Elevated Access: Extended User Access Control session
Summary
Evo now has the ability for users of Elevated Access to enable a feature allowing for a longer session of Elevation for Windows User Account Control (UAC) that doesn't require additional prompts. This is available as of Evo Windows Agent version 2.1.15 (Released Oct 10th, 2024)
This also allows for control for elevation of Windows Services such as Command Prompt, PowerShell and some others. This does not include all Windows Features at this time. This will run .MSI files, most .EXE files, and .MMC files. It may not run some Microsoft Store applications elevated and is unable to change permissions on files/users.
This setting is configured on a per endpoint basis.
Enabling the feature
This feature is currently set by a registry key value. Navigate to HKEY_LOCAL_MACHINE -> SOFTWARE -> EvoSecurity -> EvoLogin-CP
You'll see the uac_extension value present at the bottom.
- 0 means the setting is disabled
- 1 means the setting is enabled but other credential providers are available (If Evo is not set as the sole proivder already)
- 2 means the setting is enabled and Evo is the sole provider during UAC prompts
end_user_elevation | uac_extension | UAC Evo Only (If Evo Sole Provider is not enabled) |
0 | 0 | No |
1 | 0 | No |
2 | 0 | Yes |
0 | 1 | No |
1 | 1 | No |
2 | 1 | Yes |
0 | 2 | Yes |
1 | 2 | Yes |
2 | 2 | Yes |
After the change is made you will need to restart the Evo Agent from the Evo Settings Editor (or services.msc)
You can also pass in the value via scripted commands. The PowerShell installer can also be updated with an additional variable for unattended installations
msiexec.exe /i EvoCredentialProviderSetup.msi UAC_EXTENSION=1Administration
When the setting is enabled, if a user tries to access an application that requires elevation, the same prompt will show for administrative access. When proper Elevated credentials are provided, an option will appear beneath the prompt for a time window.
If the setting is not selected you will just be able to approve that request as a one-off acceptance. If you select a window of time (5,10 or 15 minutes) you will be able to access additional administrative prompts without a prompt.
A message will appear in the top right of the screen showing a timer that the user has the ability to continue utilizing elevated applications without an additional prompt. That session can be terminated by simply selecting the option.
Please reach out to the Support Team with any questions!