{"id":3779,"date":"2019-03-12T01:32:00","date_gmt":"2019-03-12T01:32:00","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/?p=3779"},"modified":"2026-01-25T08:43:26","modified_gmt":"2026-01-25T08:43:26","slug":"local-admin-rights-elevation-served-three-ways","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/local-admin-rights-elevation-served-three-ways","title":{"rendered":"Local Admin Rights Elevation, Served Three Ways!"},"content":{"rendered":"\n

Versatile admin elevation<\/h2>\n\n\n\n

Version 6 of Admin By Request brings with it a rather \u2018tasty\u2019 new functionality which enables \u2018per app\u2019 elevations using the traditional \u2018run as administrator\u2019 method which most users are familiar with. So with the launch of \u2018run as\u2019 functionality, we thought it would be a good time to dish up a brief re-cap of all three elevations methods available in Admin By Request, and cover the best situation to use them in.<\/p>\n\n\n\n

1. Elevation Via Whitelisting (now called pre-approval)<\/h2>\n\n\n\n
\"WHITELIST-1\"\/<\/figure>\n\n\n\n

Admin By Request comes with sophisticated approval workflows built in, which enable portal administrators to process each elevation request based on a \u2018reason\u2019 and to then decide on whether or not to approve it.<\/p>\n\n\n\n

But what if you have a known application, perhaps legacy, that some staff need to use all the time? You don\u2019t want to have to \u2018workflow\u2019 these requests, but at the same time you don\u2019t want there to be a Local Admin \u2018free buffet\u2019 either.<\/p>\n\n\n\n

This is the ideal scenario for application white-listing.<\/p>\n\n\n\n

To set up an application for Whitelist:<\/h2>\n\n\n\n
  • Log in to the portal and navigate to \u2018Settings > Whitelist\u2019<\/li>
  • Select \u2018new\u2019 to create a new Whitelist entry<\/li>
  • Enter the location of the file (program files, Windows directory, any, or custom) and then the file name.<\/li>
  • On the Whitelist setting is changed it might take a few hours for settings to be taken up by clients.<\/li><\/ul>\n\n\n\n

    Any user can now run this program without having to gain full local admin rights to their system.<\/p>\n\n\n\n

    For more granular control, you can deploy a sub setting and create additional Whitelist entries for those users in that sub setting \u2013 so if you need to Whitelist an application for engineering, you would add this only to the engineering sub setting Whitelist, so only that department could auto elevate it.<\/p>\n\n\n\n

    TIP: Learning Mode automatically detects elevations and enables one click adding to Whitelists.<\/p>\n\n\n\n

    2. Run As Administrator Elevation<\/h2>\n\n\n\n
    \"Run<\/figure>\n\n\n\n

    (Above) If a user \/ group has \u2018Run As Admin\u2019 mode enabled, they can request elevation simply by right clicking on the application in question and selecting the \u2018Run as administrator\u2019 icon from the properties.<\/strong><\/em><\/p>\n\n\n\n

    New in Admin By Request 6 is the ability to perform \u2018per app\u2019 elevations. The main benefit of this is, like whitelisting, you are giving the user the ability to elevate just a single application, rather than granting elevated access to the entire system. Another benefit of the new \u2018Run As Admin\u2019 mode is that it works the exact the same way as users likely got apps to run with Admin Elevation before, so there is minimal need to \u2018re-educate\u2019 users in how to get elevated rights when running apps.<\/p>\n\n\n\n

    Unlike whitelisting, \u2018Run As\u2019 elevations can be configured to require the user to:<\/p>\n\n\n\n

    • Fill out a \u2018reason\u2019 for the elevation<\/li>
    • Require manual approval to run the application elevated<\/li><\/ul>\n\n\n\n

      You have the option to assign different users \/ groups of staff different combinations of these options, with the use of our sub settings functionality.<\/p>\n\n\n\n

      So when you need to manage the granting of elevation \u2018per application\u2019 and not the entire system, the \u2018Run As Administrator\u2019 method is the right choice.<\/p>\n\n\n\n

      3. Full Session Elevation<\/h2>\n\n\n\n
      \"Full<\/figure>\n\n\n\n

      (Above) In order to obtain \u2018Full Session\u2019 elevation (again only if enabled for the user\/group), right clicking on the green \u2018Admin By Request\u2019 icon in the tray invokes the \u2018Request administrator access\u2019 option from where the user can start the full session elevation workflow.<\/strong><\/em><\/p>\n\n\n\n

      Sort of self-explanatory, full session elevation provides exactly that, in that any user given full session elevation gets full local admin rights on their system.<\/p>\n\n\n\n

      Full session elevation mode is ideal for the following situations:<\/p>\n\n\n\n

      • Developer using a lot of elevated applications<\/li>
      • Elevation access to \u2018system\u2019 resources such as drivers, printers etc<\/li>
      • Someone that needs to have their elevation only for a specific amount of time<\/li><\/ul>\n\n\n\n

        As with \u2018Run As\u2019 mode, everything in the elevation session is audited, so you will get to see the reason why the person needs the elevation, anything installed, uninstalled or run.<\/p>\n\n\n\n

        Some extra protections were added to Full Session elevation mode in version 6, such as the ability to block the elevation of any system files (CMD.EXE etc) whilst running elevated, and the ability to \u2018force terminate\u2019 any elevated processes once the timer has run down.<\/p>\n\n\n\n

        4. No Elevation, Elevation!<\/h2>\n\n\n\n
        \"PIN<\/figure>\n\n\n\n

        (Above) if you have excluded a user from Admin By Request in order to deny them the ability to request elevations, it is still possible to perform an ad-hoc elevation with a single use PIN. The end user (or IT support person working on PC) would enter PIN 1 into the portal, and use this to generate PIN 2.<\/strong><\/em><\/p>\n\n\n\n

        Technically there are FOUR ways to get elevation in Admin By Request, the fourth way is not \u2018user self initiated\u2019 and so should be treated separately.<\/p>\n\n\n\n

        Let\u2019s say you deploy Admin By Request to your entire organisation of say 1,000 staff, however you only want to give 600 people the ability to use Admin By Request to elevate as and when they want. To do this you set up a master \u2018Global Scope\u2019 in the portal settings. This scope defines who is able to run Admin By Request in order to either auto elevate or request elevation. Anyone not in this scope, can\u2019t use Admin By Request to elevate unilaterally.<\/p>\n\n\n\n

        However, a very nice feature, new in version 6, is that even if a user is out of the Admin By Request user scope, it is still possible to obtain elevation, via a special single use challenge \/ response PIN code. This code is ONLY be obtained from IT \/ portal administrator.<\/p>\n\n\n\n

        So if a user brings their laptop into your IT department and you know this user is out of Admin By Request user scope, and they need elevation \u2018in profile\u2019, all is not lost. You can easily generate a PIN and start an elevated session, hopefully while that user pops out to buy you a plate of prawn sushi \u2013 served three ways!<\/p>\n","protected":false},"excerpt":{"rendered":"

        A privilege management taster explaining our three main elevation modes, and the scenarios to use them.<\/p>\n","protected":false},"author":2,"featured_media":3780,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[197,96,106,20,22,67,198,68,196],"ppma_author":[16],"class_list":["post-3779","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","tag-admin-session","tag-elevation","tag-features","tag-least-privilege","tag-local-admin-rights","tag-pam","tag-pin-code","tag-privileged-access-management","tag-run-as-admin","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t