# Privilege Manager > Grant standard users elevated rights through session and process elevation, including UAC prerequisites and elevation rules. Source: https://docs.capaone.com/capaone/privilege-manager/ Product: CapaOne — a separate CapaSystems product; do not apply this page to any other. :::caution If your endpoints are hybrid-joined, we strongly recommend using only on-prem AD groups for validation. ::: ## How Privilege Manager works Privilege Manager enables specified users without local administrator permissions to perform actions with elevated privileges. *Session elevation* enables specified users to control system settings and install or remove any application with elevated privileges. *Session elevation* is less restrictive than process elevation. *Process elevation* enables specified users to execute EXE and MSI files with elevated privileges. *Process elevation* can be used to control exactly which processes users are allowed to execute with elevated privileges. ## Session elevation If you want to use session elevation, you need to enable it in the “Security” section. ![Session elevation toggle in the Security section](/attachments/capaone/f1113555-909a-4bae-a48a-e23e43d4a209.png) Afterward, specify the users/groups that are allowed to use session elevation in the “Validation” section. ![Validation section listing users and groups allowed to use session elevation](/attachments/capaone/6b88e7ce-265a-4800-bee7-b694bdac82a0.png) Users/groups that are “Denied” from session elevation can still use process elevation. The process elevation rules are not effective during session elevation, unless process elevation is used. To start a session elevation, a user must click on the CapaOne tray icon and then click the “Start” button. ![Starting a session elevation from the CapaOne tray icon](/attachments/capaone/37278c7d-2e54-4dda-be97-0d8c1d639aaa.webp) ## Process elevation When users want to execute a single process with elevated privileges, all they have to do is right-click the process and select “Run with Admin Privileges” If *Informational Text* is enabled it will be presented to the user. If *Confirmation Text* is enabled it will be presented to the user and must be confirmed before proceeding. ![Right-click menu with Run with Admin Privileges on a single process](/attachments/capaone/ed8b1962-a73d-443a-b8c5-a1f8cae26243.webp) ## Prerequisites ### User Account Control **General** Privilege Manager requires that User Account Control (UAC) is enabled and configured as described. Configuration can be applied using Group Policy Objects (GPO) or Windows Registry Database (REGDB). **User Account Control: Run all administrators in Admin Approval Mode** must be *Enabled* GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode REGDB: HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\\:1 (REG\_DWORD) ![GPO setting for Run all administrators in Admin Approval Mode set to Enabled](/attachments/capaone/ec01b690-c35e-4971-8795-bab444ee3c80.png) **User Account Control: Behavior of the elevation prompt for standard users** must be *Prompt for credentials* or *Prompt for credentials on the secure desktop*. GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users REGDB: HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\\:1 or 3 (REG\_DWORD) ![GPO setting for the standard-user elevation prompt set to Prompt for credentials](/attachments/capaone/c3725b4b-6474-4b28-894e-dcf94d8b4687.png) ### Configuration issues If User Account Control is disabled, an “access denied” message is presented. ![Access denied message shown when User Account Control is disabled](/attachments/capaone/4036cce1-4b2c-45aa-9762-e23e5ab75534.png) If User Account Control is enabled, but not configured correctly, a “blocking” message is presented. ![Blocking message shown when UAC is enabled but misconfigured](/attachments/capaone/01f7aba3-e44e-4305-8b4e-4dca180632cf.png) ## Process elevation rules ### Child processes All applications that use the Windows Command Prompt (*cmd.exe*) rely on the Console Window Host (*conhost.exe*) process to interact with other Windows components. As an example, the Console Window Host makes it possible to drag and drop files and folders from Windows Explorer to Windows Command Prompt. It is not uncommon to see multiple instances of the Console Window Host in the Task Manager. ![Multiple Console Window Host (conhost.exe) instances in Task Manager](/attachments/capaone/2b75b451-ed9f-45a1-ab96-62a2d2dc6fb6.png) PowerShell and Command Prompt both rely on the Console Window Host. As a result, you need to either allow all child processes (default) or specifically *conhost.exe* when you create a process elevation rule that allows *powershell.exe* or *cmd.exe* ![Process elevation rule allowing child processes such as conhost.exe](/attachments/capaone/c1194450-58dd-4ce2-844c-71f355abf24b.png) ## Hide Run as administrator You can hide the built-in “Run as administrator” option in the “Security” section. The built-in option can only be hidden when session elevation is disabled. ![Security section option to hide the built-in Run as administrator entry](/attachments/capaone/11f9fd18-d85c-4a26-839c-b473de991e8c.png) ![Right-click menu with the built-in Run as administrator entry hidden](/attachments/capaone/cdf0c752-14bd-4318-8be3-cb461b52e042.png) ## Troubleshooting - [Session Elevation denied](/capaone/troubleshooting/session-elevation-denied/) - [Missing Privileges](/capaone/troubleshooting/missing-privileges/) - [Orphaned User Accounts](/capaone/troubleshooting/orphaned-user-accounts/)