Forum Discussion

Rob-CTL's avatar
Rob-CTL
Iron Contributor
Dec 01, 2023

Endpoint Privilege Management - "Run with elevated access" only required once?

Hi,

 

I am just evaluating EPM and I just wanted to clarify the functionality.  I've deployed my settings policy and created a rule to allow a specific app to run with evaluated privileges.  The policy was deployed successfully to the PC.  When I clicked on the test application (that requires elevated privilege permission) I got the UAC prompt, which is what I was expecting.  Next I right click the app and this time select "Run with elevated access".  For info the policy sets the application evaluation type to "Automatic" so the app loads with out the user having to enter a justification. I then close the app and this time just double click it to open it and it opens no UAC prompt or with the need to me to click "Run with elevated access" .  I can see with Procmon that the application is running under the EPM account so I believe it is working OK.

 

My question is once a application has been run once with the "Run with elevated access" command is it then approved to run all the time with out the need to select the "Run with elevated access" command?  It not a massive issue as the app is authorised but it would be good to understand if this behaviour is correct.

 

Thanks

Endpoint Privilege Management (EPM)

7 Replies

    • Rob-CTL's avatar
      Rob-CTL
      Iron Contributor
      Dec 04, 2023
      Hi Rudy_Ooms_MVP

      Thanks for the response, yes the policy is set to automatic but the question I was trying to ask, apologies if I wasn't clear, is why on first clicking of a approved privileged app it would cause the UAC prompt to appear and require the user to use the "Run with elevated access" command then after that the user can just double click the app and it will load i.e. not having to go through the "Run with elevated access" process. I am trying to document the process for users so I am just trying to understand if this behaviour is by design.
      • Rudy_Ooms_MVP's avatar
        Rudy_Ooms_MVP
        MVP
        Dec 04, 2023
        Which app did you configured for epm elevation? As doing this for powershell doesn't give you the uac prompt. I assume that app needs to perform some other tasks first to be able to be launched automatically. If you have the name of the app or could share some more info, i could try to see whats happening and give you the reason why that uac is shown

Resources