Skip to main content

Removal of Admin Permissions - Remediation

  • Updated

Concept

When first onboarding a new Customer, or when rolling out the CyberQP Elevation feature, MSPs may want to discover and remove permissions from Users that should not have Elevated Permissions.

Coupled with the Elevation Feature Audit Mode, the removal of Admin permissions is the next logical step to ensure that your Customer's End Users are using Least Privilege.

 

Prerequisites

  1. Agents deployed to Customer End Points 
    How to install the Agent - Manual and Silent
    Using Pre-created Scripts
  2. Technician role higher than HelpDesk (HelpDesk Technicians are designed to "use" the Features, not configure them)

 

WARNING

Removal of Local Admins can create a scenario where the system cannot be managed if all Admin accounts are removed from the Administrators group.  Ensure you understand the entire scope of usage for this Feature prior to implementing it.

 

Discovery

  1. Click the Agents screen on the main Dashboard.
    1. All Agents for All Customers will be listed.  Filters for Customer Name, Role of the System, UAC Level, and Online/Offline Agent status will help you limit your actions to just the systems you wish to manage.
  2. We suggest implementing this on a Customer by Customer basis
    1. Set a Customer Filter to limit Agents that are installed for that Customer
  3. Once the Filter has applied, only the systems for that Customer will be shown.
    1. You can determine if you would like to further filter by system Role (for example if you want to only perform this action on AD Workstations, or Standalone Workstations)
    2. The Local Admins Column will show a quantity of Local Admins on that specific system.
      1. To view the members of the Local Administrators Group, click on the quantity Icon.
      2. The list of Local Administrators will be shown

         

Remediation

Administrative permissions can be removed in 2 ways:

Manual per system

In Bulk

 

Manual Remediation

 

2nd Warning - Removal of Local Admins can create a scenario where the system cannot be managed if all Admin accounts are removed from the Administrators group.  Ensure you understand the entire process for this PRIOR to actioning.

  1. Select the Local Admins Quantity icon for the specific system you want to remove Admin permissions for:
  2. The list of accounts that are CURRENTLY a member of the Local Administrators group are shown

  3. Click "Remove Privileges" in the upper right corner of that screen.

    Disclaimer

    NOTE: Accounts that are CURRENTLY imported to the Administrator Accounts or Service Accounts, and Just in Time accounts will NOT be removed from the Administrators Group.  

    If an End User account was imported to the Administrators Section of the Dashboard, because of the import process (or any other reason), you can now MOVE the account to the End User Account screen and THEN use this Bulk removal to ensure the account is removed from the Administrators Group.  

    Move Account between Sections - Change Account Type

    Ensure you refresh the list of Agents PAGE and reapply your filters after you move any accounts.

    NOTE: Domain Groups will ALSO be removed from the Local Administrator Group unless the toggle is enabled OR the Exclude box is populated with the name of an Account or Group that you want to remain a Local Administrator.
     

  4. Check boxes will appear on the left side - select the accounts you no longer want to be members of the Local Administrators group.

  5. Select the box to confirm you want to remove the accounts and click the Remove Button

     

 

Bulk Remediation

  1. On the list of Agents, select the checkboxes on the left side.
  2. Click the "Remove Local Admin Rights" along the Header.
  3. A screen will open to give you the opportunity to specify specific accounts you want to KEEP as Local Admins.  Non Specified Accounts and Groups will be removed.



    2nd Warning - Removal of Local Admins can create a scenario where the system cannot be managed if all Admin accounts are removed from the Administrators group.  Ensure you understand the entire process for this PRIOR to actioning.
     


Disclaimer

NOTE: Accounts that are CURRENTLY imported to the Administrator Accounts or Service Accounts, and Just in Time accounts will NOT be removed from the Administrators Group.  

If an End User account was imported to the Administrators Section of the Dashboard, because of the import process (or any other reason), you can now MOVE the account to the End User Account screen and THEN use this Bulk removal to ensure the account is removed from the Administrators Group.  

Move Account between Sections - Change Account Type

Ensure you refresh the list of Agents PAGE and reapply your filters after you move any accounts.

NOTE: Domain Groups will ALSO be removed from the Local Administrator Group unless the toggle is enabled OR the Exclude box is populated with the name of an Account or Group that you want to remain a Local Administrator.
 

  1. If the system is Active Directory joined, and you want to KEEP all of the Active Directory Privileged Group (see the list here) as members of the Local Administrators group, then 

    Enable the Toggle to Exclude those Groups.
     
  2. If there are Custom Active Directory groups you want to KEEP as members of the Local Administrators group, then populate the username or group names in the Exclude box. Click ADD to ensure the exclusions are listed below the box




    THIS IS A COMMA SEPARATED LIST.
  3. Click Remove Privileges Button
  4. A confirmation (one last chance to confirm you want the accounts removed) dialogue box will prompt you to confirm you wish to proceed.
  5. Because this is a Bulk Action and it may take some time to process this request on each machine a Banner will appear to indicate that the process has started and you can click on the "View Events" link to be taken to the Events list in a new Tab

NOTE: If an Agent is OFFLINE at the time of confirming the Bulk removal, they will be skipped.

If a Selected Agent is a Domain Controller (AD Server role) it will ALSO be skipped (Domain Controllers don't have Local Accounts).

 

Related articles

Comments

0 comments

Please sign in to leave a comment.