Make Me Admin - Temporarily allows standard user accounts to be elevated to admin

[Arthur]

Website / Download / Documentation / Source Code

 

Make Me Admin is a simple, open-source application for Windows that allows standard user accounts to be elevated to administrator-level, on a temporary basis.

 

How it works

The user launches the Make Me Admin application. If they are authorized to obtain administrator rights, and they are not already an administrator, the "Grant Me Administrator Rights" button is enabled.

 

 

When the user clicks the Grant button, a service, running in the background, adds the user to the Administrators group. The user application notifies the user, and it minimizes to the notification area.

 

 

At this point, the user can perform the actions that require administrator rights. When prompted for credentials, they simply enter their current Windows credentials.

 

After a configurable period, the user is removed from the Administrators group by the service. The user is notified of this, and the application closes.

 

[minimoo]

@Arthur nice, so uses the security context of the named pipe call to see who accesses the service - what does the .net service come in at resource wise (ram?)

[free780]

This does a similar job.

https://robotronic.de/runasroben.html

For organisations you need to puchase licensing. You can run a process as system to get an updater to update. It relies on a service to do the group membership change. Granting temporary privilege seems a better way than multiple accounts.

[minimoo]

The run as rob thing looks like it's more focused on apps (and as you say is obviously commercial) - what caught my eye on arthur's app is it looks like it's solving a simple problem. Most schools are going to have some deployment solution/method already, but doing tasks as an admin can be awkward. For example, we used to have a admin user with a shared password; now have moved towards LAPS - which means that you need to look up the password for the workstation. This service looks to be a rather simple way of granting a temporary privilege, seems secure and sensibly implemented at a quick scan of the code.

 

At one point I coded a self-updating windows service in .net, but in the end found that updating it was a pain, and that it also used a chunk of RAM - but that was back in the 2.x days.

[LTurner3692]

As this is something i am looking at right now, What stops them being able to do this every 5 minutes if they wanted to download and install loads of apps?

[Arthur]

what does the .net service come in at resource wise (ram?)

Currently around ~8MB. I might check it again later today to see what it has increased to.

 

 

What stops them being able to do this every 5 minutes if they wanted to download and install loads of apps?

There are a couple of feature requests relating to this on the developer's GitHub issue tracker.

 

https://github.com/pseymour/MakeMeAdmin/issues/4

https://github.com/pseymour/MakeMeAdmin/issues/2

[minimoo]

I'd thought of this as more of a tool for IT staff to use - as you'd need the SID in the registry for the user first right?

[TwistedHelixis]

I'd thought of this as more of a tool for IT staff to use - as you'd need the SID in the registry for the user first right?

 

I think you can use the supplied Group policy to push out group SID if needed, so could be groups of staff etc.

[pseymour]

Hey, sorry to bump this thread, but I’m the developer. You can use SIDs or names of users/groups. So you could use, for example, a local group on each PC to control admin access, and specify a value of %COMPUTERNAME%\GroupName in the allowed list.

 

Let me know if you have other questions or concerns.