Self-Service Privilege Elevation for Windows and Windows Domain

PAM360 empowers administrators to configure Self-Service Privilege Elevation on target machines, enabling end-users to execute specific files or applications (.cmd, .exe, .msc, .msi, and .bat) with elevated account privileges, without ever disclosing the credentials of the privileged account. Refer to this document to learn more about the Self-Service Privilege Elevation in PAM360.

Refer to the following links to know more about configuring the Self-Service Privilege Elevation in Windows and Windows Domain based environments:

1. Setting Up Self-Service Privilege Elevation
2. Managing the Self-Service Privilege Elevation Configuration
3. Elevating Privileges Using Self-Service Privilege Elevation
4. Troubleshooting Tips

1. Setting Up Self-Service Privilege Elevation

Follow the below steps to configure Self-Service Privilege Elevation for Windows or Windows Domain resources:

1. Log in to PAM360 and navigate to Admin >> Privileged Elevation >>Allowed Apps/Scripts. Here, you can view the list of all applications currently added for privilege elevation.
   
2. To register a new application or file, click Add.
3. In the Allowed Apps/Scripts dialog box that opens, provide the following details:
   1. Application Name: A user-friendly name for the application.
      
   2. Application File Name: The exact filename on the privileged resource with its extension (e.g., .exe, .cmd, .msc, .msi, .bat).
   3. SHA256 Hash Value: The cryptographic hash of the application file. Learn how to obtain it or use this application to generate it.
4. Click Save to finalize the application registration.
   
5. Now, navigate to Resources >> All My Passwords >> Resources to associate the application or scripts with the privileged resource.
6. Locate the desired resource for which the Self-Service Privilege Elevation to be configured. Click the Action icon next to it and click Configure >> Self-Service Privilege Elevation.

   Caution

   Ensure that the DNS name of the resource is specified. The configuration cannot proceed if it is left blank.

   
7. In the pop-up configuration window, choose the Account Type:
   
   1. Domain Account: Select both the Domain Name and Account Name to allow privilege elevation via a domain account.
      
   2. Local Account: Select the Account Name of the privileged local account.
      
8. Under Allowed Apps/Scripts, list the applications that users are permitted to launch with elevated privileges. Examples include: cmd.exe, services.msc, etc.
9. Click Configure to apply the configuration.
   

Once configured, the selected account will be used for privilege elevation across all agent-installed endpoints. When Access Control is enabled for an account, Self-Service Privilege Elevation will take precedence over password-based access control.

2. Managing the Self-Service Privilege Elevation Configuration

1. To remove the privilege elevation configuration for a resource, click Clear in the Self-Service Privilege Elevation configuration pop-up.
   
2. To delete a previously registered application, navigate to Admin >> Privileged Elevation >> Allowed Apps/Scripts, select the relevant applications, and click Delete.
3. To view a list of resources with Self-Service Privilege Elevation configured, go to Reports >> Query Reports >> Resources, and search for Resources with self-service privilege elevation configuration. Two custom reports are also available under Reports >> Custom Reports: Authorized App Privilege Elevated and Unauthorized App Elevation Triggered. These reports help administrators monitor and audit all privilege elevation activities across the network.
   

3. Elevating Privileges Using Self-Service Privilege Elevation

Once Self-Service Privilege Elevation is configured, users can self-elevate privileges by following the steps below:

1. Initiate a remote session and log in to a resource where Self-Service Privilege Elevation is enabled via PAM360.
2. Right-click the desired application or file (e.g., .exe, .msc, .msi, .cmd, .bat) that has been authorized for privilege elevation and select Run as PAM360 Privileged Account.
   
3. In the pop-up that opens, provide a mandatory reason for the elevation request and click Elevate.

The selected application or file will now run with elevated privileges, as defined by the administrator.