# Understanding Privilege Management

**Last Updated On**: 14 Jul 2026  
**5 minutes read**

A technical reference covering agent processes, scanning behavior, policy deployment mechanics, enforcement logic, and rule type support for EPM.

## Specifications of Agent Processes

Four background processes handle admin account scanning, elevation enforcement, notification, and configuration delivery.

### Agent process resource usage

| Agent Process | Running Application | Bandwidth | CPU | Memory |
|---|---|---|---|---|
| Admin Accounts Scanner | DRAdminUsers.exe | N/A | 0—1% | 1—5 MB |
| Process Notifier | AppCtrlToast.exe | N/A | 0—1% | 20 MB |
| ACP Privileger | Privilager.exe | N/A | 0—1.4% | 1—1.5 MB |
| Component Upgrade | dcconfig.exe | 3.5 MB | 0—1% | 1 MB |

## Admin Accounts Scan

How the agent identifies local administrator accounts on each endpoint.

### Recurring admin account scanning

After agent installation, a one-time scan runs to identify local administrator accounts using **DRAdminUsers.exe**. This scan focuses exclusively on local admin accounts and runs again during every subsequent 90-minute refresh cycle — ensuring the Admin Rights Summary remains current as accounts are added or removed.

## Policy Deployment: Agent-Server Synchronization

How EPM policies flow from the server to managed endpoints.

### Deployment options and refresh behavior

![Policy deployment flow diagram from server to managed agents](https://www.manageengine.com/products/desktop-central/help/images/ac-policy-deploy-hw.png)

*Policy deployment — immediate push or scheduled 90-minute refresh.*

When an EPM policy is created, **dcconfig.exe** delivers it via one of two options:

- **Deploy Immediately** — pushes the policy to currently online agents. For custom groups larger than 200 machines, the policy is applied to 200 machines first; the remainder follow in the next refresh cycle.
- **Deploy** — schedules the policy for the next 90-minute refresh cycle.

Policy modifications, deletions, group changes, and unmanaged application updates are all synchronized during refresh cycles. In environments with a Distribution Server, changes are replicated there first, then pushed to agents.

## Policy Enforcement, Removal, and JIT Workflow

How the agent applies elevation policies, revokes admin accounts, and handles time-bound JIT access.

### Policy enforcement in the agent

Once a policy is received by the agent, **VerifyTrustedFiles.exe** invokes **Privileger.exe** to elevate processes according to the deployed policy. Elevated application events are posted during the 90-minute refresh cycle and updated every 7 days.

### Admin accounts removal

When manual or automatic admin rights removal is configured, **DRAdminUsers.exe** carries out the removal of the specified local admin accounts on target machines during the next refresh cycle.

### Just-In-Time Access workflow

JIT policies grant time-bound elevation for specified applications. When a JIT policy is deployed, **VerifyTrustedFiles.exe** invokes **Privileger.exe** to elevate the processes on the target machine or for the target user. Elevated privileges are automatically terminated when the specified duration expires — no administrator action is required.

## Rule Type—Extension Support

Not every rule type applies to every file extension — consult this table when building elevation rules.

### Supported extensions per rule type

| Extension | Vendor | Product Name | Verified Executable | File Hash | Folder Path | CLS-ID |
|---|---|---|---|---|---|---|
| EXE, MSI | ✔ | ✔ | ✔ | ✔ | ✔ | ✗ |
| MSC | ✗ | ✗ | ✗ | ✔ | ✔ | ✗ |
| BAT | ✗ | ✗ | ✗ | ✔ | ✔ | ✗ |
| COM Components | ✗ | ✗ | ✗ | ✗ | ✗ | ✔ |

## Related

- [Endpoint Privilege Management overview](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-overview.html)
- [Create EPM policy](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-creation.html)
- [EPM policy deployment](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-deployment.html)
- [JIT access for privilege elevation](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-jit-access.html)