Getting Started with Microsoft Intune’s Endpoint Privilege Management – Part 5

Posted on May 14, 2023 Updated on May 17, 2023

Are you new to endpoint privilege management products? Or have you used other endpoint privilege management products and are looking to explore what Microsoft has to offer? This series of blog post guides will walk you through the core process of Microsoft Intune’s Endpoint Privilege Management (EPM)…navigating you from trial activation, to prerequisites, to onboarding users/devices, to creation of example policies using real applications, and troubleshooting.

• Part 1 – What is EPM and why does it matter?
• Part 2 – Trial registration and meeting the prerequisites.
• Part 3 – Onboarding users/devices.
• Part 4 – Basics of creating EPM elevation rule policies.
• Part 5 – Actual, practical elevation rules that you can test!
• Part 6 – Troubleshooting tips.

In part 4 of this blog post series, I outlined the basics of creating EPM elevation rule policies, which included how to get the hash of a file and/or the certificates used to sign the application. For part 5, I’m providing practical examples that you can use to validate different application behaviors.

The Apps, The Examples

First and foremost, I’m going to outline the applications that use for various demonstrations. The benefit is that I use real applications that you can download and use at no cost with no hassle. For that, I turn to Microsoft Edge insider builds and the very popular Sysinternals from Microsoft. The great part about these applications from Sysinternals is each tool varies by the amount of admin privileges that are needed. Some need full admin permissions, some can run without admin privileges (but then need admin to do other things), and more.

Go get these application versions downloaded.

Example #1 – NotMyFault

For transparency, the NotMyFault application will not have a policy created – it’s just an easy way to show the user experience of it being blocked from executing. This can be experienced by trying to run the application by itself and also with a right-click > Run with elevated access.

Example #2 – Process Monitor

Similar to NotMyFault in Example #1 above, procmon requires elevated access to execute. For this example, we’ll configure the EPM elevation rules to automatically elevate any time the user runs it.

Elevation Rule for Process Monitor

1. Basics page
   • Name: Procmon | Hash | Auto Elevate
   • Description: This app can only ever run with admin-level credentials. Configure this policy to automatically run elevated. https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
2. Configuration Settings page
   • Rule name: Procmon64 v3.93 | Windows Auth
   • Elevation type: Automatic
   • File name: Procmon64.exe
   • Signature source: Not configured
   • File hash: CBE952CBCF66A0DE40D4E494C970A310257712D44363DDB157F469A351D57ACB
3. Assignment page: All users

User Experience of Process Monitor

Example #3 – VMMap

VMMap can run with standard user rights…to an extent. Full visibility requires elevated access. For this example, I configure it to use the file hash and user confirmation for Windows Authentication.

VMMap Elevation Rule

1. Basics page
   • Name: VMmap | Hash | Windows Auth and Business Justification
   • Description: VMmap has capability to do system level monitoring with elevation. Configure this to be elevated with user’s Windows Authentication. https://learn.microsoft.com/en-us/sysinternals/downloads/vmmap.
2. Configuration Settings page
   • Rule name: vmmap v3.32 | windows auth
   • Elevation type: User confirmed > Windows authentication and Business justification
   • File name: vmmap64.exe
   • Signature source: Not configured
   • File hash: C4EE4DA8A62F92BD0C494267704E439CFFEA7C01528F0F09CB2877D805F1027A
3. Assignment page: All users

User Experience for VMMap

Example #4 – Microsoft Edge Insider

This example is design to show how a reusable setting for a vendor’s code signing certificate can be configured to allow users to elevate the applications created by the vendor. This can be useful when a vendor produces updates for their applications and it’s easier for IT to allow those to be installed by the users.

I’m using Microsoft Edge because of the easy access to other channel releases and frequent updates to Microsoft Edge (Beta, Dev, Canary). If you’d prefer to not use a Microsoft application for this, Notepad++ is a great option.

Upload the Reusable Cert

1. Create the reusable setting (certificate upload) by navigating in the Intune portal to Endpoint Privilege Management > Reusable Settings “tab”. Then click on Add.

