AdminOnDemand 2.0 released September 9, 2022 - Document updated September 9, 2022
Description
AdminOnDemand allows standard users without local administrator permissions to execute EXE and MSI files with elevated privileges.
Session Elevation
If you want to use session elevation, you need to enable it in the “Security” section.
Afterward, you must specify the users and/or groups that are allowed to use session elevation in the “Validation” section.
Users and/or groups that are not allowed to start a session elevation can still start a process elevation through the right-click menu
The process elevation rules are not effective during session elevation, unless process elevation is used.
Process Elevation
When users want to execute a single process with elevated privileges, all they have to do is right-click the process and select “Run as AdminOnDemand”
If Informational Text is enabled it will be presented to the user.
If Confirmation Text is enabled it will be presented to the user and must be confirmed before proceeding.
Prerequisites
User Account Control
User Account Control: Run all administrators in Admin Approval Mode must be Enabled
GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode
REGDB: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\<EnableLUA>:1 (REG_DWORD)
User Account Control: Behavior of the elevation prompt for standard users must be Prompt for credentials or Prompt for credentials on the secure desktop.
GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users
REGDB: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\<ConsentPromptBehaviorUser>:1 or 3 (REG_DWORD)
If User Account Control is disabled, an “access denied” message is presented.
If User Account Control is enabled, but not configured correctly, a “blocking” message is presented.
Process Elevation Rules
Child Processes
All applications that use the Windows Command Prompt (cmd.exe) rely on the Console Window Host (conhost.exe) process to interact with other Windows components.
As an example, the Console Window Host makes it possible to drag and drop files and folders from Windows Explorer to Windows Command Prompt.
It is not uncommon to see multiple instances of the Console Window Host in the Task Manager.
PowerShell and Command Prompt both rely on the Console Window Host. As a result, you need to either allow all child processes (default) or specifically conhost.exe when you create a process elevation rule that allows powershell.exe or cmd.exe
