Endpoint Privilege Management and Windows Terminal
Anyone had issues with using Windows Terminal or the Preview once Endpoint Privilege Management has been enabled? I've got a test rule base at the moment that just does powershell and notepad but now I'm getting blocked by EPM when I'm running Terminal. Our default rule is deny but I wasn't an admin before I enabled EPM and could run Terminal just fine then.
Endpoint Privilege Management - "Run with elevated access" only required once?
Hi, I am just evaluating EPM and I just wanted to clarify the functionality. I've deployed my settings policy and created a rule to allow a specific app to run with evaluated privileges. The policy was deployed successfully to the PC. When I clicked on the test application (that requires elevated privilege permission) I got the UAC prompt, which is what I was expecting. Next I right click the app and this time select "Run with elevated access". For info the policy sets the application evaluation type to "Automatic" so the app loads with out the user having to enter a justification. I then close the app and this time just double click it to open it and it opens no UAC prompt or with the need to me to click "Run with elevated access" . I can see with Procmon that the application is running under the EPM account so I believe it is working OK. My question is once a application has been run once with the "Run with elevated access" command is it then approved to run all the time with out the need to select the "Run with elevated access" command? It not a massive issue as the app is authorised but it would be good to understand if this behaviour is correct. Thanks
EPM Service Account Breaks User Context In Apps
Hi, I am working with a customer who is wanting to make use of EPM for their developer team to run some applications with elevated permissions. They have noticed that when elevating certain applications with EPM that a service account is used (see MEM\AzureAD_AdeleVance_$ below), which therefore runs the app with a new user profile, removing things like user preferences, context and also breaks some apps that rely on domain permissions/credentials. From my testing, this service account only seems to be used by EPM when elevating already installed applications, not application installers. Is this by design and is there a possible workaround that avoids EPM using this service account?
