Admin By Request

Admin By Request End User

Quick Start Guide
(Windows Workstation with UAC Confirm Mode)

INTRODUCING ADMIN BY REQUEST

A new tool called ‘Admin By Request’ will soon be deployed to your computer. Admin By Request is a compact, low
resource application which enables enhanced management of Local Admin Rights, on a ‘Just In Time’ basis.

WHY IS ADMIN BY REQUEST NEEDED?

Admin By Request has two major benefits:

1) Increased Productivity

You may have found in the past that you were not able to
install / update software or access a certain part of
Windows because you did no possess sufficient ‘Local
Admin Rights’.
You might be familiar with the Windows ‘UAC’ login screen
(right), which requires someone who possesses
Administrator rights to enter their own details on your
computer, in order to enable you to complete the task.
Before Admin By Request, to get admin tasks done it was
necessary to call the IT Helpdesk and wait for someone to
remotely join your computer in order to entire the
administrative login details.
Once Admin By Request is active on your computer, your IT
department will be able to grant you permission to run
specific applications or tasks that require Admin Rights,
without the need for you to call someone and wait for a
remote session. There is a double productivity gain here,
not only for you but also for the IT helpdesk, as their time
will be freed up to work on other cases.

2) Increased Security

For those users that already have permanent Local Admin rights, Admin By Request provides a significant benefit by
enabling Local Admin use ‘Just In Time’ with very minimal impact on day to day work routine.
You will continue to work just as before, the key difference being that admin rights are only activated for a specific task,
or time period. By minimising the amount of time people spend as Local Administrators, this will dramatically reduce
computer ‘attack surface’ if a malware threat were ever to get inside the business.
Admin By Request will therefore help keep you and your colleagues safe from cyber threats that typically depend on
admin rights to spread from one computer to another.

Admin By Request www.adminbyrequest.com Page 1

 Admin By Request
Admin By Request End User
Quick Start Guide
(Windows Workstation with UAC Confirm Mode)

HOW DO I KNOW THAT I HAVE ADMIN BY REQUEST?

Admin By Request is a tool which requires minimal user interaction,
so it’s quite possible you have already been given the software,
without you noticing!
To tell if Admin By Request is running on your system, click on your
system ‘Taskbar’ and look for the Admin By Request icon.

ADMIN BY REQUEST ICON COLOURS

Depending on your configuration, the Admin By Request icon colour may be different.

Admin By Request is installed and fully active.

Admin By Request is installed but set to ‘learn’ more about elevation activity (Learning
Mode). Admin By Request is not ‘active’ in this mode.

Admin By Request is installed and you are logged in as a permanent Administrator. Like
with Learning Mode, Admin By Request is not ‘active’ in this mode.

WHAT IF I AM OFFLINE? WILL I STILL BE ABLE TO ELEVATE APPLICATIONS?

Admin By Request works both online and offline, in some configurations there is no difference in functionality. Where
you are required to obtain manual approval, you will be presented with an ‘Offline notice’ which will request you enter a
PIN code. PIN codes are covered later in this guide.

ADMIN BY REQUEST IS ACTIVE ON MY SYSTEM WITH A GREEN ICON.

HOW DO I USE IT?
Admin By Request works differently depending on what features your IT Department has enabled for you. Different
staff might need different Admin By Request capabilities, depending on their role.
There are three different techniques to run applications and tasks as Administrator with Admin By Request:

1) Run As Admin Mode

You should be very familiar with this mode because it works
exactly like standard Windows in that you simply right click on
a file to install / run and click ‘Run As Administrator’. You will
notice that with Admin By Request installed, you will now see
a small Admin By Request ‘tick’ logo in place of the Windows
admin shield.

Admin By Request www.adminbyrequest.com Page 2

 Admin By Request
Admin By Request End User
Quick Start Guide
(Windows Workstation with UAC Confirm Mode)

Run As Admin mode is designed to be used on a per

application basis, typically you elevate one application a
time with this method. Depending on your Admin By
Request settings (set by your IT department) you might
be able launch a file without needing to make any further
inputs apart from clicking ‘OK’, you might be asked to
provide a reason for running the file as admin, and in
some cases you might be asked to wait for someone to
manually approve your elevation request.

If approval is required, you will need to wait for the

request to be processed by your IT department.

The result will come back via email and a pop-up box on
your computer with either an ‘approved or ‘denied’
message. Once a request has been approved you do not
need to use it right away, the approval will be active for a
maximum of 14 days before expiry.

2) Tray Tools
Located in a menu via the Admin By Request tray icon,
your IT team might provide you with ‘shortcuts’ we call
‘Tray Tools’. Common Tray Tools will allow you to launch
Device Manager, add printers and change network
settings, just as if you were an administrator. You might
find additional custom commands provided here by your
IT department.
Note: If when using Tray Tools you come across a
windows UAC ‘login box’ it is possible your computer
needs a Windows 10 update in order for Tray Tools to
function properly. Please contact your IT department
for assistance.

