# Configure Elevation for .bat and .msc Files

Learn how to securely elevate .bat and .msc files using folder path or file hash rules in Application Control Plus, without granting full administrator rights.

## Overview

A **.bat (Batch) file** is a Windows command script that automates tasks using command-line instructions. These files are commonly used for software installation, system configuration, cleanup operations, and administrative automation.

An **.msc file** is a Microsoft Management Console (MMC) file that opens administrative snap-ins such as Services, Device Manager, or Event Viewer. These files are typically used to access and manage system-level configurations. Examples of .msc files include:

- **Services (services.msc):** Manage Windows services (start, stop, configure).
- **Device Manager (devmgmt.msc):** View and manage hardware devices.
- **Event Viewer (eventvwr.msc):** Monitor system and application logs.

Application Control Plus supports elevation of both .bat and .msc files through policy-based controls. This enables approved scripts and management consoles to run with administrative privileges without granting users full local administrator rights. Only explicitly authorized files in the policy are permitted to run with elevated privileges. All others remain restricted under standard user permissions.

The goal is controlled privilege delegation — enabling necessary administrative execution without expanding the user's privilege boundary.

> **Note:** .bat and .msc file elevation can be configured only through the Folder Path rule or the File Hash rule. [Learn More](https://www.manageengine.com/application-control/help/endpoint-privilege-management/epm-how-it-works.html#rule-type-extension-support)

## Configuration steps

Elevation for .bat and .msc files can be configured using either a Folder Path rule or a File Hash rule.

### Folder-based elevation

Use the Folder Path rule when the files are stored in a controlled directory, or if multiple files need elevation. Follow the steps below:

1. Navigate to **Privilege Management**. Click **Create Policy/Modify**.
2. Enable the toggle for **Configure specific application to run with elevated privileges**. The option **Allow users to elevate all applications** can also be enabled for end-users to self-elevate applications by providing a justification. Refer to [Privileged Application List configuration](https://www.manageengine.com/application-control/help/endpoint-privilege-management/epm-policy-creation.html#create) to learn more.
3. Choose to add specific applications for elevation. Under selecting specific applications, select the rule type **Folder Path**.
4. Specify the folder path containing the approved file(s). The elevation of child processes created by the folder files can be blocked by enabling **Restrict Child Elevation**.

![Folder Path rule configuration for elevating .bat and .msc files in Application Control Plus](https://www.manageengine.com/sites/meweb/images/application-control/images/folder-path-howto.png)

5. Save the list and [deploy](https://www.manageengine.com/application-control/help/endpoint-privilege-management/epm-policy-deployment.html) it to the target devices that should receive this elevated access. All eligible files, including .bat and .msc files, inside that folder will inherit elevation based on the policy.

### Hash-based elevation

Use the File Hash rule when only a specific .bat or .msc file has to be elevated. First, find the hash value of the file using Command Prompt or PowerShell.

> **Prerequisites:** Retrieve the file's SHA256 hash before creating the rule — using Command Prompt or PowerShell.

#### Using Command Prompt (CMD)

1. Open Command Prompt.
2. Navigate to the folder containing your file using the `cd` command (e.g., `cd Desktop`).
3. Run the following command, replacing *filename.bat* with your actual file name:

```bash
certutil -hashfile "filename.bat" SHA256
```

#### Using PowerShell

1. Open PowerShell.
2. Run the `Get-FileHash` command, replacing *C:\path\to\your\file.msc* with your actual folder path:

```powershell
Get-FileHash "C:\path\to\your\file.msc" -Algorithm SHA256
```

Now that the file hash is retrieved, follow the steps below to configure the policy for elevating the file:

1. Create the Privileged Application List as described in [configuration steps](https://www.manageengine.com/application-control/help/endpoint-privilege-management/elevate-bat-msc-files.html#configuration) above.
2. In the *Select Specific Applications* section, select the **File Hash** rule type.
3. Add the .bat or .msc file using the custom rule. Click **Add** under the rule type and specify the executable name and hash value of the file.
4. The elevation of its child processes can be blocked by enabling **Restrict Child Elevation** against the file.

![File Hash custom rule configuration for elevating a .bat or .msc file in Application Control Plus](https://www.manageengine.com/sites/meweb/images/application-control/images/hash-custom-rule.png)

5. Save the list and [deploy](https://www.manageengine.com/application-control/help/endpoint-privilege-management/epm-policy-deployment.html) it to the target devices that should receive this elevated access. This method is more secure, as elevation is tied to the file's unique hash, and the hash changes if the file is modified — the modified version will not be elevated.

## End-user implementation

Once the policy is deployed, it takes effect immediately or in the next refresh cycle. After policy deployment, the end-user can navigate to the file, right-click, and select **Run as Administrator**. The file will run with elevated privileges.

### Recommended best practices

- Prefer the Hash rule for high-security environments.
- Store elevated scripts in secured, non-user-writable directories.
- Regularly audit elevated scripts.
- Avoid broad folder-based elevation unless operationally required.
- Limit elevation to necessary administrative tasks.

## Related

- [Creating a privilege management policy](https://www.manageengine.com/application-control/help/endpoint-privilege-management/epm-policy-creation.html)
- [Deploying a privilege management policy](https://www.manageengine.com/application-control/help/endpoint-privilege-management/epm-policy-deployment.html)
- [Just-In-Time privilege elevation](https://www.manageengine.com/application-control/help/endpoint-privilege-management/epm-jit-access.html)