Endpoint Privilege Manager
Endpoint Privilege Manager (EPM) removes standing local administrator rights from endpoints and re-grants only the elevation that each task genuinely needs. Exam items focus on which policy type achieves a given outcome, how policies interact, and what happens when the agent is absent or unmanaged.
Components
An EPM agent runs on each endpoint; the EPM Server (management application plus database, with the web console hosted on IIS) is deployed on-premises. An agent that is not installed, or that sits in an unmanaged state, enforces nothing - the endpoint simply keeps its original administrative rights.
Policy types
- Elevation policies define who (users or AD groups), where (computer groups), what (an application identified by hash, path, file name or publisher), and with which conditions (justification prompt, approval workflow, time limit).
- Application control policies block or allow execution using publisher, hash, path or file name; trusted sources allow any binary signed by a specified publisher catalogue.
- Ransomware protection uses protected folders and honeypot files, blocking unauthorised processes from modifying them.
- Credential theft protection stops processes from reading LSASS memory and blocks common credential-dumping tools.
Evaluation order
Policies combine rather than replace each other. An explicit block takes precedence; a request that matches no elevation rule runs unelevated rather than failing.
Worked example
An internally developed application signed by the company certificate is allowed by a hash rule. After a routine update the hash changes, the application is blocked and users cannot work. Reasoning: hash rules are exact and do not survive version changes. The correct remediation is to replace the hash rule with a publisher-certificate rule so that every signed build is trusted, while unsigned drops remain blocked.
Deployment notes
Run new rules in audit mode before enforcing, target policies at computer groups rather than individual machines, and remember that a user who still holds standing local admin rights can bypass most agent controls.
Traps
Confusing an elevation policy (grants administrative rights) with application control (permits or denies execution). Expecting EPM to vault credentials - it does not. Assuming blocking rules can be overridden by a matching allow rule.