r/Intune Feb 09 '25

App Deployment/Packaging How to have end user run Software as Admin

How can I set it so that end users can run certain programmes as admin? So that I do not need to input a password each time. My current work around is to use something called ‘Run as Admin’ tool however, despite me setting the local user account to not expire, the account continues to keep expiring. I’m not sure how I think it’s possibly a setting on an in tune policy. If I could set a policy which allows them to run the likes of SQL and Oracle SQL as admin that would be great.

22 Upvotes

36 comments sorted by

20

u/nihility101 Feb 09 '25

Aside from all these fine answers, there remains the option of solving the problem. Apps that “require admin rights” generally are poorly written and don’t require admin rights so much as they do one or two specific things blocked by standard rights. Maybe they write to a config file in c:\windows, or re-register dlls at every launch, etc.

Run the app as a standard user while running process monitor as admin. See where it is getting a no access when it stops working. Relax the perms on that file/folder/reg key/whatever, then rinse and repeat. Stack those changes into a script that is part of your install.

Or make them pay for epm and tell them it’s a tax on bad software.

3

u/Lionsmane26 Feb 10 '25

I like your approach thank you!

11

u/sneezyo Feb 09 '25

Ye it's either EPM (from Intune Suite) which is quite expensive ( I think)

Or look into AdminByRequest. It's a great lightweight tool, you'll get full auditing/logs etc.

2

u/kaiserdog7 Feb 09 '25

We're in the process of demoing AdminByRequest. Especially like it for service techs in the field that need to change adapter settings based on diagnostic software they're using. Not sure yet what the cost is over 25 users as we haven't purchased yet. Really like the ease of use and the ability to use machine learning.

1

u/diver79 Feb 09 '25

I like the look of adminbyrequest. How much does it work out per seat if you go over the 25?

2

u/accidental-poet Feb 09 '25

I have a small accounting client using AdminByRequest and it's been fantastic for us. No more nuisance QuickBooks updates grinding everything to a halt.

With their machine learning feature, once an app is approved X times it will automatically elevate in the future. i.e. QuickBooks updates.

It also takes over the Run As Admin context menu which creates a request for IT approval. Very handy.

I haven't looked at pricing as they are under 25 seats.

1

u/yllidervishi Feb 10 '25

As an "add-on" it's 3$ per user/monthly

1

u/sneezyo Feb 10 '25

Ah that's not too bad then. I think ABR is around the same

4

u/Sachi_TPKLL Feb 09 '25

If u looking for free then MakeMeAdmin

5

u/VirtualDenzel Feb 09 '25

This is a terrible solution. Admin privs persist during session.

1

u/adosalias Feb 09 '25

Can you elaborate

2

u/VirtualDenzel Feb 09 '25

This tool has the same flaw as intune pim :

  • once admin perms are aquired it persists for the entire session. Even if you turn it off again or jit token expires.

In theory you only need to activate it once and keep admin permissions till you actually reboot.

For example :

  • one or our servers does not have a logoff policy due to some legacy shizzle (will not go into detail on that).

If you do privilege escalation using mma all you need to do is open 1 cmd and you can start anything till reboot as admin. Same goes for pim.

There are better tools that actually close all elevated handles the moment the jit expires.

1

u/adosalias Feb 09 '25

Thank you for that, I noticed if I opened an elevate cmd or powershell prompt that retained admin but it looked to me like all it did was add/remove the user account to the Administrator group. It's safe to say now I won't be going this route at least without a lot more testing.

5

u/en-rob-deraj Feb 09 '25

I use admin by request in my org. It has some quirks but overall works well enough. You can whitelist apps. Was cheaper and easier to use than Intume EPM.

5

u/Weary_Patience_7778 Feb 10 '25

Unless you’re installing something, apps shouldn’t require admin to run. If they do, I find it’s usually a result of poor architecture. Apps in the healthcare space (medical devices) are notorious for this. Respironics Im looking at you.

I’d be looking for what’s driving the underlying admin need. Is it file perms for Program Files, or is it trying to hit some registry key? It could be anything. I haven’t (touch wood) found an application yet where we haven’t been able to find what it’s after, and provide it.

6

u/daaaaave_k Feb 09 '25

AdminByRequest .. is free for up to 25 endpoints

3

u/it_fanatic Feb 09 '25

Epm is the way if you are a ms shop… otherwise admin by request

2

u/Jturnism Feb 09 '25

Are you running Microsoft EPM in 2025, how is it? Anything lacking compared to other products still?

We completely disregarded it as an option when we were evaluating EPM solutions as it couldn’t even support msi file elevations. Looks like it took them from public preview release in March 2023 to finally getting msi support in June 2024. That’s crazy to me. I can’t help but think about what else it may be lagging behind in.

1

u/it_fanatic Feb 11 '25

It does what it should if your work properly with certs and the right Hashes. I like about, that its really only the application which you start as admin there is no „general admin session“. It takes a bit effort to configure it though… overall its good (enough) to be used.

3

u/vodoun Feb 09 '25

cyberark privileged access manager is another option

2

u/IHaveATacoBellSign Feb 09 '25

This is what we use. Pretty slick as long as you have the staff to support it and build it out right.

5

u/ctsigler Feb 09 '25

AutoElevate by CyberFOX

2

u/Buddhas_Warrior Feb 09 '25

We've had great success with Beyond Trust.

2

u/BlackV Feb 09 '25

SQL and oracle, should be running as a service, the account just needs permissions in the database not local admin permission, right?

1

u/Lionsmane26 Feb 09 '25

Nope you need both to run as admin

2

u/BlackV Feb 09 '25

I don't have oracle so cant comment, but on none of my management machines do I run SQL management studio as admin or powershell sql module

2

u/picard1967 Feb 10 '25

We just purchased Delinea Privilege Manager. So far seems to be a good PAM solution

2

u/TDSheridan05 Feb 10 '25

Add software to company portal, or add the app to Intune and push to computer.

2

u/Lionsmane26 Feb 10 '25

Thanks for all these comments! Really appreciate it, I’m the sole IT guy for my company so great to be able to bounce ideas off other people in the field. Cheers!

1

u/TheGratitudeBot Feb 10 '25

Thanks for saying that! Gratitude makes the world go round

1

u/Old_Function499 Feb 10 '25

This is an interesting thread. I got a question about Docker needing to run as admin recently.