2. Basics page – add the name and description
3. Configuration settings page – upload the certificate file that you’ve exported. You’ll notice the Base 64 value is displayed after processing.
4. Review and save the certificate.

Elevation Rule Policy for Microsoft Edge Insider

1. Basics page
   • Name: Microsoft Edge Insider | Certificate | User Confirmed
   • Description: Allow the install of any Microsoft Edge Insider channel build and version. https://www.microsoftedgeinsider.com/en-us/download
2. Configuration Settings page
   • Rule name: msedge
   • Elevation type: User confirmed > Business justification
   • File name: (not defined)
   • Signature source: Certificate selected
     • Add or remove a certificate: select the certificate that was previously uploaded.
   • Certificate type: Publisher
3. Assignment page: All users

User Experience of Edge Insider

Long story short, doing the above process for the other Microsoft Edge Insider channels shows results in the same behavior of only requiring business justification as per our rule.

Wrap-up

The above elevation rules provide several examples to help you get started quickly with EPM.

Getting Started with Microsoft Intune’s Endpoint Privilege Management – Part 4

Posted on May 12, 2023 Updated on May 17, 2023

Are you new to endpoint privilege management products? Or have you used other endpoint privilege management products and are looking to explore what Microsoft has to offer? This series of blog post guides will walk you through the core process of Microsoft Intune’s Endpoint Privilege Management (EPM)…navigating you from trial activation, to prerequisites, to onboarding users/devices, to creation of example policies using real applications, and troubleshooting.

• Part 1 – What is EPM and why does it matter?
• Part 2 – Trial registration and meeting the prerequisites.
• Part 3 – Onboarding users/devices.
• Part 4 – Basics of creating EPM elevation rules policies.
• Part 5 – Actual, practical elevation rules that you can test!
• Part 6 – Troubleshooting tips.

In part 3 of this series of blog post, I dove into how to enroll devices and/or users into the EPM service. For part 4, I’m getting into the basics for the creation of elevation rule policies. Most importantly, I provide tips on things to consider.

Basics of how to Collect Hashes and Certificates

As of the GA release of Intune EPM, the hash of the application or the signing certificate is required for elevation rules. If you’re unfamiliar on how to collect either of these, here’s the quick tutorial.

First, here’s an example of how to get the file hash. Simply use PowerShell with cmdlet Get-FileHash. It’s easy! It’s super important to know that every time an application is compiled, a new hash is generated. So in real-life, supporting multiple versions of an application would require a hash for each.

Next, getting the certificate of an application is a bit more involved, but not too difficult. I’m just outlining the high-level steps with a couple of screenshots.

1. On the .exe file, right-click and select Properties.
2. On the tab for Digital Signatures, select the signature and click Details > View Certificate > Install Certificate > install to the Personal store of the current user.
3. Next, open the certificate manager, navigate to Personal > Certificates > Right-click the certificate and select All Tasks > Export. Export as a Base-64 encoded certificate.

Basics of Creating an EPM Elevation Rules Policy

1. In the Intune portal, navigate to Endpoint Security > Endpoint Privilege Management.
2. On the Policies “tab”, select to Create Policy > Platform | Window 10 and later > Profile | Elevation rules policy

3. Basics page: Provide a name and an optional description for the elevation rules policy.
   • Name: I like to use the format of App Name | Source Type | Authentication Type
   • Description: Optional. I like to include pertinent information, such as info about the vendor.

3. Configuration Settings page: click “edit instance” of the user confirmed elevation.
   • Rule name: I prefer to use App Name | App Version | Auth Type
   • Elevation type: as per business requirements
   • File name: The exact name of file that will be identified
   • File path: Optional, but the more concrete the better.
   • Signature source:
     • Use a cert file in reusable settings: This is the most dynamic and flexible approach as the certificate from Reusable settings can be used in multiple rules. Using certificate alone may introduce a certain amount of risk.
     • Upload a cert file: note that uploading a certificate is a one-time
     • Not configured: to use only the file hash and not a certificate.
   • File hash: hashes are the most trusted. It’s important to note that there is a different hash for every application version. As such, using hash means that there would need to be an elevation type for every version of an app, which can be contained within one rule.

