Introduction
- Why Endpoint Central?
Set up Endpoint Central
Working with Endpoint Central
Migration

Frequently Asked Questions (FAQ)

While deploying a policy in strict mode, it can be configured to permit user requests by enabling the option 'Allow users to request applications which are unmanaged'.

Endpoint Privilege Management

What is Endpoint Privilege Management?

Endpoint Privilege Management is the process of allocating application-specific privileged access to users based on their requirements. You can easily adopt the principle of least privilege through out your network, without it affecting your productivity using this feature. It enables privileged access to applications without compromising the privileged credentials or any unnecessary privilege elevation.

When should I enable application level privileged access to users?

Using the Endpoint Privilege Management feature, you can elevate application specific privileges of certain users, without compromising the privileged credentials or elevating their entire organizational level privileges.

What is the significance of the 'Run as ManageEngine' option that is displayed in the File menu of a few applications?

The 'Run as ManageEngine' option is displayed to standard users whose endpoints were added to Custom Groups that were associated with the Privileged Application List during policy deployment. By selecting this option, the standard users can run said applications as administrators without entering any extra credentials, even while they remain as standard users with minimum privileges.

I added an application to the Privileged Application List in the Privilege Management module, however it is not being elevated when run. Why is it so?

These are the suggested resolution techniques:

Only allowlisted applications can be elevated, even if present in the Privileged Application List otherwise. Check whether the application in question is allowlisted to the target user-device.
Ensure that you have checked 'Yes' for the Associate Privileged Application List option during policy deployment.
Only standard users can access applications with elevated privileges using the 'Run as Manageengine' option. Other administrators will have to use their credentials as usual, even if the Privileged Application List is associated with them. Lowering their privileges to standard user type can remedy this.
Modify the Privileged Application List by enabling elevation to "All allowlisted application", this might act as an intermediate fix. Also try testing elevation of other applications in the endpoint to assess the extent of the issue.
If nothing works, you can upload the agent logs from the "C:\Program Files (x86)\DesktopCentral_Agent(or UEMS_Agent)\logs" for us to analyze. Specifying if only a single application has the issue or if it is prevalent with all apps can help us fix it sooner.

How does the elevation of applications using the Endpoint Privilege Management feature work?

Allowisted applications that are added to the Privileged Application List, can be accessed with elevated privileges by the user-devices that are present in the custom groups associated with them. Even standard users can access applications as administrators using this feature, as it elevates the privileges specific to the application and not the user.

Will an application added to the Privileged Application List and associated to a Custom Group during policy deployment execute in the target machines, if they arent allowlisted to them?

No, they have to be allowlisted for them to executed.

Removal of Admin Rights

What are local admin accounts?

User accounts in computers can be classified as standard user accounts and local admin user accounts. Local admin accounts enable users to accomplish management activities on their local computers, whereas standard user accounts grant minimal to no management privileges. Here are a few capabilities that local admin accounts possess:

Installing and uninstalling any software
Adding or removing devices like printers
Creating, deleting or modifying files, folders, and other computer settings
Creating accounts for other users on the computer

What are built-in administrator accounts?

Windows machines come with built-in administrator accounts. They can be used to set up other standard user and local admin accounts initially. These accounts also have privileges similar to the local admin account. However, unlike local admin accounts, they can never be deleted from the machine, only disabled.

How can a new administrator account be added to a machine where all local administrator privileges have been revoked?

If all local administrator rights have been removed from a machine, a new administrator account can be added using the Endpoint Central console. Follow these steps:

Navigate to the Endpoint Central console -> Tools -> System Manager.
Click the agent live status icon and select System Manager (This option will appear only when the agent is live).
Select Groups -> Administrators.
Add the members.

You can verify the addition of the administrator account through either of the following methods:

Type the command-line prompt `net localgroup Administrators` to list all administrators.
Open Windows Run and type `lusrmgr.msc`. Go to Groups > Administrators, and the added member will be listed under the Administrators group.

Was this article helpful?

Thank you for your feedback!

Sorry about that!

What problem did you face? Need more details Need more images Steps are not clear OthersCan one of us reach you to help you better?

Yes No

By clicking "Submit", you agree to processing of personal data according to thePrivacy Policy.

Frequently Asked Questions (FAQ)

Endpoint Privilege Management

Removal of Admin Rights

Features

Explore

Connect with us

Quick Links

Available on

Connect with us

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

Frequently Asked Questions (FAQ)

Endpoint Privilege Management

Removal of Admin Rights

Features

Explore

Connect with us

Quick Links

Available on

Connect with us

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure