Endpoint Privilege Management
Endpoint Privilege Management (EPM) takes the model Britive already applies to your cloud accounts and applies it to the laptop on someone’s desk. Local administrator rights stop being something a user permanently has, and become something they request, receive for a bounded period, and give back.
The elevation itself is carried out by an endpoint agent you already run. Britive does not install anything new on the workstation.
EPM is enabled on request. It is not turned on by default. Contact your Britive Customer Success representative to have it enabled on your tenant before you begin.
The Problem It Solves
Standing local admin is the most common exception to an otherwise disciplined access programme. Developers need it to install tooling, field engineers need it to change a network adapter, and a support team needs it once a quarter — so everyone keeps it permanently, because revoking it generates tickets.
That standing right is what ransomware, credential theft, and unapproved software installs all depend on. It is also invisible: nothing records why a user was an administrator at the moment something happened.
EPM changes three things:
- No standing membership. The user’s account is not in the local Administrators group between requests.
- Elevation is a checkout . It goes through the same profiles, policies, and approvals as any other Britive access, and lands in the same audit trail.
- Revocation is enforced by the platform, not by the user remembering. Checking the profile back in removes the membership.
Supported Platforms
| Vendor | Mechanism | Status |
|---|---|---|
| CrowdStrike Falcon | Real Time Response (RTR) | Available |
| Microsoft Defender | — | Planned |
What You Need
Requirements differ per vendor, but every EPM integration needs three things in place:
- EPM enabled on your Britive tenant — by request, as above.
- An endpoint agent already deployed to the workstations you want to manage, with a licence tier that permits remote script execution.
- Users’ local accounts removed from the local Administrators group. EPM grants elevation; it does not take away rights that are already standing. Removing existing membership is a separate exercise you run first, and it is usually the longest part of the project.
Point 3 is worth planning properly. An EPM rollout onto machines where everyone is still a permanent administrator changes nothing measurable — the elevation succeeds, but so would everything the user did before it.