Take admin rights off laptops without slowing anyone down
Admin rights make it much easier for malware and mistakes to do serious damage. We remove everyday admin access and give people a safe way to get what they need.
- Works with
- Delinea Privilege Manager and Secret Server, Intune Endpoint Privilege Management, Windows LAPS, Jamf Pro, Addigy
- Devices
- Mac and Windows
- You receive
- An admin rights report, elevation rules and a rollout plan
Why everyone ended up with admin rights
In many companies most staff have admin rights because it once made software installs easier. It also means one wrong click can install malware, switch off security tools or change system settings.
Taking the rights away is easy. Doing it without flooding IT with requests takes planning.
What's included
- Admin rights auditWho has admin rights today, on which devices, and why.
- Standard user rolloutEveryday accounts moved to standard users in planned batches.
- Self Service appsAn approved app catalogue so people install common software themselves.
- Time-limited elevationWhen someone truly needs admin rights, they get them for a short, logged window.
- Rotating local admin passwordsA unique, automatically changing local admin password on every Mac and PC.
- Privileged account vaultingShared admin and server passwords stored and audited with a tool such as Delinea Secret Server.
How it runs
Audit
Find who has admin rights and why.
Catalogue
Publish the apps people need.
Rules
Set up time-limited elevation.
Remove
Move teams to standard accounts in batches.
Review
Check elevation requests monthly.
What you get at the end
Everything is in your company's name and documented, so you are never tied to us.
- A report of who has admin rights and on which devices
- Elevation rules agreed with your managers
- A Self Service app catalogue covering everyday software
- Rotating local admin passwords on every managed device
Questions
What if someone needs admin rights for their job?
Developers and IT staff can request time-limited elevation, approved automatically or by a manager, and every use is logged.
Do we need to buy Delinea?
Not necessarily. Intune, Jamf Pro and Addigy all offer ways to manage admin access. Delinea makes sense when you also need to protect server and shared admin accounts.
Related services
Start with a free device audit
Tell us what you have. We review your devices and settings, then send a written report and a fixed quote.