Endpoint Privilege Manager (EPM)
Purpose and Components
Endpoint Privilege Manager removes standing local admin rights from endpoints while still allowing users to run approved tasks with elevated privilege. The core components are the EPM Agent on endpoints, the EPM Server (policy and management), and policy sets that define what is allowed. Policies can elevate (run with higher privilege), block, or audit application execution. A classic trap is confusing EPM with PSM: EPM governs endpoint application privilege, PSM governs privileged sessions to servers. If a question mentions removing local admin from laptops, think EPM.
Application Control and Elevation
EPM uses application control rules to allow, block, or elevate executables, often keyed on file attributes like hash or publisher signature. Hash-based rules are precise but break when the binary updates; publisher/signature rules survive version changes. Questions frequently test this trade-off. Just-in-time elevation grants privilege only for a specific action rather than permanently.
Policy Precedence and Traps
When multiple policies match, precedence matters: explicit block rules typically override allow/elevate rules. Another trap is assuming EPM replaces antivirus; it is privilege and application control, not malware scanning. Also, EPM does not store privileged account passwords; that is the Vault's job.
Worked Example and Rule of Thumb
A helpdesk user must install an approved vendor tool without permanent admin rights. The answer is an EPM elevation policy scoped to that application (ideally publisher-based) with just-in-time elevation, not granting local admin. Rule of thumb: elevate the task, not the user.
Auditing
EPM logs application elevation and block events, supporting compliance evidence that users operate without standing admin rights.