CyberArk EPM is an agent installed on employees computers. This tool allows for the secure elevation of privileges for tasks that require it.

1 - Software Installation

With this tool, users can independently install Software pre-authorized by the IT Team as long as it is downloaded from official sources. 

1.1 - Authorized Software

Note: PRIMAVERA.LOCAL users should install Software from Software Center.

There are other development tools, specific components and frameworks that may not be on this list.

1.2 - Not Authorized Software

• Personal peripheral drivers and software (Mouses, Keyboards, Printers, Video Cameras, GPS, )

1.3 - Software that is not pre-authorized 

Whenever a user runs an application that is not pre-authorized or not properly signed, the next window will appear asking for justification.

If the application you are trying to install meets these requirements:

1 - Trust - The Software was downloaded from a trusted source and is duly signed.
2 - Licensing - The Software must be free for Commercial Use or the Company has Licensing.
3 - Updates - Software have regular updates and its not dependent on legacy components.
4 - Redundancy - A tool with similar functionality cannot exist in actual Authorized Software List (1.1).

If you have a valid justification, you must fill it in and click OK. Automatically, a ticket will be opened with your request, which will be analyzed by a support technician. The privileges to carry out the action will be granted to you if the is duly justified and meets security requirements. You will receive feedback and know that your request was authorized through the ticket.

2 - Request for Privileges

Whenever the user tries to perform a task in the Operating System that is not pre-authorized, a window will appear asking for a justification identical to that in section 1.2. 

If you have a valid justification, you must fill it in and click OK. Automatically, a ticket will be opened with your request, which will be analyzed by a support technician.

2.1 - MMC Snap-ins

Pre-authorized snap-ins are available from the Start Menu or Control Panel. Snap-ins that require Administrator privileges, such as Services and Machine Certificates, will be automatically elevated.
Mounting Snap-ins with elevation from the mmc.exe command is not allowed.

Other actions that require elevation in Snap-ins, such as Services, can be performed if the user opens the Snap-in as an administrator and then executes the actions.

2.2 - Registry

Import Keys that require elevation can be done if the user opens Regedit as an Administrator and then imports the key.

3 - Security Policies

This tool also validates the behavior of some applications and can block certain user actions.

Whenever CyberArk EPM blocks a task, the following Pop-Up is displayed on notification area.

Most of these situations are related to Browser Plugins or Office 365 Applications that are not properly Signed.

If the user receives this notification and is prevented from carrying out a relevant task, please report the situation via ticket.

4 - Scripts

Running Scripts as administrator from Windows Explorer is not allowed.

Alternatively, you can open a command line or powershell as administrator and then invoke the Script.

Script instructions that require administrator privileges are executed with elevation if rules exist.

If you have any problems executing Scripts please place a ticket on GLPI.