Avecto Privilege Guard

Over the past several years, AgIT has been gathering feedback and comments from on and off campus staff and faculty.

One issue that always comes up regards access and admin rights. AgIT has been listening and working to find a solution that will meet individual user needs as well as security requirements.

AgIT is happy to announce that a new service has been rolled out to help bridge this gap.  This service is called Privilege Management.  All AgIT-supported PC’s (AgIT is still investigating solutions for Macs) began to see a granular increase in access rights beginning Tuesday, May 14.  

This includes tasks such as installing and updating software, installing printer drivers from HP and several other vendors, defragmenting the hard drive, setting the time zone, etc.

You may see the following three screens when trying to install or run services that have previously required administrative privileges.

NOTE:  Some applications or services that in the past have been blocked will be 'whitelisted'.  This will allow for immediate install without a dialog box.

Managed Application

The 'Managed Application' dialog box appears for applications such as Internet Explorer, Adobe Flash, Microsoft Windows Updates, FileMaker, etc.  

The installation and updating of these applications is handled automatically by AgIT and cannot be executed manually.  When AgIT deploys a new version of this software, your computer will receive it automatically.

Application Blocked

The 'Application Blocked' dialog box appears when trying to do something that is normally blocked, such as installing torrent applications or unapproved security suites.  We ask that you submit a request that will be emailed back to AgIT Support Services.  

By submitting your request, AgIT will investigate and possibly include it in the 'whitelist' for future installs and updates by yourself and other users.  We encourage you to submit requests so other users can reap the benefits of possibly allowing this application.

Confirm Elevation

The Confirm Elevation box appears for a wide and ever increasing variety of applications that we will allow to be installed.  We will be asking for credentials to ensure that Purdue faculty and staff are making the request.

Instant Authorize

The 'Instant Authorize' option found in the right-click menu allows a user to install software using a one-time use code provide by AgIT when requested.  

This process allows software to be installed even when a user is not connected to the network.  Rules for 'Managed Applications' still apply.

NOTE: As AgIT moves forward, we will continue to gather more data and work to increase 'whitelist' applications and services. AgIT is always open to suggestions on what you would like to see added or if you have any questions about this new service. 

To generate an authorization code for Privilege Management Instant Authorize, please follow the instructions below.

Open PGChallengeResponseUI found at \\itsofs04.itap.purdue.edu\ag_Software\Applications\Windows - All\AgIT\Avecto.

Enter the 'Shared Key' found in the internal notes. The Specialist should have access to the Shared Key; it is departmental knowledge. Reach out to a team member or a supervisor if you are unaware of the Shared Key.

NOTE: The user will provide a challenge code from their own machine. They will need to right-click and select 'Instant Authorize' on the program they are attempting to run.

An 'Authorization Code' will then be generated. Provide this code to the user, have them enter it into their 'Instant Authorize' window. Have them click 'Yes.'

To use the Instant Authorize feature in Privilege Management, follow the instructions below.

1. Right-click on the file that needs to be installed, and select 'Instant Authorize.'
   
   
   
   
2. A window will open with a number listed. Contact AgIT Support Services and provide the number shown on the screen.
   
   
3. Enter the 'Authorization Code' provided from AgIT into the box, and click 'Yes.' At this point, the software installation will begin.
   
   
   
   NOTE:  The Authorization Code provided from AgIT is only a one-time use.  After the code is used or the Instant Authorize window is closed, the code will no longer work.

You have two options for using Avecto as an Admin to generate Response codes, via shortcut or via .exe.

Creating a desktop shortcut:

Make a shortcut on your desktop to:

• Z:\Applications\Windows - All\AgIT\Avecto\PGChallengeResponseUI.exe

OR (without a Z: drive mapping)

• \\itsofs04.itap.purdue.edu\ag_Software\Applications\Windows - All\AgIT\Avecto\PGChallengeResponseUI.exe