CrowdStrike Falcon

Overview

Britive elevates a user on their own workstation by asking CrowdStrike Falcon to run a script there. No Britive software is installed on the endpoint — the Falcon sensor you already run does the work, through Real Time Response (RTR).

You supply two scripts per platform: one that adds the user to the local administrators group, one that removes them. Britive calls the first on checkout and the second on check-in.

Checking the profile back in is what ends the elevation — it runs the revoke script, which removes the membership. The scripts carry no timer of their own, so the elevation is short-lived because Britive drives both ends of it.

Licensing. RTR is required. That means Falcon Insight or Falcon Enterprise — RTR is not included in Falcon Go or Falcon Pro.

How It Works

    sequenceDiagram
    participant U as User
    participant B as Britive
    participant F as Falcon API
    participant S as Falcon sensor
    participant W as Workstation

    U->>B: Check out EPM profile
    B->>B: Evaluate policy and approvals
    B->>F: Run RTR script on mapped device
    F->>S: runscript -CloudFile="elevate"
    S->>W: Add account to local admins
    W-->>U: Notification in GUI session
    Note over U,W: User works with elevated rights
    U->>B: Check in
    B->>F: Run RTR script on mapped device
    F->>S: runscript -CloudFile="de-elevate"
    S->>W: Remove from local admins
    W-->>U: Notification in GUI session

The pieces:

Component	Role
Britive EPM integration	Holds the Falcon API credentials, scans for devices and accounts, and owns the profiles and policies
Falcon API client	The credential Britive authenticates with. Scoped to hosts, RTR, response policies, and user management
RTR scripts	Your uploaded elevate and de-elevate scripts, stored in Falcon, executed on the endpoint as SYSTEM or root
Account and device mapping	Connects a Britive identity to the local account and the machine it should be elevated on

What Scanning Collects

Britive scans your Falcon tenant and stores three things, visible on the integration’s Data tab:

Devices — every endpoint, or the subset matched by your device filter.
Accounts — the last logged-in user per device, or the full login history if you enable that in settings.
Permissions — the RTR scripts available to be used as grant and revoke actions.

Mapping can be automatic, if you nominate a Britive identity attribute that holds the account name and one that holds the device ID. Otherwise it is manual, from the Data tab. A single user can be mapped to several devices, but only one user maps to a given account.

Platform Differences

The two platforms behave differently after elevation, and it affects what you tell your users.

Adding an account to the local Administrators group does not change the token of a session that is already signed in. The user keeps their standard token until next logon, and UAC reuses that session’s linked token — so Run as administrator still fails immediately after elevation.

The reference script works around this by placing two files on the user’s desktop:

Run-Elevated-Installer.bat — what the user double-clicks
ElevatedInstaller.ps1 — the launcher it starts

The launcher forces a fresh logon with runas, which picks up the new group membership, and elevates from there. The de-elevate script deletes both files and terminates processes the workflow spawned.

Without this, the only alternative is to have the user sign out and back in after every elevation.

macOS admin group membership takes effect for sudo and authorization prompts without a new logon, so there is no launcher and nothing is written to the desktop.

The script adds the account to the admin group with dseditgroup and pushes a notification into the user’s GUI session. If no GUI session is active, the group change still applies and the script reports DONE (no active session) — only the notification is skipped.

Prerequisites

EPM enabled on your Britive tenant — by request through Customer Success.
Falcon Insight or Falcon Enterprise licensing, with RTR.
RTR Admin role on your own Falcon account, to upload the scripts.
Britive administrator privileges.
Target workstations where users are not already permanent local administrators.

Next Steps

Work through these in order — the Britive integration cannot be tested until the Falcon side exists.

Configure CrowdStrike

Create the API client, grant yourself RTR Admin, and upload the elevation scripts.

Integrate with Britive

Add the integration, connect it to your Falcon tenant, and run the first scan.

Manage EPM Profiles

Create a profile, wire up grant and revoke, and check out an elevation.

Last updated on September 3, 2026