3. Assignments page:
   • Include groups: There are many ways Assuming that you followed along with my philosophy of the approach in my part 3 blog post, you would assign this policy to All Users since it should only be applied to any user of devices that have been enrolled into EPM.
   • Excluded groups: If there are certain users that should be excluded from this rule, such as tier 2 / tier 3 desktop support admins.

Wrap-Up

That’s the majority key considerations and tips for the basics of creating EPM elevation rules policies. Stay tuned for the next blog post which will provide real life examples for applications that you can download and use at no cost with no hassle!

Getting Started with Microsoft Intune’s Endpoint Privilege Management – Part 3

Posted on May 9, 2023 Updated on May 17, 2023

Are you new to endpoint privilege management products? Or have you used other endpoint privilege management products and are looking to explore what Microsoft has to offer? This series of blog post guides will walk you through the core process of Microsoft Intune’s Endpoint Privilege Management (EPM)…navigating you from trial activation, to prerequisites, to onboarding users/devices, to creation of example policies using real applications, and troubleshooting.

• Part 1 – What is EPM and why does it matter?
• Part 2 – Trial registration and meeting the prerequisites.
• Part 3 – Onboarding users/devices.
• Part 4 – Basics of creating EPM elevation rule policies.
• Part 5 – Actual, practical elevation rules that you can test!
• Part 6 – Troubleshooting tips.

In part 2 of this series of blog post, I dove into the EPM trial registration and review of deployment prerequisites. For part 3, I’m covering my approach towards enrolling users/devices into EPM, validating that EPM is enabled, and my recommendations for policies.

Enroll Users or Devices?

When it comes to EPM policies, you can target users, devices, or a mix of both. For example, you might want to enroll all devices, but only apply EPM rule policies to specific users of the device. Or conversely, you might want to have all user devices enrolled, but exclude specific devices. For most (if not all) scenarios, EPM provides flexibility to manage them all!

With that said above, my approach is to enroll devices with an elevation settings policy. Then my EPM rules will target all users while also excluding any users that need to be. A simple illustration of this is in the image below.

When choosing the configuration options for EPM Client Settings policy, there are a couple of main decision points:

1. Have data sent (or not) and the level of data that is sent (for privacy or regulatory reasons).
2. Set the default elevation behavior to deny by default or to require user confirmation by default.

As you might guess, deny all requests is the most restrictive and will necessitate creating explicit rules that define which applications are allowed to be elevated and how. And of course, there are options to accommodate the most flexibility by allowing anything to be elevated by the user without any additional validation.

Onboard Users or Devices – The Steps

Following the above model, enrolling devices into EPM is a simple task.

1. Create your Group that includes your devices (not covered in this guide).
2. In the Intune portal, navigate to Endpoint Security > Endpoint Privilege Management > select Create Policy. For the policy, select Windows as the platform and Elevation settings policy.

3. For the basics, enter the name as Enroll Devices | All Data | Deny Requests.

4. Set the default elevation response to “Deny all requests”.

5. Finally, assign the policy to the group of devices that were created in Step 1. Then complete the wizard.

Validating EPM Enrolls Devices

To validate EPM functionality, I recommend using a client Hyper-V virtual machine installed, running Windows 10/11, fully updated, and enrolled into Intune. This way, checkpoints can be used for quick reversal of testing. As a reminder, this is a guide for getting started quickly with EPM…it’s not meant to be a checklist of tasks for a production rollout.

1. Once your Hyper-V virtual machine is ready, add it into the group of devices for testing which has the enrollment policy assinged.
2. Login to the device with a user (that’s not a local admin!) who will be used to validate EPM policies. Open the Company Portal > Settings > Sync. This is only used to get the enrollment policy.

3. Validate the EPM service (MEMEPMSvc) is running.

4. Restart Windows (not just the service) to expedite the endpoint showing in the status in the console.
5. Confirm the enrollment of the device in the policy reporting by navigating to the EPM Settings policy > View Report.
   Note: This might take an hour to be reflected within the Intune portal.