Almost every organization knows users shouldn't be local admins on their machines. A user with admin rights can install any software, turn off protections and run malicious code with full privileges. An attacker who takes over that account gets the same rights.
Even so, many organizations leave those rights in place. The reason usually isn't lack of awareness but worry about the fix: endpoint privilege management (EPM) has a reputation as a complex project that's expensive to maintain, frustrating for users and unsuitable for developers.
Those four concerns were true of some solutions. They don't have to be anymore.
Myth 1: Implementation is complex and slow
The fear is familiar: a months-long project, dedicated servers, databases, and consultants building a policy for every application before you can start.
With a cloud-based solution the picture is different. There are no servers to set up and no infrastructure to maintain. You install a small agent on the endpoints, through Intune or any other deployment tool, and manage everything from a cloud portal.
You don't have to build the policy up front either. You can start in audit-only mode, while users still have admin rights and every action that needs elevation is logged. After a few weeks you see exactly which software users really need, and build the policy from real data instead of guesses. According to Admin By Request, implementing it takes about 70% less time than other systems.
Myth 2: Maintenance takes half a headcount or more
With some legacy solutions, running the system is a part-time or even full-time job: updating rules for every new software version, handling requests and maintaining servers.
The key to low maintenance is automating the routine decisions:
- Pre-approval for known software. Software the organization trusts, by vendor or digital certificate, runs without a request. No need to update a rule for every new version.
- AI-based auto-approval. Admin By Request rates vendors and applications and can automatically approve requests for known, trusted software.
- Approval from your phone. A request that does need approval goes to a mobile app, and you approve it with a tap.
- No infrastructure to maintain. The portal is in the cloud and the agent updates itself.
In practice, after the initial adjustment period, most requests are handled automatically and the IT team only deals with exceptions.
Myth 3: Users won't be able to work
This is the biggest fear, and rightly so. If every printer install or software update means a call to IT and hours of waiting, users will complain and management will ask to bring the rights back.
But a good EPM solution improves the user experience compared to today. Without EPM, a user without admin rights has to open a ticket and wait for a technician to connect remotely. With EPM, approved software runs without waiting for approval, and a request for anything else is sent from the endpoint itself and approved within minutes, sometimes automatically.
Users don't need to know an admin password, don't wait for a technician, and usually don't notice that anything changed.
Myth 4: You can't remove admin rights from developers
Developers are the hardest group to convince, so many organizations give up on them from the start and leave them standing admin rights. The argument is familiar: developers install tools all the time, work with Docker, WSL, npm and PowerShell, and change system settings. Every approval request would slow them down.
But that's exactly why developers are the group that most needs protecting. They have access to code, development environments, keys and servers. An attacker who takes over a developer's machine with admin rights gets far more than from a regular endpoint.
The answer isn't to give up on the group, but to give it its own policy:
- A dedicated policy for the developer group. The same global default, with a layer of exceptions that fits development work.
- Pre-approval for development tools by vendor. Visual Studio, JetBrains, Docker, Git and similar tools run elevated without a request, even after a version update.
- Admin Session for complex tasks. When a developer needs several actions in a row, such as setting up a new environment, they get temporary, logged admin rights instead of standing ones.
- Every file is scanned. Even when developers get more freedom, every file that runs elevated is scanned by dozens of engines.
It works in practice: every one of our Admin By Request EPM customers in Israel has removed local admin rights from their users. And that's exactly the measure of a good EPM solution: not how many endpoints have the agent installed, but for how many users the rights were actually removed.
The Admin By Request approach
Admin By Request was built from the start around these problems: fast implementation, minimal maintenance and a user experience that doesn't suffer. According to the company, more than half of its customers moved to it from other EPM solutions.
The architecture is simple:
- A very small agent. The installer is under 3MB, and the agent uses less than 1% CPU on average. Deployment is fast even on slow networks.
- A cloud management portal. No servers, no databases and no on-premises infrastructure.
- Windows, macOS and Linux from the same portal.
- No passwords. The system doesn't store or manage user passwords, so there's no password vault to break into.
Two elevation modes
| Run As Admin | Admin Session | |
|---|---|---|
| What it gives | Admin rights for one application only | Temporary admin rights on the whole endpoint |
| Examples | Installing software, running software that needs elevation, OS tools | Fixing an issue that takes several actions in a row |
| Who it's for | All users | Mainly support and IT staff |
| Risk scope | Narrow: only the application that ran | Wider, so it's time-limited and logged |
Run As Admin is the mode most users need. Rights are granted only to the application the user asked to run, and to nothing else on the endpoint.
Admin Session gives the user full admin rights on the endpoint for a limited time, with a timer that ends it automatically. It's usually not given to regular users, only to support staff. Every action during the session is logged.
Built-in security and compliance
- Scanning with dozens of engines, at no extra cost. Every file a user asks to run with admin rights is scanned with OPSWAT MetaDefender across dozens of antivirus engines. A malicious file won't run, even if the user requested approval. Scanning is included.
- Intune integration. You can tie elevation to the endpoint's compliance status in Intune.
- MFA before elevation. You can require Entra ID authentication before a user gets admin rights.
- Every Windows configuration. The system works on Workgroup, on-premises domain, Hybrid Joined and Entra ID-only endpoints. That matters especially for organizations in the middle of a move to the cloud.
Summary
The four EPM myths came from heavy solutions that needed infrastructure, a dedicated team and a lot of patience from users. With a small agent, a cloud portal and automated routine decisions, you can remove local admin rights without a long project, without an extra headcount and without disrupting work.
At OnCloud we implement Admin By Request end to end: rolling out the agent, the audit period, building the policy and removing the rights. Want to try it in your organization?
Book a technical demo