Elevation lets EPM Windows run an application with administrative privileges on behalf of a standard user. EPM Windows offers three independent settings that enable elevation, and how they interact determines whether an application elevates on demand only, or automatically as soon as the user opens it.
Key concepts
- On-demand elevation: the user actively requests elevation, through the EPM Core interface or the application's right-click context menu.
- Automatic elevation: elevation happens without an explicit request, triggered by double-clicking the application icon.
How it works
- User can elevate applications (global parameter): allows elevation for all applications. When this parameter is enabled, elevation is always available on demand through the EPM agent or the context menu (right-click). To perform automatic elevation, the Enable Automatic Elevation global parameter must also be active.
- Enable Automatic Elevation (global parameter): allows elevation for all applications via double-click whenever elevation is permitted through the User can elevate applications global parameter or through the configuration in an access policy. This parameter is enabled by default.
- User can elevate applications (access policy setting): allows elevation for the applications listed within the policy. Just like the global parameter, elevation is available on demand through this configuration, and automatically when the Enable Automatic Elevation global parameter is also enabled.
When an application is covered by an access policy, the policy's own elevation setting governs it: the access policy takes priority over both global parameters, regardless of how they are configured. More information in [Permission](/go-endpoint-manager-windows-permission-1).
When to use it
- Enable only User can elevate applications when elevation should be available strictly on demand, through the EPM agent or the context menu.
- Also enable Enable Automatic Elevation when double-click elevation is an accepted convenience for your environment.
- Configure an access policy's elevation setting when a specific set of applications needs elevation behavior that differs from the rest of the environment.
Related topics
- System parameters - EPM: configure the global elevation parameters.
- How to configure application access policies for EPM Windows: configure the access-policy elevation setting.
- Running an application with EPM Windows: see elevation triggered while running an application.
- About EPM Windows access policies: general access-policy concepts and precedence between policies.
- UAC integration: a related on-demand elevation path through Windows UAC.
- Privilege elevation block: a separate parameter that blocks elevation outright.