Microsoft EPM – Random CMD / PowerShell / OpenConsole popups
Hello everyone, we are currently testing Microsoft Endpoint Privilege Management (EPM) and are seeing some unexpected behavior on several devices. Symptoms Users occasionally see random: CMD windows PowerShell windows OpenConsole windows The windows usually appear shortly after logon and disappear automatically after a short time. Some developers also reported issues related to: VS Code terminal integration Copilot terminal actions Windows Terminal WSL / Debian Additional observations However, we have also seen PowerShell popups on a user who is not currently part of the EPM pilot group Some affected devices still have Admin By Request installed Current EPM Configuration At the moment we only have an Elevation Settings Policy assigned with User Confirmed enabled. We currently do not have any custom elevation rules, file hash rules, publisher rules or automatic elevations configured. The issue appears in a configuration that is essentially limited to: EPM client installed Elevation Settings Policy assigned User Confirmed elevation workflow enabled This is one of the reasons why we are unsure whether the behavior is directly related to an EPM policy configuration or to an interaction between: EPM agent Windows Terminal / OpenConsole VS Code WSL Admin By Request Questions Has anyone experienced random CMD / PowerShell / OpenConsole windows after introducing EPM? Has anyone seen issues between EPM and: Windows Terminal OpenConsole.exe VS Code terminal WSL Has anyone run Admin By Request and Microsoft EPM on the same device and observed unexpected console windows? Are there any EPM-specific logs that provide detailed parent/child process relationships for these launches? Any ideas or similar experiences would be greatly appreciated. Thanks!
Endpoint Privilege Management and Windows Terminal
Anyone had issues with using Windows Terminal or the Preview once Endpoint Privilege Management has been enabled? I've got a test rule base at the moment that just does powershell and notepad but now I'm getting blocked by EPM when I'm running Terminal. Our default rule is deny but I wasn't an admin before I enabled EPM and could run Terminal just fine then.Endpoint Privilege Management - "Run with elevated access" only required once?
Hi, I am just evaluating EPM and I just wanted to clarify the functionality. I've deployed my settings policy and created a rule to allow a specific app to run with evaluated privileges. The policy was deployed successfully to the PC. When I clicked on the test application (that requires elevated privilege permission) I got the UAC prompt, which is what I was expecting. Next I right click the app and this time select "Run with elevated access". For info the policy sets the application evaluation type to "Automatic" so the app loads with out the user having to enter a justification. I then close the app and this time just double click it to open it and it opens no UAC prompt or with the need to me to click "Run with elevated access" . I can see with Procmon that the application is running under the EPM account so I believe it is working OK. My question is once a application has been run once with the "Run with elevated access" command is it then approved to run all the time with out the need to select the "Run with elevated access" command? It not a massive issue as the app is authorised but it would be good to understand if this behaviour is correct. Thanks
EPM Service Account Breaks User Context In Apps
Hi, I am working with a customer who is wanting to make use of EPM for their developer team to run some applications with elevated permissions. They have noticed that when elevating certain applications with EPM that a service account is used (see MEM\AzureAD_AdeleVance_$ below), which therefore runs the app with a new user profile, removing things like user preferences, context and also breaks some apps that rely on domain permissions/credentials. From my testing, this service account only seems to be used by EPM when elevating already installed applications, not application installers. Is this by design and is there a possible workaround that avoids EPM using this service account?
