Application Control powered by AppSense

Ivanti Application Control is the new name for AppSense Application Manager

User Privileges

A privilege is the right of a user account to perform a particular system-related operation, such as shutting down the computer or changing the system time. You can use the Privilege Management feature to assign (enable) or deny (disable) privileges.

In this section:

User Privileges Policies

The Elevate policy is applied to new rule items by default. When an item is elevated the selected item will be given increased privileges and will not require an administrator to run it.

User privileges policies offer an alternative to using the default Elevate rule and can be customized to meet the needs of your organization. Policies can range from making an individual user a member of a "Power User" group to removing user membership from the Administrators group.

When a User Privileges Policy is created, you can customize your policy using the following three tabs:

  • Group Membership - Group Membership allows you to specify Windows user groups to be dropped or added when a policy is applied. You add a group action to the policy contents and then specify whether or not the selected group is to be applied to the newly created policy or whether their membership is to be dropped.

    When you assign membership to a user group, you will only add the group that you have selected, any nested groups will not be included. For example, if you assign group membership to Domain Administrators this will not automatically include the Local Administrator group and they will therefore need to be added separately.

  • Privileges - A privilege is the right of a user account to perform a particular system-related operation, such as shutting down the computer or changing the system time. You can use the User Rights Management feature to enable, disable or remove privileges:
    • No change - Leaves the privilege as it is with its original token.
    • Enabled - Sets the flag in the token to enabled.
    • Disabled - Sets the flag in the token to disabled.
    • Remove - Removes the privilege from the token. You cannot undo this option.
  • Properties - Add a description for the policy in the Properties tab.

Create a User Privilege Management Policy

  1. Select the Library > User Privilege Policies node.
  2. Select Add Policy on the Privilege Management ribbon.
  3. Select and right-click the new policy and select Rename.
  4. Give the policy an intuitive name.
  5. Do one or more of the following:
    • Use the Group Membership tab to specify the credentials an application can run under, for example, what group and whether to add or drop membership for the group. Adding membership allows users to run an application as if they were a member of the group.
    • Use the Privileges tab for granular control of the privileges the user will have over an application.
    • Use the Properties tab to specify the integrity level. Applications with a low integrity level cannot interoperate with applications that have a high integrity level.

User Privileges Management policies are reusable.

Add Group Membership to a Policy

Standard users typically have no administrative rights. The following process demonstrates how to create a User Privileges Policy for a Support Desk operative. User privileges management provides the ability to add membership to a selected group or to drop membership. The first step in creating the configuration is to create a User Privileges Policy and to specify the membership, in this case, to add membership.

  1. In the Application Control console, select the User Privileges Policies node under Library.
  2. In the Privilege Management ribbon, click Add Policy.

    The new policy is added under the User Privileges Policies node in the navigation pane.

    To sort policies under the User Privileges Policies node, right-click the node and select Sort Ascending or Sort Descending.

  3. In the work areas, click the new policy name to make the name editable.
  4. Enter a name for the policy, for example, SupportDesk.
  5. In the Privilege Management ribbon, click Add Group Action.

    The Account Selection dialog displays.

  6. Enter or navigate to the SupportDesk group and click OK.

    The group is added to the Group Membership tab in the work area for the policy.

  7. In the tab, ensure that Add Membership is visible in the Action column. This is the default setting

Assign Privileges to a Policy

  1. Select the Library > User Privilege Policies node.
  2. Select Add Policy on the Privilege Management ribbon.
  3. Select and right-click the new policy and select Rename.
  4. Give the policy an intuitive name.
  5. Select the Privileges tab for granular control of the privileges the user will have over an application.
  6. Identify the privilege you want to assign.
  7. Click the drop-down arrow in the Actions column for the privilege and select Enable.

Example: Create a Configuration that Allows Microsoft Silverlight to be Downloaded

Privileges

The following table provides the full list of privileges and describes how and when system components check for them.

Privilege

User Right

Privilege Usage

SeAssignPrimaryTokenPrivilege

Replace a process-level token

Checked for by various components, such as NtSetInformationJob, that set a process' token.

SeAuditPrivilege

Generate security audits

Required to generate events for the Security event log with the ReportEvent API.

SeBackupPrivilege

Backup files and directories

Causes NTFS to grant the following access to any file or directory, regardless of the security descriptor that is present.

READ_CONTROL

ACCESS_SYSTEM_SECURITY

FILE_GENERIC_READ

FILE_TRAVERSE

When opening a file for the backup, the caller must specify the FILE_FLAG_BACKUP_SEMANTICS flag. Also allows corresponding access to registry keys when using.

SeChangeNotifyPrivilege

Bypass traverse checking

Used by NTFS to avoid checking permissions on intermediate directories of a multilevel directory lookup. Also used by file systems when applications register for notification of changes to the file system structure.

SeCreateGlobalPrivilege

Create global objects

Required for a process to create section and symbolic link objects in the directories of the object manager namespace that are assigned to a different session than the caller.

