Frequently Asked Questions on Temporary Administrator Access
How to grant temporary admin access in Windows 11?
In Windows 11, you can grant temporary admin access by using LAPS or an Endpoint Privilege Manager. You must maintain a separate local admin account and manage the passwords using LAPS. You will be sharing your admin account’s credentials with the user who needs temporary admin rights. On the contrary, EPM works by modifying the local admin group by temporarily adding the user to the local admin group and removing them once the task is complete.
Between LAPS and endpoint privilege manager, which is the secure way to grant temporary admin access?
While Legacy LAPS and Windows LAPS involve the risky practice of sharing admin account credentials, EPM solutions temporarily add the user account to the local admin group and move the user back to the standard user group once the timer runs out.
Endpoint Privilege Managers are more secure than LAPS for granting temporary admin access
How to securely add a user to the local admin group on their computer temporarily?
You can add a user to the local admin group and remove them manually if you have the required permissions on the device or your Active Directory domain. However, it is very common to forget to remove the user from the local admin group. It is better to automatically demote the temporary admin from the local admin group.
How to automatically revoke admin rights after temporary admin access?
You can make use of an Endpoint Privilege Manager to automatically revoke admin rights after the time limit expires. The user will be removed from the local admin group automatically and will go back to the to which they group originally belong.
