Enrolling a virtual device as an unprivileged user
Examples of enrollment of virtual devices for unprivileged users are described. In some examples, a virtual device includes an enrollment agent, encrypted enrollment credentials, and a user mode privilege elevation component that elevates privilege of the enrollment agent. A privilege elevated token is created to include an administrative privilege of a local security authority service, and a security context of an unprivileged user account logged in to the virtual device. The enrollment agent is launched using the privilege elevated token rather than a user token of a user that is logged in. The enrollment agent decrypts the encrypted enrollment credentials based on administrative privilege of the privilege elevated token, and enrolls the virtual device with a management service using decrypted enrollment credentials.
1. A method, comprising:
launching, by a virtualization service, a virtual device comprising: an enrollment agent, encrypted enrollment credentials, at least one user mode privilege elevation component that elevates privilege of the enrollment agent, and an operating system;
creating, by the at least one user mode privilege elevation component, a privilege elevated token comprising: an administrative privilege of a local security authority service, and a security context of an unprivileged user account logged in to the virtual device from a client device that is managed by a device management system;
changing, by the at least one user mode privilege elevation component, a primary token of the enrollment agent from a user token to the privilege elevated token; and
executing, by the virtual device, the enrollment agent using the privilege elevated token, wherein the enrollment agent: decrypts the encrypted enrollment credentials based on the administrative privilege of the privilege elevated token, and transmits an enrollment request that includes the decrypted enrollment credentials to a management service of the device management system to enroll the virtual device with the management service using the decrypted enrollment credentials.
2. The method according to claim 1 , wherein the virtual device comprises a plurality of agent privilege elevation components that includes at least one kernel mode privilege elevation component and the at least one user mode privilege elevation component.
3. The method according to claim 2 , further comprising:
intercepting, by the at least one kernel mode privilege elevation component, a launch of the enrollment agent; and
transmitting, by the at least one kernel mode privilege elevation component to the at least one user mode privilege elevation component, a process identifier of the enrollment agent prior to execution of the enrollment agent.
4. The method according to claim 3 , further comprising:
transmitting, from the at least one user mode privilege elevation component to the at least one kernel mode privilege elevation component, an indication to continue with process execution of the enrollment agent once the primary token of the enrollment agent is changed from the user token to the privilege elevated token.
5. The method according to claim 1 , wherein the privilege elevated token is created using: an unprivileged user token associated with the unprivileged user account, and a privileged token of the local security authority service.
6. The method according to claim 1 , further comprising:
executing, by the virtual device, a management agent as a child process of the enrollment agent, wherein the management agent uses the privilege elevated token based on being the child process of the enrollment agent.
7. The method according to claim 1 , wherein the virtual device is a virtual desktop infrastructure (VDI)-based virtual desktop.
8. A non-transitory computer-readable medium embodying instructions executable by at least one computing device, the instructions, when executed, causing the at least one computing device to at least:
launch, by a virtualization service, a virtual device comprising: an enrollment agent, encrypted enrollment credentials, at least one user mode privilege elevation component that elevates privilege of the enrollment agent, and an operating system;
create, by the at least one user mode privilege elevation component, a privilege elevated token comprising: an administrative privilege of a local security authority service, and a security context of an unprivileged user account logged in to the virtual device from a client device that is managed by a device management system;
change, by the at least one user mode privilege elevation component, a primary token of the enrollment agent from a user token to the privilege elevated token; and
execute, by the virtual device, the enrollment agent using the privilege elevated token, wherein the enrollment agent: decrypts the encrypted enrollment credentials based on the administrative privilege of the privilege elevated token, and transmits an enrollment request that includes the decrypted enrollment credentials to a management service of the device management system to enroll the virtual device with the management service using the decrypted enrollment credentials.
9. The non-transitory computer-readable medium according to claim 8 , wherein the virtual device comprises a plurality of agent privilege elevation components that includes at least one kernel mode privilege elevation component and the at least one user mode privilege elevation component.
10. The non-transitory computer-readable medium according to claim 9 , wherein the instructions, when executed, cause the at least one computing device to at least:
intercept, by the at least one kernel mode privilege elevation component, a launch of the enrollment agent; and
transmit, by the at least one kernel mode privilege elevation component to the at least one user mode privilege elevation component, a process identifier of the enrollment agent prior to execution of the enrollment agent.
11. The non-transitory computer-readable medium according to claim 10 , wherein the instructions, when executed, cause the at least one computing device to at least:
transmit, from the at least one user mode privilege elevation component to the at least one kernel mode privilege elevation component, an indication to continue with process execution of the enrollment agent once the primary token of the enrollment agent is changed from the user token to the privilege elevated token.
12. The non-transitory computer-readable medium according to claim 8 , wherein the privilege elevated token is created using: an unprivileged user token associated with the unprivileged user account, and a privileged token of the local security authority service.
13. The non-transitory computer-readable medium according to claim 8 , wherein the instructions, when executed, cause the at least one computing device to at least:
execute, by the virtual device, a management agent as a child process of the enrollment agent, wherein the management agent uses the privilege elevated token based on being the child process of the enrollment agent.
14. The non-transitory computer-readable medium according to claim 8 , wherein the virtual device is a virtual desktop infrastructure (VDI)-based virtual desktop.
15. A system, comprising:
at least one computing device; and
instructions accessible by the at least one computing device, wherein the instructions, when executed, cause the at least one computing device to at least:
launch, by a virtualization service, a virtual device comprising: an enrollment agent, encrypted enrollment credentials, at least one user mode privilege elevation component that elevates privilege of the enrollment agent, and an operating system;
create, by the at least one user mode privilege elevation component, a privilege elevated token comprising: an administrative privilege of a local security authority service, and a security context of an unprivileged user account logged in to the virtual device from a client device that is managed by a device management system;
change, by the at least one user mode privilege elevation component, a primary token of the enrollment agent from a user token to the privilege elevated token; and
execute, by the virtual device, the enrollment agent using the privilege elevated token, wherein the enrollment agent: decrypts the encrypted enrollment credentials based on the administrative privilege of the privilege elevated token, and transmits an enrollment request that includes the decrypted enrollment credentials to a management service of the device management system to enroll the virtual device with the management service using the decrypted enrollment credentials.
16. The system according to claim 15 , wherein the virtual device comprises a plurality of agent privilege elevation components that includes at least one kernel mode privilege elevation component and the at least one user mode privilege elevation component.
17. The system according to claim 16 , wherein the instructions, when executed, cause the at least one computing device to at least:
intercept, by the at least one kernel mode privilege elevation component, a launch of the enrollment agent; and
transmit, by the at least one kernel mode privilege elevation component to the at least one user mode privilege elevation component, a process identifier of the enrollment agent prior to execution of the enrollment agent.
18. The system according to claim 17 , wherein the instructions, when executed, cause the at least one computing device to at least:
transmit, from the at least one user mode privilege elevation component to the at least one kernel mode privilege elevation component, an indication to continue with process execution of the enrollment agent once the primary token of the enrollment agent is changed from the user token to the privilege elevated token.
19. The system according to claim 15 , wherein the privilege elevated token is created using: an unprivileged user token associated with the unprivileged user account, and a privileged token of the local security authority service.
20. The system according to claim 15 , wherein the instructions, when executed, cause the at least one computing device to at least:
execute, by the virtual device, a management agent as a child process of the enrollment agent, wherein the management agent uses the privilege elevated token based on being the child process of the enrollment agent.