Background

This article provides a walkthrough on End-User Elevation (EUE) in CyberQP, covering how end users submit elevation requests, how technicians review and approve them, and how the elevation is activated and completed.

Pre-requisites

• End-User Elevation enabled by your Account Rep
  Contact your Rep
• CyberQP dashboard configured for elevation
  Configuring End-User Elevation
• Technician-level access to the customer and end-user accounts
• UAC prompt set to any value higher than "Never Notify"
  

Table of Contents

• Background
• Pre-requisites
• End-User Elevation Usage
• Submit an Elevation Request
• Review and Approve or Deny a Request
• Cancel an Elevation Request
• Activate and Complete the Task
• FAQs

End-User Elevation Usage

Submit an Elevation Request

1. Using end-user account credentials imported into one of your enabled customers, sign in to a supported system type: Active Directory Member, Active Directory Workstation, Server, or Workstation.
2. Run an executable that triggers the UAC prompt (for example, an Acrobat Reader or Notepad++ installer).

3. Observe the UAC prompt — a Request Admin Access section appears. 

4. Fill in the Reason field and click OK.
   NOTE: The end user can also submit an elevation request from the system tray icon.
   

Review and Approve or Deny a Request

Approve or deny elevation requests from either the CyberQP dashboard or the QTech app.

1. To approve or deny from the QTech app, see QTech App: End-User Elevation Requests.
2. To approve or deny from the CyberQP dashboard, navigate to your tenant sidebar and select Elevation Requests, or click Active Requests from the main dashboard page.
   • An email notification is sent to the configured address(es). See Configuring End-User Elevation.
   • Click the link in the email to go directly to the Elevation Requests page.
     
3. Review the pending request at the top of the page.
4. Click the request, select a Duration, then click Approve.
   Once approved, the request status changes to Awaiting User Activation.
   

Cancel an Elevation Request

1. To cancel an approved request in Awaiting User Activation status, click the Cancel icon in the request header, or open the 3-dot menu and select Cancel. 

   

2. To cancel an active Process Elevation, locate the request in Active status and use the same Cancel options. 

   

NOTE: User Elevations cannot be cancelled once activated by the end user. Only Process Elevations support cancellation in Active status.

Activate and Complete the Task

1. Activate elevation via the desktop notification or the email link.
   NOTE: The email link and the elevation tray icon both open in the end user's default browser. Ensure the end user is using a modern browser.
2. Once activated, the end user is added to the local Administrators group and the countdown timer begins.
3. Run the application or make the system change. Because the current session is not elevated, enter credentials in the Username and Password fields when prompted.
    
4. NOTE: Only the launched process runs with elevated permissions. Each administrative action during the elevation period requires the end user to enter their credentials.
5. When finished, click Finish Now in the lower-left corner of the screen, or allow the timer to expire.
   
6. When the timer expires or Finish Now is clicked, permissions are removed from the local Administrators group. Close the confirmation pop-up with the X. Any additional elevation requires a new request.
   
7. Confirm the request has moved to the Completed Requests section on the CyberQP dashboard.
   

FAQs

• What happens if an end user logs out or reboots while the account is elevated?
  • The end user is logged off with a warning timer after the elevation timer runs out. This ends the elevated session and removes admin privileges.
• What happens if the system shuts down or the agent goes offline before the timer runs out?
  • Removal of admin privileges is retried when the agent comes back online, following the same process to ensure the end user is no longer an administrator.
• Will CyberQP support process-based or digital signature-based elevation?
  • Future updates to the elevation suite will include process whitelisting via digital signature.
• How long is an elevation request email link valid?
  • A request from an end user to the MSP is valid for 24 hours.
  • An approved request from the MSP to the end user does not expire.

end of article