Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

Mitigate Operational Risk: Service Control in Privilege Guard 3.8

October 20, 2017

  • Blog
  • Archive

Privilege Guard becomes the only privilege management solution to provide control of Windows Services

Services play an integral part of endpoint functionality - they are components of many desktop products, and almost all server implementations. On desktops, services run in the background across multiple user sessions, most commonly for products such as antivirus, firewalls and other security products. On servers, many roles function as services because of the performance and high availability requirements of applications in the datacenter.

In addition, many native features of Windows run as background processes, and are enabled or disabled from its service.

So it's a fair assumption that no matter your role within the organization, at some point there may be a need to interact with a service, and herein lies the issue.

Unavoidable risk

Services are typically accessed through the Services.msc management console, Task Manager, or from the net.exe command line. Other 3rd party tools offer extended functionality for managing services. But one thing in common is that managing services (with a few exceptions) requires administrator privileges. Granting those privileges to the application is great if you want your user to have access to ALL services, but what if you need a bit more control? Access to services should be restricted to only authorized personnel - the people responsible for what they deliver to an organization. Put it another way, services should be out of bounds.

Power users, particularly developers, frequently need to be able to start and stop services on their own PC’s - for example, a web developer running code in IIS (a service). Elevating Services.msc lets the developer do this, but also allows them to tamper with and disable other services.

Many server roles, such as databases, web servers, file servers, directory servers, etc run as services, and many scheduled/unscheduled maintenance tasks require access to those services. Given that servers tend to be business critical, maintenance is usually restricted to key teams or individuals responsible for their function. But servers are still a Windows OS, and may be maintained by multiple teams. As an example, a web server hosting an intranet may need to be accessed by the web team, the network operations team and also the security team. Roles within IT may be well defined, but when it comes to maintaining services, the boundaries are a lot less defined and usually unrestricted.

These are precisely the challenges that Privilege Guard 3.8 solves.

Granular control over service privileges

With Privilege Guard 3.8, you can now assign granular privileges for individual services, to whoever and wherever they are needed. Individual actions like start, stop or pause, can be elevated or revoked, and detailed auditing tracks all user interactions, whether allowed or blocked.

Assigning privileges to individual services eliminates the need to elevate high risk applications such as Services.msc or net.exe. Instead, these tools can be executed with standard rights, letting the user, developer or IT admin perform authorized tasks seamlessly.

For high risk or critical services, you can incorporate End User Messages to specific actions, prompting the admin for credentials or Challenge / Response authorization before being allowed to proceed. Where privileges are required, request messages are audited, and those requests can then be fed directly into policy for rapid provisioning of service privileges.

For environments were external contractors or consultants need to access services, add dual-authentication controls to ensure all actions are supervised and federated.

Avecto are the leaders in privilege management, and our award winning solutions help solve real challenges by removing admin rights from users. Privilege Guard is the first and only least privilege solution that lets power users and IT admins manage services in a secure, controlled and flexible standard user session.

Introducing Defendpoint

Edit: Privilege Guard has now evolved into the brand new security suite, Defendpoint, which encompasses Privilege Management, Application Control and Sandboxing. For more information, please visit www.avecto.com/defendpoint.

Kris Zentek

Senior Product Manager

Kris Zentek is a Senior Product Manager at BeyondTrust, focusing on Endpoint Privilege Management solutions. Based in the UK, he has over 20 years of experience working in the cybersecurity industry.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Webcasts | February 09, 2021

Customer Webinar: Remote Support 21.1 Released!

Webcasts | February 24, 2021

Your PAM 2021 Blueprint: Securing Privileged Accounts for On-Premises and Cloud Assets

Whitepapers

Evolving Privileged Identity Management (PIM) In The 'Next Normal'

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.