Access

Manage local admin rights

Take standing administrator rights off your computers without stopping people working. Start in report mode, enforce safely, grant elevation on request.

A person who is an administrator on their own computer can turn off its protections, install anything, and hand an attacker the same power. Trustaige lets you decide who may hold administrator rights on your Windows PCs and Macs, see everyone who holds them today, take them away from everyone else, and give them back for a few minutes when someone genuinely needs them.

How it works

• A rule says who may be an administrator: the members of the groups you choose. Everyone else holding administrator rights is not allowed.
• A mode says what happens to people the rule doesn’t allow:
  • Report only shows you who they are, and changes nothing.
  • Enforce removes their rights.
• A break-glass administrator on each device, a local account called trustaigebrk, keeps you able to administer it when nobody else can. Its password changes every day and is kept by Trustaige, revealed only to an administrator who confirms it’s them.
• Elevation on request lets someone without administrator rights get them for a short time, on their own or with approval.

Trustaige never removes rights from a device that doesn’t have a working break-glass administrator yet: it holds enforcement back on that device and tells you why.

Before you begin

• Devices enrolled in Trustaige, with its agent running: Windows PCs and Macs get the agent automatically when they enroll.
• On Macs, people registered with Trustaige sign-in. A Mac’s allowed administrator account, and the account elevation applies to, is the one the person registered with the Trustaige sign-in app.
• The Scale or Premier plan.
• A role that can manage policies, settings and devices. The rule is a setting, the per-platform options are device settings, and the page sits under policies. A superadmin has all three.

Everything below is in the hub under Devices → Privilege.

Roll it out in five steps

1. Choose who may be an administrator, in report mode

2. Turn on the break-glass administrator on each platform

On the Windows tab and on the macOS tab, turn on Break-glass admin. Devices create the account on their next check-in. The Windows tab shows Break-glass ready when its devices have one.

You’ll find the break-glass password for a device on its page, under Reveal secret.

3. Read the report, and fix what it shows

Each platform tab shows the fleet: Devices affected, Unapproved admins, Pending sign-out and Enforcement blocked. Open a device’s Privileges tab to see every administrator account on it, labelled Trustaige managed, Allowed by policy, Elevated on request or Not allowed.

For each person shown as Not allowed, decide: should they keep rights (add them to an administrator group), or lose them (do nothing; enforcement will handle it)? You’re ready when the panel reads “Every administrator across the checked devices is allowed by your rule”, or when everyone left is someone you mean to demote.

4. Turn on elevation on request

Before you take rights away, give people a way to get them back for a task. On each platform tab, under Just-in-time elevation, choose:

• Self-service: a request is granted at once, up to a daily number per person (Self-service up to). Requests over the number go to an approver.
• Approval: every request waits for an administrator.

Then set how long elevation lasts (5 to 240 minutes) and whether a reason is required, and save: Save Windows mechanics on Windows, Save elevation settings on macOS. Save these once even if you keep the values shown, so devices get exactly what you see.

Elevation works differently on each platform:

• Windows: the person runs one program as the break-glass administrator. They never become an administrator themselves. The time limit is how long they have to start the program.
• macOS: the person’s own account becomes an administrator for the time you set, then Trustaige removes it again.

Requests appear in Elevation requests on each tab, with Approve and Deny. Trustaige doesn’t email you about new ones, so if you choose Approval, decide who watches the queue.

5. Enforce

Watch Enforcement blocked and Pending sign-out fall to zero over the next day.

What people see

On Windows. To run something as an administrator, a person either right-clicks a program and chooses Request elevation with Trustaige, or opens Elevate in Trustaige. There they enter the program’s full path under What do you need to run? and, if you require it, a reason, then click Request access and confirm with their passkey. They see Approved — starting now or Waiting for approval. When their rights are removed under enforcement, Windows shows Administrator rights removed and, if you set a sign-out time, signs them out after a warning.

On a Mac. From the Trustaige menu bar icon, they choose Request administrator access…, give a reason and confirm with their passkey in the browser within 10 minutes. Notifications tell them You’re an administrator now, Administrator access ends in 2 minutes and Administrator access ended. They can finish early with Give back administrator access. When a Mac asks for an administrator password, Trustaige offers Need administrator access?.

Running it day to day

• Keep groups current. Rights follow group membership. Someone who joins IT gets rights at the next check-in, and someone who leaves loses them.
• Watch the fleet panel weekly. A new Not allowed account means someone gained rights outside your rule.
• Use elevation counts as a signal. If the same program keeps being elevated, install it for everyone instead. Elevation activity also appears in the weekly report.
• Use the audit log. Demotions (“Removed local administrator rights”), held enforcement, and every elevation (requested, granted, denied, run, expired, ended) are recorded.
• Windows services. If people need to start or stop a particular Windows service, grant it under Services standard users may control instead of making them administrators.

Troubleshooting