Managing privilege delegation on a server device

1 . A system, comprising:

a memory; and

a remote management (RM) server comprising a processing circuit, wherein the processing circuit is configured to:

intercept a request, via an agent plug-in installed on the RM server, originating from a first user account of a logged-in user on a client device to execute a command by the RM server and as a second user account on the RM server, wherein the first user account is assigned first privileges, the second user account is assigned second privileges, the request is transmitted over a network from the client device to the RM server, and the request is intercepted by the agent plug-in prior to receipt by an intended recipient on the RM server;

obtain information related to the request to execute the command;

determine whether to execute the command on the RM server by applying a policy to the information related to the request; and

in response to determining to execute the command, cause the command to be executed according to the second privileges in the second user account.

2 . The system of claim 1 , wherein the policy comprises a plurality of rules and the processing circuit is further configured to evaluate the information against the plurality of rules.

3 . The system of claim 1 , wherein the processing circuit is further configured to delegate the second privileges to a thread executing the command by providing the thread with a token, wherein the second privileges are assigned to the token.

4 . The system of claim 1 , wherein the agent plug-in is configured to be executed by the processing circuit and cause the processing circuit to intercept the request.

5 . A method, comprising:

intercepting, via an agent plug-in installed on an RM server, a request originating from a first user account of a logged-in user on a client device to execute a command by the RM server and as a second user account on the RM server, wherein the first user account is assigned first privileges, the second user account is assigned second privileges, the request is transmitted over a network from the client device to the RM server, and the request is intercepted by the agent plug-in prior to receipt by an intended recipient on the RM server;

obtaining, via the RM server, information related to the request to execute the command;

determining, via the RM server, whether to execute the command on the RM server by applying a policy to the information related to the request; and

in response to determining to execute the command, causing, via the RM server, the command to be executed according to the second privileges in the second user account.

6 . The method of claim 5 , further comprising:

capturing, via the RM server, a set of identities associates with the request; and

requesting, via the RM server, the policy based on the set of identities.

7 . The method of claim 6 , wherein the set of identities comprises at least one of: a user identity of the first user account, a user identity of the second user account, a group identity, and a process identity.

8 . The method of claim 5 , further comprising:

generating, via the RM server, a custom message based on the policy; and

causing, via the RM server, the custom message to be rendered on a display of the client device.

9 . The method of claim 5 , further comprising:

exposing, via the RM server, a function corresponding to a command execution plug-in function; and

receiving, via the RM server, the request via the exposed function.

10 . The method of claim 5 , further comprising providing a token to a thread executing the command, wherein the second privileges are assigned to the token.

11 . The method of claim 5 , further comprising:

calling a command execution plug-in function;

delegating the second privileges to the command; and

passing the command to the command execution plug-in function.

12 . The method of claim 5 , further comprising passive handling of the request based on the policy.

13 . A non-transitory computer-readable medium embodying a program that, when executed by a processing circuit of a remote management (RM) server, causes the processing circuit to:

intercept a request, via an agent plug-in installed on the RM server, originating from a first user account of a logged-in user on a client device to execute a command by the RM server and as a second user account on the RM server, wherein the first user account is assigned first privileges, the second user account is assigned second privileges, the request is transmitted over a network from the client device to the RM server, and the request is intercepted by the agent plug-in prior to receipt by an intended recipient on the RM server;

obtain information related to the request to execute the command;

determine whether to execute the command on the RM server by applying a policy to the information related to the request; and

in response to determining to execute the command, cause the command to be executed according to the second privileges in the second user account.

14 . The non-transitory computer-readable medium of claim 13 , wherein the program further causes the processing circuit to delegate the second privileges to an agent service and the agent service executes the command.

15 . The non-transitory computer-readable medium of claim 13 , wherein the program further causes the processing circuit to intercept the request from the first user account of the logged-in user on the client device by exposing a function corresponding to a command execution plug-in function and receiving the request via the exposed function.

16 . The non-transitory computer-readable medium of claim 13 , wherein the request originating from the first user account of the logged-in user on the client device to execute the command by the RM server is received from a terminal.

17 . The non-transitory computer-readable medium of claim 13 , wherein the program further causes the processing circuit to relay the command to a command execution plug-in provided by an operating system of the RM server.

18 . The non-transitory computer-readable medium of claim 13 , wherein the program further causes the processing circuit to:

intercept a connection request, from the client device, to connect to the RM server; and

control connection of the logged-in user on the client device to the RM server.

19 . The non-transitory computer-readable medium of claim 13 , wherein the program further causes the processing circuit to:

generate a custom message comprising a challenge-response based on the policy; and

receive a validation code to authenticate the first user account.

20 . The non-transitory computer-readable medium of claim 13 , wherein RM server is configured to generate responses for requests as the intended recipient unless the request is intercepted.