SeCreatePagefilePrivilege

Create a pagefile

Checked for by NtCreatePagingFile, which is the function used to create a new paging file.

SeCreatePermanentPrivilege

Create permanent shared objects

Checked for by the object manager when creating a permanent object (one that does not get de-allocated when there are no more references to it).

SeCreateSymbolicLinkPrivilege

Create symbolic links

Checked for by the NTFS when creating symbolic links on the file system with the CreateSymbolicLink API.

SeCreateTokenPrivilege

Create a token

NtCreateToken, the function that creates a token object, checks for this privilege.

SeDebugPrivilege

Debug programs

If the caller has this privilege enabled, the process manager allows access to any process or thread using NtOpenProcess or NtOpenThread, regardless of the process's or thread's security descriptor (except for protected processes).

SeEnableDelegationPrivilege

Enable computer and user accounts to be trusted for delegation

Used by Active Directory services to delegate authenticated credentials.

SeImpersonatePrivilege

Impersonate a client after authentication

The process manager checks for this when a thread wants to use a token for impersonation and the token represents a different user than that of the thread's process token.

SeIncreaseBasePriorityPrivilege

Increase scheduling priority

Checked for by the process manager and is required to raise the priority of a process.

SeIncreaseQuotaPrivilege

Adjust memory quotas for a process

Enforced when changing a process's working set thresholds, a process's paged and nonpaged pool quotas, and a process's CPU rate quota.

SeIncreaseWorkingSetPrivilege

Increase a process working set

Required to call SetProcessWorkingSetSize to increase the minimum working set. This indirectly allows the process to lock up to the minimum working set of memory using VirtualLock.

SeLoadDriverPrivilege

Load and unload device drivers

Checked for by the NtLoadDriver and NtUnloadDriver driver functions.

SeLockMemoryPrivilege

Lock pages in memory

Checked for by NtLockVirtualMemory, the kernel implementation of VirtualLock.

SeMachineAccountPrivilege

Add workstations to the domain

Checked for by the Security Accounts Manager on a domain controller when creating a machine account in a domain.

SeManageVolumePrivilege

Perform volume maintenance tasks

Enforced by file system drivers during a volume open operation, which is required to perform disk checking and defragmenting activities.

SeProfileSingleProcessPrivilege

Profile single process

Checked by Superfetch and the prefetcher when requesting information for an individual process through the NtQuerySystemInformation API.

SeRelabelPrivilege

Modify an object label

Checked for by the SRM when raising the integrity level of an object owned by another user, or when attempting to raise the integrity level of an object higher than that of the caller's token.

SeRemoteShutdownPrivilege

Force shutdown from a remote system

Winlogon checks that remote callers of the function have this privilege.

SeRestorePrivilege

Restore files and directories

This privilege causes NTFS to grant the following access to any file or directory, regardless of the security descriptor that's present:

WRITE_DAC

WRITE_OWNER

ACCESS_SYSTEM_SECURITY

FILE_GENERIC_WRITE

FILE_ADD_FILE

FILE_ADD_SUBDIRECTORY

DELETE

When opening a file for the backup, the caller must specify the FILE_FLAG_BACKUP_SEMANTICS flag. Also allows corresponding access to registry keys when using.

SeSecurityPrivilege

Manage auditing and security log

Required to access the SACL of a security descriptor, read and clear the security descriptor, read and clear the security event log.

 

SeShutdownPrivilege

Shut down the system

This privilege is checked for by NtShutdownSystem andNtRaiseHardError, which presents a system error dialog box on the interactive console.

SeSyncAgentPrivilege

Synchronize directory service data

Required to use the LDAP directory synchronization services and allows the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties.

SeSystemEnvironmentPrivilege

Modify firmware environment variables

Required by NtSetSystemEnvironmentValue and NtQuerySystemEnvironmentValue to modify and read firmware environment variables using HAL.

SeSystemProfilePrivilege

Profile system performance

Checked for by NtCreateProfile, the function used to perform profiling of the system. This is used by the Kernprof tool, for example.

SeSystemtimePrivilege

Change the system time

Required to change the time or date.

SeTakeOwnership

Take ownership of files and other objects

Required to take ownership of an object without being granted discretionary access.

SeTcbPrivilege

Act as part of the operating system

Checked for by the security reference monitor when the session ID is set in a token, by the Plug and Play manager for Plug and Play event creation and management, BroadcastSystemMessageEx when called with

SeTimeZonePrivilege

Change the time zone

Required to change the time zone.

SeTrustedCredManAccessPrivilege

Access credential manager as a trusted caller

Checked by the credential manager to verify that it should trust the caller with credential information that can be queried in plain text. Is only granted to Winlogon by default.

SeUndockPrivilege

Remove computer from a docking station

Checked for by the user-mode Plug and Play manager when either a computer undock is initiated or a device eject request is made.

SeUnsolicitedInputPrivilege

Receive unsolicited data from a terminal device

This privilege is not currently used by Windows.

Related topics


Was this article useful?    

The topic was:

Inaccurate

Incomplete

Not what I expected

Other