Admin By Request www.adminbyrequest.com Page 3

 Admin By Request
Admin By Request End User
Quick Start Guide
(Windows Workstation with UAC Confirm Mode)

3) Administrative Session
The third means of using Admin By Request to gain
admin rights is to request an ‘Administrative Session’.
This is invoked either by the Admin By Request desktop
icon (if enabled) or on the Admin By Request Tray Icon
‘Request Administrative Session’.

An Administrative Session is different from ‘Run As Administrator’ mode in that a timer appears and during that amount
of time you will be able to run multiple applications as Administrator until the timer ticks down to zero.

Note: Check with your IT team if Admin By Request is

configured to close applications you have elevated with
Admin By Request when the session time runs out.
If you need to perform a reboot during an Administrative
Session, you should keep your session running. When
your computer comes back up and you log back in, the
session will automatically resume where you left off.
As with Run As Admin, depending on your Admin By
Request settings, you might be able to launch a session
without needing to perform any additional inputs, you
might be required to write in a reason to explain why you
need to start the session, and you might also be required
to wait for manual approval.
If your IT department has disabled the Administrative
Session feature, you will get a denied error when
running it.

MALWARE DETECTION ON ELEVATION

Your IT department may have enabled a powerful Admin
By Request feature that checks a database of up to 20
security software vendors every time you elevate a file.
As the check is a simple hash lookup it is not at all
resource intensive and will not interfere with your
existing antivirus endpoint solution.
If when you attempt to elevate a file, the database check
comes back with the file being marked as suspicious or
malicious a safeguard will prevent you from running the
file. You will see a red warning message and an alert will
be sent to the workstation security team.
Depending on your Admin By Request configuration your
Administrative Session may be terminated along with all
applications elevated with it.

Admin By Request www.adminbyrequest.com Page 4

 Admin By Request
Admin By Request End User
Quick Start Guide
(Windows Workstation with UAC Confirm Mode)

PIN CODES
There are four areas of Admin By Request that may require
PIN codes to be entered

1) Offline Mode (when manual approval is required)

If you require manual approval to run an application or task
and you happen to be offline, Admin By Request will not
able to send this request out. In this scenario Admin By
Request will detect you are offline and request a PIN code
for your task to complete. To obtain a PIN code you will
contact someone in the IT department who will then ask
you for you ‘PIN 1’. After you provide the PIN 1, you will then
be given PIN 2 which will enable you to complete the
elevation task.

2) Enable Administrator Session PIN

If your IT department has disabled Administrator
Session mode, you will get a message telling you that
the feature has been denied by policy when you try to
launch it.
On this prompt you are also asked if you have a PIN
code, where you can follow the PIN 1 / PIN 2
procedure in order to start an Administrative Session.

3) Blacklisted application
Your IT department might decide to block specific
applications from being elevated with Admin By Request. If
you attempt to launch an application that is blacklisted, you
will be presented with an error / deny message and a link to
submit a PIN code (if enabled).
As with the offline approval PIN, you will need to give your
IT department PIN 1 and they will provide you with PIN 2 in
order to allow you to execute the blacklisted file.

4) Uninstallation PIN
If it’s decided that you need to uninstall Admin By
Request, your IT department can provide you with an
uninstallation PIN code. This PIN can only be used
once, and on entering it into Admin By Request > Tray
Icon > About > System, Admin By Request will be
immediately uninstalled.

Page 5
 Admin By Request
Admin By Request End User
Quick Start Guide
(Windows Workstation with UAC Confirm Mode)

TROUBLESHOOTING AND
DIAGNOSTICS
In the unlikely event of a problem with Admin By
Request, there are a couple of actions your IT Helpdesk
may ask you to perform in order to help them isolate
the root cause of the issue.

To check Admin By Request is functioning correctly,

and that there are no connectivity issues, you can
navigate to:
> Admin By Request Tray Icon > About Admin By
Request > Connectivity.

If more information is required about an Admin By

Request issue, you might be asked to send some
diagnostics. To send diagnostics you will need to
navigate to:
> Admin By Request Tray Icon > About Admin By
Request > Diagnostics.
Hit submit on this page to send through a fresh set of
diagnostics.

SUMMARY
Admin By Request is an important component in our IT strategy; it will help us increase staff productivity whilst enabling
us to better combat the latest cyber threats.
We appreciate that for some, the loss of permanent Admin Rights might be a concern. To this group of people, we would
like to assure you that it is our aim to ensure that you will be able to go about your work as before but do so with far less
risk.
Once the solution is fully deployed, we expect you will also notice a positive reduction in IT helpdesk response times, as
the helpdesk team will no longer be tied up assisting users with Local Admin rights related issues.

Admin By Request www.adminbyrequest.com Page 6