# Frequently Asked Questions (FAQ) **Last Updated On**: 27 Jul 2026 **9 minutes read** ## Endpoint Privilege Management ### What is Endpoint Privilege Management? [Endpoint Privilege Management](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-overview.html) is the process of allocating application-specific privileged access to users based on their requirements. You can easily adopt the principle of least privilege throughout your network without affecting productivity using this feature. It enables privileged access to applications without compromising privileged credentials or causing unnecessary privilege elevation. ### Does Privilege Management apply to Admin users? No. Privilege Management applies only to Standard users. Admin users have full administrative access and are not subject to privilege-based restrictions. ### When should I enable application level privileged access to users? Using the [Endpoint Privilege Management](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-overview.html) feature, you can elevate application-specific privileges of certain users without compromising privileged credentials or elevating their entire organizational-level privileges. ### What is the significance of the 'Run as Endpoint Central MSP' option that is displayed in the File menu of a few applications? The **Run as Endpoint Central MSP** option is displayed to standard users whose endpoints were added to Custom Groups associated with the Privileged Application List during policy deployment. By selecting this option, standard users can run applications as administrators without entering extra credentials, while still remaining standard users with minimum privileges. ### I added an application to the Privileged Application List in the Privilege Management module, however it is not being elevated when run. Why is it so? These are the suggested resolution techniques: - Only allowlisted applications can be elevated, even if present in the Privileged Application List. Check whether the application in question is allowlisted to the target user-device. - Ensure that you have checked **Yes** for the *Associate Privileged Application List* option during policy deployment. - Only standard users can access applications with elevated privileges using the **Run as Manageengine** option. Other administrators must use their credentials as usual, even if the Privileged Application List is associated with them. Lowering their privileges to standard user type can remedy this. - Modify the Privileged Application List by enabling elevation to **All allowlisted application**. This might act as an intermediate fix. Also try testing elevation of other applications on the endpoint to assess the extent of the issue. - If nothing works, upload the agent logs from: `C:\Program Files (x86)\DesktopCentral_Agent(or UEMS_Agent)\logs` Specify whether the issue occurs with a single application or all applications to help resolve it faster. ### How does the elevation of applications using the Endpoint Privilege Management feature work? Allowlisted applications added to the Privileged Application List can be accessed with elevated privileges by user devices present in the custom groups associated with them. Even standard users can access applications as administrators using this feature, as it elevates privileges specific to the application and not the user. ### Will an application added to the Privileged Application List and associated to a Custom Group during policy deployment execute in the target machines if they aren't allowlisted to them? No. They must be allowlisted to execute. ### How does application elevation work when all allowlisted applications or specific applications are selected? If elevation is enabled for all allowlisted applications, or specific applications are selected with the **Allow users to elevate all applications** option turned on, those applications can be elevated directly without additional justification. Other applications can be elevated only after providing a reason. ## Removal of Admin Rights ### What are local admin accounts? User accounts on computers can be classified as standard user accounts and local admin user accounts. Local admin accounts enable users to perform management activities on their local computers, whereas standard user accounts grant minimal to no management privileges. Capabilities of local admin accounts include: - Installing and uninstalling any software - Adding or removing devices like printers - Creating, deleting, or modifying files, folders, and other computer settings - Creating accounts for other users on the computer ### What are built-in administrator accounts? Windows machines come with built-in administrator accounts. They can be used to initially set up other standard user and local admin accounts. These accounts have privileges similar to local admin accounts. However, unlike local admin accounts, they cannot be deleted from the machine—only disabled. ### How can a new administrator account be added to a machine where all local administrator privileges have been revoked? If all local administrator rights have been removed from a machine, a new administrator account can be added using the Endpoint Central MSP console: 1. Navigate to the Endpoint Central MSP console → **Tools** → **System Manager**. 2. Click the agent live status icon and select **System Manager** (this option appears only when the agent is live). 3. Select **Groups** → **Administrators**. 4. Add the members. You can verify the addition of the administrator account using either of the following methods: - Open Command Prompt and run: ``` net localgroup Administrators ``` This lists all administrators. - Open Windows Run and type: ``` lusrmgr.msc ``` Go to **Groups** → **Administrators**. The added member will be listed under the Administrators group. ![Admin View](https://www.manageengine.com/products/desktop-central/help/images/local-admin-view.png)