy Admin By Request, configure it to immediately revoke local admin rights, but at the same time, soften the default \u2018Authorization\u2019 settings so users can initially elevate what they like \u2013 perhaps with a single requirement of requiring them to enter a reason as to state why they need to elevate.<\/p>\n\n\n\n An example of some \u2018Soft Settings\u2019 used at the start of a deployment. Users can elevate anything but are required only to enter a \u2018reason\u2019 for their elevation.<\/em><\/p>\n\n\n\n Tray Tools gives the user various (fully customizable) shortcuts to quickly access parts of the operating system which require elevated access.<\/em><\/p>\n\n\n\n There are some areas of the Windows operating system which need additional clearance for elevated access \u2013 mainly applications launched from Windows Control Panel. With soft settings these are fully accessible when using \u2018Administrator Session\u2019 mode however some control panel elements may invoke a \u2018traditional\u2019 UAC box which users would need to re-enter their non admin user credentials.<\/p>\n\n\n\n By setting up and enabling Tray Tools either globally or for a group, users can launch control panel elements much easier (no UAC) directly through the Admin By Request Tray icon.<\/p>\n\n\n\n Access and use of Tray Tools is also logged and shown in the Audit Log.<\/p>\n\n\n\n Tray Tools is easily enabled by navigating to (Settings)<\/em> > Applications<\/em> > Tray Tools.<\/em><\/p>\n\n\n\n Tray Tools can be configured globally or via a sub-setting. They can be configured to launch elevated and non-elevated tasks (https links to intranets etc.).<\/em><\/p>\n\n\n\n The \u2018Soft Settings\u2019 approach has several advantages.<\/p>\n\n\n\n Firstly, you have revoked rights, so users are no longer operating with full admin rights. They can still elevate anything they like (just like they did before), but unlike before they only elevate the specific application when needed, or in the case of an admin session, be elevated just for a specific window of time. You\u2019ve enabled Just In Time elevation rights, right off the bat.<\/p>\n\n\n\n Enabling revoke means <\/em>also enabling our extremely useful built in Malware reputation solution, powered by OPSWAT MetaDefender.<\/em><\/p>\n\n\n\n Secondly, with our unique OPSWAT integrated Malware \/ File Reputation integration, all file hashes elevated by users would need to pass through a battery of 20 A\/V providers before that elevation was permitted to be performed. Anything known to be even remotely suspicious would be blocked and sent to quarantine where a portal administrator could then decide whether or not it should be allowed to elevate. Like many of Admin By Requests features, malware protection is on as default and is totally automatic. You pretty much forget it\u2019s switched on, until something triggers it and you become gratefully reminded that it is.<\/p>\n\n\n\n Finally, with ABR switched on, if a single user did somehow manage to run malware on their system, in just a few clicks you could blacklist the malwares checksum \u2013 globally, and soon after, prevent all others from either elevating it OR even running it at all.<\/p>\n\n\n\n Like with the first approach you would still have full visibility of all applications that users are elevating, what AD \/ AAD groups they belonged to and you can use this data to create some really granular rules which would decide who gets to do what with what applications. When the time comes to switch on manual approval, it\u2019s not a big deal because you have built your list of \u2018approved without needing manual approval\u2019 applications.<\/p>\n\n\n\n So the difference between these two approaches is that \u2018Disable Revoke\u2019 is entirely learning based, there is zero impact on user behavior at all, but you need to also live with risk (though not increased) whist you are running in this mode.<\/p>\n\n\n\n \u2018Soft Settings\u2019 involves a little education of staff as enabling Admin By Request revoke will slightly change how they elevate applications. You took their rights away but you gave them pretty much the same rights right back again, so there should be no complaints there. You are fully utilizing the product from day one, and all of the protections (and compliance checkbox ticks) it provides.<\/p>\n\n\n\n The great thing with Admin By Request, is that you not only have the ability to choose which way to go yourself, but actually you can choose different approaches for different groups of people by thoughtful use of \u2018Sub Settings\u2019.<\/p>\n\n\n\n It may also dawn on you that perhaps a good plan would be to do both, one after the other. Initially deploy with revoke disabled, for a few days of recon and deployment, and then you can \u2018stage\u2019 people over to soft settings in an orderly fashion, simply by moving them into a different AD \/ AAD group.<\/p>\n\n\n\n It\u2019s totally up to you.<\/p>\n\n\n\n The challenge of \u2018cleaning piglets\u2019, or making difficult tasks easy and fun to do, is something deeply ingrained in our DNA here at FastTrack Software, and thinking about it, a pristine piglet is surely a powerful metaphor (and mascot?) for the entire company rather than just the tricky job of humanely removing Local Admin Rights. One might say that the \u2018art\u2019 of cleaning pigs is fundamentally \u2018baked in\u2019 to everything we do here.<\/p>\n\n\n\n Being a Danish company, perhaps not baked in, but… err… fried?<\/p>\n\n\n\n (Sorry piglet!)<\/p>\n","protected":false},"excerpt":{"rendered":" Adopting a less \u2018pig-headed\u2019 approach to removing Local Admin rights from staff will always return happier project outcomes.<\/p>\n","protected":false},"author":2,"featured_media":1262,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[96,106,20,19,133],"ppma_author":[16],"class_list":["post-1256","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","tag-elevation","tag-features","tag-least-privilege","tag-privilege","tag-revoke","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tStrategy 1: Revoke Disabled<\/h2>\n\n\n\n
![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Babe-Mode-Settings.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Learning%20Mode(1).png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Babe-Mode-AuditLog.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Babe-Mode-Icon.png\"){kind=icon}
<\/figure>\n\n\n\nStrategy 2: Soft Settings<\/h2>\n\n\n\n
![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/ASPM-Settings(1).png\")
<\/figure>\n\n\n\nDon\u2019t Forget The Tray Tools<\/h2>\n\n\n\n
![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Tray-Tools.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Tray-Tools-Settings.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Malware.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/Blacklisting.png\")
<\/figure>\n\n\n\nSqueaky Clean Piglet \u2013 Two Ways<\/h2>\n\n\n\n
FastTrack Software: Saving your bacon!<\/h2>\n\n\n\n