{"id":3688,"date":"2021-10-14T04:00:00","date_gmt":"2021-10-14T04:00:00","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/?p=3688"},"modified":"2026-01-25T07:57:22","modified_gmt":"2026-01-25T07:57:22","slug":"auto-approval-in-case-of-emergency","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/auto-approval-in-case-of-emergency","title":{"rendered":"Auto-Approval, In Case of Emergency"},"content":{"rendered":"\n

\u201cYou can\u2019t have your cake, and eat it!<\/em>\u201d, I was told last week, by one of our Danish developers.<\/p>\n\n\n\n

We had been discussing a feature request from an Italian customer, who wanted to enforce approval on user elevation requests but at the same time, provide a \u2018bypass\u2019 facility that would enable staff to gain automatic approval, in \u2018emergency\u2019 situations.<\/p>\n\n\n\n

Whilst suspecting the developer had a valid point, I suffered an adverse reaction to the common \u2018cake and eat it\u2019 turn of phrase he used.<\/p>\n\n\n\n

I mean, what else does one do when they have cake, if not eat it?<\/p>\n\n\n\n

A little more research only got me further agitated, when I discovered that this non-sensical saying had \u2018evolved\u2019 from the far more logically correct \u2018you can\u2019t eat your cake and (still) have it<\/em>\u2019 in the first half of the 20th century, to the idiotic idiom we have today. Darwin\u2019s theory of evolution obviously does not apply to the English language.<\/p>\n\n\n\n

At least my Danish colleague had no such problems with his language:<\/p>\n\n\n\n

\u201cMan kan ikke b\u00e5de bl\u00e6se og have mel i munden!<\/em>\u201d (You can\u2019t both blow and have flour in your mouth!) is the more amusing (but still bake-related) equivalent of the term in Danish.<\/p>\n\n\n\n

Once the mental image of a developer furiously wafting clouds of flour away from his laptop screen had subsided, I regained composure and got back to working the customer enquiry.<\/p>\n\n\n\n

Their Admin By Request deployment had been so successful, it was to be recommended to another part of the business, who still \u2018enjoyed\u2019 working under full local admin rights.<\/p>\n\n\n\n

The loss of Local Admin rights, for those who have gotten used to having them all their lives, can be quite a blow. We joke sometimes that Local Admin Rights are seen by some as a \u2018human right\u2019 but for many, it\u2019s no laughing matter \u2013 this is how some people feel. It was no surprise that the suggestion to deploy Admin By Request there went down like a \u2013 sack of pasta flour landing on one\u2019s head. No grazie!<\/em><\/p>\n\n\n\n

This was presumably the motivation for the deployment of Admin By Request countermeasures, with a \u2018have cake and eat it\u2019 request:<\/p>\n\n\n\n

\u201cWhat if there is a situation, and we simply can\u2019t wait to be approved? We must have a way to bypass approval\u2026 in case of emergency!\u201d<\/p>\n\n\n\n

And there lies the problem. With Admin By Request, the enforcement of approval is a binary choice, either it\u2019s on or off.<\/p>\n\n\n\n

There is no \u2018on\u2026 but also off, if it\u2019s an emergency\u2019 setting.<\/p>\n\n\n\n

To make a product feature which would allow approval to be circumvented in case of emergency, we would need to also invent a feature that could determine what constituted an emergency in the first place! For this particular customer an \u2018emergency\u2019 might range all the way from a full factory shutdown to a home working developer needing to install something in a hurry so he can rescue a fast-melting Zuccotto. Good luck finding an A.I. solution to do THAT.<\/p>\n\n\n\n

It seemed that for my Italian customer, this would be a case of \u201cVolere la botte piena e la moglie ubriac!<\/em>\u201d.<\/p>\n\n\n\n

Then I had an idea. Maybe with Admin By Requests \u2018Support Assistance\u2019 feature, it would be possible to have your cake AND eat it after all?<\/p>\n\n\n\n

Emergency Assistance<\/h2>\n\n\n\n

For those of you not familiar with our Support Assistance feature, here\u2019s a quick heads-up:<\/p>\n\n\n\n

First, I have to point out that the feature is a little unusual in that you will find no settings for it in the Admin By Request portal, and because of this, you won\u2019t find any \u2018in line\u2019 support documentation either. The genius of this feature is\u2026 that there is really not much to actually do, aside from have a basic compatible configuration, and that means the use of \u2018Sub Settings\u2019.<\/p>\n\n\n\n

A classic use case for Support Assistance would be as follows:<\/p>\n\n\n\n

A user with restrictive Admin By Request settings (manual approval required, no elevation of system files allowed) has a system problem which requires IT helpdesk to fix. The IT helpdesk remotes to the users computer (using something like MS Teams or TeamViewer) and immediately finds that they are not able to elevate PowerShell because the logged-in user\u2019s Admin By Request settings do not allow this.<\/p>\n\n\n\n

The helpdesk user invokes Admin By Requests \u2018Support Assistance\u2019 feature to \u2018fetch\u2019 their own Admin By Request settings which get temporarily applied to the users working profile, to get the job done.<\/p>\n\n\n\n

To invoke Assistance, right click on the Admin By Request icon, and click \u2018About\u2019<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

From the resulting pop-up screen, select \u2018Assistance\u2019<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Now select \u2018Start\u2019<\/p>\n\n\n\n

At the next screen the helpdesk user would authenticate with their own AD \/ AAD user \/ password.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

