Just-in-time admin access to your Active Directory computers
Take permanent admin rights away from your team without getting in the way of their work. With Lithnet Access Manager, you decide who can be an admin on which computers and for how long, and your team requests that access via our user-friendly web app. They keep the access they have today, with one extra step for safety. With far fewer standing admin rights to steal, one compromised account is much less likely to cause an organization-wide breach.
Professional edition from USD 750 a year, including 100 devicesFree Community edition for up to 100 devices
Permanent admin rights let an attacker move between computers
Giving your IT team permanent admin rights on every computer they look after is convenient, because nobody has to ask before they fix something. However, it also lets an attacker who takes over one of their accounts take over your entire environment. Large ransomware attacks often spread in this way. Access Manager allows admins to request admin access to the servers they are entitled to manage, and automatically removes that access after a configured period of time.
Learn more about Lithnet Access ManagerHow it works
- 1You request admin rights on a computer via the Access Manager web app.
- 2Access Manager adds you to the local administrators group on that computer.
- 3You log on to the server, and have full admin rights.
- 4When the configured time has elapsed, Access Manager removes you from the group.
Decide who can request admin rights
Your authorization rules decide who can request admin rights to which computers, and for how long that access lasts. A rule can cover one computer, an Active Directory group of computers or every computer in an organizational unit.
Know who had admin rights on each computer
Access Manager writes every just-in-time request to the Windows event log. Each event contains a detailed record of who requested access, for which computer or role, from which IP address, the reason they gave and when the access ends. Access Manager can send those audit events to your SIEM, or even get them sent right to your Slack or Teams channel.
Access to a computer was granted
- Requested access
- Just-in-time access
- Name
- Alex Chen
- User name
- FABRIKAM\alex.chen
- Computer
- FABRIKAM\FAB-WS-0142$
- Matched rule
- Service desk admin access
- Access expiry
- Today at 2:30 pm
- Reason
- Installing a printer driver
Meet the Essential Eight requirement for just-in-time administration
The Australian Signals Directorate's Essential Eight Maturity Model lists "Just-in-time administration is used for administering systems and applications" as a Maturity Level Three requirement for restricting administrative privileges (ASD). At Maturity Levels Two and Three, privileged access events must also be centrally logged, and Access Manager's audit events give you that record.
Runs on your own server
Access Manager runs on a Windows Server in your own environment, so granting and removing admin rights never depends on a Lithnet cloud service.
Frequently asked questions
Does someone have to approve each request?
No. People request admin rights for themselves within the limits that your authorization rules set.
Which computers does it work with?
Just-in-time access to computers works with Windows servers and workstations that are joined to an Active Directory domain. Access Manager adds you to the local administrators group on the computer where you request admin rights.
Can my admins also get temporary membership of an Active Directory group?
Yes. With just-in-time access to roles, you can make a role out of any Active Directory group. Your admins request the role in the same web app, and Access Manager removes them from the group when the time is up.
Get started today
Paid editions start at USD 750 a year and include support from Lithnet. The Community edition includes just-in-time access to computers and is free for up to 100 devices.
The free trial unlocks every feature for 30 days on a free installation.