Elevated Permissions for Windows University Managed Desktops (UMDs)
- James Tortoise
This page documents how elevated permissions are requested via a HALO request, and how you then elevate your permissions if your request has been approved. User access is allocated using Endpoint Privilege Management (EPM) which allows anyone with standard permissions to elevate their rights to install or run applications with administrative rights. It does not replace local administrator rights. It also does not change organisationally managed settings of filesystem permissions.
Pre-requisites
You must be using a Windows UMD device
You must be the primary user of the device
Check your device is correctly categorised in the Company Portal because the EPM group the user is added to in Blue Toolkit must match the device category assigned in the Company Portal.
to check this, Open the Company Portal, click, Home, THIS DEVICE and under Device information confirm what is set for the Device Category
Log a Request for Elevated Permissions
If you not already done so, use this Request Form to log your request in Halo Clinical School Computing Service User Portal - Elevated Permissions - UMD
You will need to complete details of the contact, UMD Number, Serial Number, Operating System, how long required, purpose of the request and some justification.
For How Long, there is a drop-down with 3 options: Temporary, Short-Term and Indefinitely. We realise most will select Indefinitely but we are hoping people will be sensible and if they only need the elevated permissions for a short period of time (1 minute to 7 days for example), they will select Temporary. Short-Term is say 3 months
Purpose of the Request, there are currently 5 options from a drop-down list, these may increase over time
Justification - we expect some detail to be added here why elevated permissions are required, the more information the better as it will provide us with the necessary information to process the request. Additional permissions are not a right but are granted based on need and adherence to the specified rules. If your request is denied, the CSCS Service Desk will communicate this through the request you will have raised.
How to Elevate Permissions
You must have been granted elevated permissions by the CSCS Service Desk via your Halo request before you follow the below instructions.
Find the application you want to run by navigating to the appropriate folder e.g. C:/Program Files/Notepad++
This can also be achieved by right-click the App icon and select “Open File Location”
NB it is advisable to turn on File Extensions as shown below which allows you to easily identify the file type
Right-click on the executable
Select Run with elevated access
If at this stage you see the below error message, it means elevated access has not yet been allocated. Please contact the CSCS Service Desk for assistance either by calling 01223 336261 or updating the Halo request you raised earlier. The self-service portal can be found here: https://itsupportcscs.haloitsm.com/portal/home
Enter your business justification and click “Continue”. The better quality and comprehensive justifications will be used to create rules so the next time you perform the same action you will not be required to authenticate or enter a justification.
NB it is worth copying your business justification because you will need to enter it each time you elevated permissions for the same application
Authenticate the action with the account running the elevation and click OK.
Further Reading
Elevated permissions for University Managed Desktops (UMDs) | IT Help and Support