Enabling users to perform operations that require elevated privileges
Users can be enabled to perform operations that require elevated privileges in a controlled manner. An agent can be executed on a user's computing device with admin privileges. When the user desires to perform an operation that user's privileges do not allow, the user can submit a request to an administrator. If the administrator approves the request, the agent can be notified that an operation needs to be performed. The agent can then obtain the necessary information for performing the operation and either perform the requested operation directly or perform one or more other operations to enable the user to perform the requested operation. In cases where the agent's actions grant elevated privileges to the user, the agent can be further configured to revoke the elevated privileges at a subsequent time to thereby prevent the user from retaining elevated privileges indefinitely.
1. A method for enabling a user to perform operations that require elevated privileges on a thin client when the user does not have admin privileges and without requiring input of admin credentials, the method comprising:
while the user that does not have admin privileges is logged in to the thin client, executing an agent with admin privileges on the thin client;
receiving, at the thin client, user input that identifies a particular operation that the user would like to perform on the thin client but that requires elevated privileges on the thin client such that the logged-in user that does not have admin privileges cannot perform the particular operation on the thin client without input of admin credentials;
in response to the user input, sending, by the thin client, a request to a management server, the request identifying the particular operation;
receiving, at the management server, administrator input that approves the particular operation;
in response to receiving the administrator input, sending, by the management server and to the agent that is executing with admin privileges on the thin client, a notification that the particular operation has been approved; and
in response to receiving the notification, performing, by the agent using the admin privileges and while the user that does not have admin privileges remains logged in to the thin client, the particular operation on the thin client or performing one or more other operations on the thin client to enable the user to perform the particular operation such that the particular operation is performed without input of admin credentials.
2. The method of claim 1 , wherein the particular operation comprises changing a setting of the thin client.
3. The method of claim 2 , wherein the notification includes a value that the setting is to be set to.
4. The method of claim 1 , wherein the one or more other operations comprise granting elevated privileges to the user.
5. The method of claim 1 , wherein, in response to receiving the notification, the agent first retrieves, from the management server, information to be used to perform the particular operation on the thin client and then performs the particular operation using the retrieved information.
6. The method of claim 1 , wherein the agent periodically polls the management server to determine whether the user has requested any operations, and the agent receives the notification in response to the periodic polling.
7. The method of claim 1 , wherein the particular operation or the one or more other operations comprise granting access to a function on the thin client, the method further comprising:
performing another operation at a subsequent time to revoke the access to the function.
8. The method of claim 7 , wherein the subsequent time is defined in conjunction with the receipt of the notification, or is defined in a subsequent notification.
9. The method of claim 7 , wherein the subsequent time is a duration of time from a time when the particular operation is performed or is a subsequent event.
10. The method of claim 1 , wherein the user input that identifies the particular operation is received via a user interface that allows the user to select from among a number of operations that require elevated privileges on the thin client.
11. The computer storage media of claim 1 , wherein the particular operation comprises changing a setting of the thin client.
12. The computer storage media of claim 11 , wherein the notification includes a value that the setting is to be set to.
13. One or more computer storage media storing computer executable instructions which when executed implement a method for enabling a user to perform operations that require elevated privileges on a thin client when the user does not have admin privileges and without requiring input of admin credentials, the method comprising:
while the user that does not have admin privileges is logged in to the thin client, executing an agent with admin privileges on the thin client;
receiving, at the thin client, user input that identifies a particular operation that the user would like to perform on the thin client but that requires elevated privileges on the thin client such that the logged-in user that does not have admin privileges cannot perform the particular operation on the thin client without input of admin credentials;
in response to the user input, sending, by the thin client, a request to a management server, the request identifying the particular operation;
receiving, at the management server, administrator input that approves the particular operation;
in response to receiving the administrator input, sending, by the management server and to the agent that is executing with admin privileges on the thin client, a notification that the particular operation has been approved; and
in response to receiving the notification, performing, by the agent using the admin privileges and while the user that does not have admin privileges remains logged in to the thin client, the particular operation on the thin client or performing one or more other operations on the thin client to enable the user to perform the particular operation such that the particular operation is performed without input of admin credentials.
14. The computer storage media of claim 13 , wherein the one or more other operations comprise granting elevated privileges to the user.
15. The computer storage media of claim 13 , wherein, in response to receiving the notification, the agent first retrieves, from the management server, information to be used to perform the particular operation on the thin client and then performs the particular operation using the retrieved information.
16. The computer storage media of claim 13 , wherein the agent periodically polls the management server to determine whether the user has requested any operations, and the agent receives the notification in response to the periodic polling.
17. The computer storage media of claim 13 , wherein the particular operation or the one or more other operations comprise granting access to a function on the thin client, the method further comprising:
performing another operation at a subsequent time to revoke the access to the function.
18. The computer storage media of claim 17 , wherein the subsequent time is defined in conjunction with the receipt of the notification, or is defined in a subsequent notification.
19. The computer storage media of claim 17 , wherein the subsequent time is a duration of time from a time when the particular operation is performed or is a subsequent event.
20. A method for enabling a user to perform operations that require elevated privileges on a thin client when the user does not have admin privileges and without requiring input of admin credentials, the method comprising:
while the user that does not have admin privileges is logged in to the thin client, executing an agent with admin privileges on the thin client;
providing, on the thin client, a user interface that presents a plurality of operations that require elevated privileges on the thin client and that enables the user to select from among the operations;
receiving, via the user interface, user input that selects a particular operation of the plurality of operations, the user input indicating that the user would like to perform the particular operation on the thin client;
in response to the user input, sending, by the thin client, a request to a management server, the request identifying the particular operation;
receiving, at the management server, administrator input that approves the particular operation;
in response to receiving the administrator input, sending, by the management server and to the agent that is executing with admin privileges on the thin client, a notification that the particular operation has been approved; and
in response to receiving the notification, performing, by the agent using the admin privileges and while the user that does not have admin privileges remains logged in to the thin client, the particular operation on the thin client or performing one or more other operations on the thin client to enable the user to perform the particular operation such that the particular operation is performed without input of admin credentials.