If this authentication is successful then the Assistance Session is started, visible by the blue timer counting up, signifying the duration of the Support Assistance session.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

The helpdesk user can now do anything on this system with Admin By Request, just as if they were logged into their own user account. Elevate system files. Start a full, unrestricted Admin Session. What is possible depends entirely on whatever settings you have put in your own Admin By Request sub settings.<\/p>\n\n\n\n

If the restricted user sub settings required approval, and the helpdesk user do not, the helpdesk Admin By Request settings applied by Support Assistance \u2018win\u2019, and approval is no longer required.<\/p>\n\n\n\n

See where I am going with this?<\/p>\n\n\n\n

Ice Ice Baby!<\/h2>\n\n\n\n

Yes, if we create a new Sub Setting \u2013 called \u2018In Case Of Emergency\u2019, create an AD group called \u2018ABR-EMERGENCY\u2019 and add a special \u2018Emergency\u2019 user to this group, now the Admin By Request settings of the \u2018In Case Of Emergency\u2019 sub setting will be applied to any user of Admin By Request that uses the \u2018Emergency\u2019 account with a Support Assistance session.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n

Being Support Assistance, everything is joint-logged, in both the name of the end user, and in this case, the \u2018Emergency\u2019 account used to gain the emergency override.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Plus as the ICE account has it\u2019s own sub setting, this means we can also show a nice \u2018Emergency Mode\u2019 notice screen before any elevation is started:<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

There is one drawback with Support Assistance, but this can also be seen as a benefit.<\/p>\n\n\n\n

To use Support Assistance a \u2018line of sight\u2019 link to your organizations Active Directory is needed for the additional authentication. Therefore, this is solution is not going to help any offline users. Then again, if you want to build in an \u2018ICE Override\u2019 perhaps it\u2019s a good thing that this is not allowed \u2018un-authenticated\u2019 and offline, otherwise it would be impossible to track the usage.<\/p>\n\n\n\n

One more nice little side effect of requiring real time authentication with AD, is that you can configure \u2018Logon Hours\u2019 for your \u2018ICE\u2019 account to limit the time of day which it can be used.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

So, for example, if you want to require approval during office hours, but also want to find a means to allow users to get auto approval when there is no one in the helpdesk to do the approval (and of course it also happens to be an \u2018emergency\u2019) then you can simply set the \u2018logon times\u2019 in AD to out of helpdesk hours.<\/p>\n\n\n\n

Everyone Gets Cake<\/h2>\n\n\n\n

The result? Admin By Request can be deployed and security compliance achieved because users are no longer working under permanent Local Admin rights.<\/p>\n\n\n\n

Requests to perform Local Admin rights elevation all require approval\u2026 unless it\u2019s deemed to be an emergency.<\/p>\n\n\n\n

If the emergency account is used, there is still a full audit trail, accessible via API, for someone (or something) to keep a close eye on emergency account use.<\/p>\n\n\n\n

From ICE to ADM<\/h2>\n\n\n\n

Whilst I\u2019m on the subject of Support Assistance, I thought I would mention one more use case, which works pretty much identically to our \u2018In Case Of Emergency\u2019 example.<\/p>\n\n\n\n

This customer was extremely security conscious and really did not want users elevating *anything* with their domain accounts at all. Because of this, they wanted to create mirror \u2018ADM\u2019 accounts which users could use to exclusively run their admin tasks from.<\/p>\n\n\n\n

Typically, with Admin By Request, we are working with the logged-in user, but, yes, using Support Assist you could create and use tandem \u2018ADM\u2019 accounts. Rather than restrict usage to the more traditional Helpdesk, or the rare emergency, Support Assistance would be used to access \u2018ADM accounts\u2019 throughout the day for process elevation, with everything joint-logged, whilst keeping the primary account completely locked down, with no rights to elevate anything.<\/p>\n\n\n\n

Perhaps we should rename the feature, from Support Assist to \u2018Settings Overlay\u2019, or maybe just good old \u2018Cake mode\u2019?<\/p>\n\n\n\n

The Non-Cakewalk, Cake Walk<\/h2>\n\n\n\n

The armchair psychologists among you might suspect that my over-sensitivity to the \u2018can\u2019t have your cake and eat it\u2019 phrase is down to an emotional episode in my childhood, and you\u2019d be right.<\/p>\n\n\n\n

After collecting a birthday cake from a shop in hot and humid Singapore, 5 minutes into my walk home I wondered why my box had sprung a leak. That my box did not immediately appear to self-combust, issuing volcanic plumes of white smoke when leaving the shop\u2026. was a significant difference from other customer purchases I should have questioned.<\/p>\n\n\n\n

It was an ice cream cake, and the shop had forgotten to pack the dry ice.<\/p>\n\n\n\n

That night, twelve candles were blown out on a lowly mango pudding\u2026. and sadly, it is the only birthday I can remember where there was no having of cake, and no eating it either!<\/p>\n","protected":false},"excerpt":{"rendered":"

How to have your (ICE Cream) cake and eat it too.<\/p>\n","protected":false},"author":2,"featured_media":2208,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[171,46,173,125,126,138,47,174,48,172],"ppma_author":[16],"class_list":["post-3688","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","tag-app-control","tag-auto-approval","tag-emergency","tag-emergency-access","tag-local-admin","tag-local-admin-access","tag-pre-approval","tag-privileged-access","tag-whitelist","tag-whitelisting","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t