Home » Remove Admin Rights
Applicable For Endpoint Central MSP 
 
 
On-PremisesCloud

Removal of Admin Rights

Table of contents

Introduction

Removing admin rights in Endpoint Central restricts administrative privileges for certain users or groups when it comes to managing applications on the endpoint devices. This enhances security by preventing unauthorized installation, modification, or removal of applications, and reduces the risk of malware infections and other vulnerabilities.

By selecting a computer and clicking on Remove Local Admin, all Local Admin Accounts in it will be removed except for the ones retained in the Exclusion Policy. Policies to retain certain admin accounts globally can be created from the Exclusion Policy tab. The sysadmin can choose to retain only their account, the built-in administrator account, or any other account depending on their needs. Once all unnecessary local admin accounts are removed, the sysadmin can proceed to create a Privileged Application List. This list can then be associated with custom groups of user devices that will then enable select users to run these applications as administrators, even if they are granted only standard user privileges. Here is how you can leverage the Remove Admin Rights feature to eliminate a huge section of your attack surface:

  • Identify and Analyze the admin accounts: Assessing the distribution of local admin accounts across your network is crucial to identify the security vulnerabilities. The Admin Rights Summary tab displays the list of local admin accounts that correspond to the discovered computers, allowing you to analyze and minimize unnecessary privileges. The Local Admin Count shows the number of local admin accounts on each computer.
  • Remediation: After determining the local admin accounts to be removed or retained, you can manually delete them or configure automatic removal. To prevent accounts from being deleted, include them in the Exclusion policy.

Exclusion Policy

The Exclusion Policy tab allows you to create global policies that protect certain admin accounts. These accounts will be retained on all computers where they are found. The sysadmin can decide to protect only their account, the built-in administrator account, or any other account based on their requirements.

Exclusion Policy

Manual Removal of Admin Rights

Once the exclusion policy is finalized, the sysadmin can remove the remaining unnecessary accounts either manually or automatically. To manually delete these accounts, go to the Admin Rights Summary tab, choose the computers you want to modify, and click 'Remove Local Admin'. The admin privileges to all local admin accounts on those computers will be removed, except for those retained by the exclusion policy.

Manual Removal of Admin Rights

Automatic Removal of Admin Rights

Checking the Enable Automatic Removal box will immediately remove all other admin accounts from the computer groups selected.

Automatic Removal of Admin Rights

Was this article helpful?

Thank you for your feedback!

Sorry about that!

By clicking "Submit", you agree to processing of personal data according to thePrivacy Policy.
Back to Top