Using Admin By Request for Software Installation and Local Administrator Sessions (Power Users)

Summary

Admin By Request (ABR) Power User access allows approved users to perform administrative tasks on designated devices without requiring full-time local administrator rights. When elevated privileges are needed, users can launch applications with administrator permissions through ABR while maintaining security controls, auditing, and visibility.

Scope

This article applies to users and devices that meet both of the following requirements:

• The user is a member of the ABR_Power_Users Microsoft Entra ID group.
• The device is a member of the ABR_Power_Users_Devices Microsoft Entra ID group.

Users or devices that do not meet both requirements will not be able to use the Power User functionality described in this article.

Guidelines or Steps

Option 1: Run an Application as Administrator

1. Locate the application or installer you wish to run.
2. Right-click the application.
3. Select Run as Administrator.
   
    
4. Click on Yes when prompted by Admin By Request User Account Control to approve the elevation request.
   
   
    
5. The application will launch with administrative privileges.
   
    

Option 2: Start an Administrator Session

1. Click the Admin By Request icon in the Windows system tray.
   
   
    
2. Select Request administrator access 
   
   
    
3. Select Yes when prompted.
   
   
    
4. An Admin Session window with a timer will appear on the bottom right corner for the the approved duration of 3 hours (180 minutes).
   
   
    
5. The elevated session will automatically expire at the end of the 3 hours window, however, to end the session early, click on the Finish button on the timer window and select Yes on the prompt.
   
   
   
   
   
   
    

Important Notes

• Prefer Run As Admin wherever possible. Because it only elevates a single process, its scope is limited and any compromise during that process does not expose the entire endpoint.

• Use Admin Session when the task is genuinely open-ended, when multiple applications need elevation in sequence, or when an application does not work within Run As Admin's interception model.

• Administrative privileges should only be used when required to perform business-related tasks.

• All elevations and administrator sessions are logged and audited.

• Elevated access is temporary and subject to organizational security policies.

• If you are unable to elevate an application or start an administrator session, verify that both your user account and device are assigned to the appropriate ABR groups or contact the Service Desk for assistance.
   

Support

If you encounter issues using Admin By Request, contact the Service Desk at 402-280-1111 and provide:

• Your device name
• The application you are attempting to run
• Any error messages or screenshots received