Manage EPM Profiles
Overview
An EPM profile is what a user actually checks out. It names the platform it applies to, the script that grants access, and the script that takes it away.
Profiles live inside the integration rather than in the main profile catalogue — you reach them through System Admin, not through the application list.
Before You Begin
- The CrowdStrike integration connected and scanned, with your scripts visible on the Permissions sub-tab.
- At least one identity mapped to an account and a device.
- Britive administrator privileges.
Create the Profile
Open the integration’s profiles
Go to System Admin → Endpoint Privilege Management, select Manage on your CrowdStrike Falcon integration, and open the Profiles tab.
Create it
Select Create Profile and fill in:
| Section | Field | Notes |
|---|---|---|
| General | Name | What the user sees when requesting elevation |
| General | Description | Say what this elevation is for |
| Expiration | Expiration Timeout | How long the elevation lasts |
| Expiration | Expiration Extension | Optional. Whether the user can extend |
The timeout cannot exceed the Maximum session duration for profiles set on the integration’s Settings tab.
Select Done.
Set the platform
Open the Platform tab, select Edit, choose the operating system this profile targets, and Save.
This is what decides whether Britive sends a PowerShell script or a shell script, so a profile serves one platform. Supporting both Windows and macOS means two profiles.
Attach grant and revoke
Open the Permissions tab. Every profile needs both:
| Action | Purpose |
|---|---|
| Grant | The script that elevates. Britive runs it on checkout |
| Revoke | The script that removes the elevation. Britive runs it on check-in |
Check-in is what ends the elevation. The scripts hold no timer, so a profile with no working Revoke script grants access that nothing takes back — test both directions before releasing a profile to users.
Each can be set two ways:
- Select from list — pick from the scripts discovered by the scan. Use this where you can; it cannot be misspelled.
- Type Manually — enter the script name yourself, for a script the scan has not picked up.
A typed name must match the script’s name in Falcon exactly. There is no validation at save time, so a mistake here surfaces later as an elevation that fails on the endpoint rather than as a configuration error.
How Users Check Out
EPM profiles are requested from the Britive console. They are not yet available through the Britive CLI — pybritive checkout does not reach them — and the same applies to the Slack and Teams integrations.
Support for checking out a device from the CLI, and a My Devices flow in Slack and Teams, is planned. Until then, plan your rollout communications around the console.
What the User Experiences
- The user checks out the profile.
- A dialog and a tray notification appear on their desktop confirming the elevation.
- Two files appear on their desktop:
Run-Elevated-Installer.batandElevatedInstaller.ps1. - They double-click the
.batto get an elevated launcher.
Tell users about step 4. Run as administrator on an existing window will still fail, because a signed-in session keeps its original token until next logon. The launcher exists precisely to avoid making people sign out and back in. Users who skip it conclude the elevation did not work.
On check-in, the membership is removed, processes the workflow started are terminated, the desktop files are deleted, and the user is notified. They are not logged off — the session continues with standard privileges.
Verify
Check out the profile
As a mapped test user, request the profile and wait for it to become active.
Confirm elevation on the endpoint
On Windows:
net localgroup AdministratorsOn macOS:
dseditgroup -o checkmember -m jdoe adminThe user’s account should be listed.
Check in
Return the profile, then run the same command again. The account should be gone, and on Windows the two desktop files should have been deleted.
Confirm the audit trail
The checkout and check-in appear in the Britive audit log against the requesting identity, the same as any other profile.
Troubleshoot
| Symptom | Likely cause | Fix |
|---|---|---|
| Profile is not offered to a user | The identity is not mapped to an account and a device | Map it on the integration’s Data tab |
Profile does not appear in pybritive ls profiles | EPM profiles are not exposed to the CLI yet | Check out from the Britive console |
| Checkout succeeds, nothing happens on the endpoint | Grant script name does not match the name in Falcon | Compare the profile’s Grant value with the script name in Falcon, character for character |
Checkout fails with Could not resolve account | Account Mapping passes a UPN | Map to sAMAccountName or the local short name — see Integrate with Britive |
| Check-in leaves the user elevated | Revoke script name is wrong, or the script errored on the endpoint | Check the Revoke value, then run it manually from RTR to see its output |
| Elevation applies, but Run as administrator still fails (Windows) | The user is elevating from their existing session | Use the desktop launcher; the old session’s token is unchanged |
Could not locate the desktop folder (Windows) | The user has never signed in on that machine | Have them sign in once, then retry |
| Elevation works, no notification | No active GUI session at the time | Expected. The privilege change still applied |
| Wrong script type sent to the endpoint | Profile platform does not match the device | Check the Platform tab; one profile serves one OS |
| Expiration Timeout will not save | It exceeds the integration ceiling | Raise Maximum session duration for profiles or lower the profile timeout |