Privilege Elevation and Delegation Management (PEDM) (Windows)

Dive into the Privilege Elevation and Delegation Management (PEDM) module—your complete solution for dynamic user rights control. PEDM simplifies the process of elevating user rights or file executions while fully supporting zero-trust executions and instant revocations. Its intuitive, lightweight interface gives you complete control over every elevated session. Approve or deny requests instantly from the HEIMDAL Dashboard or your mobile device. With PEDM, you can effortlessly track sessions, enforce escalation periods, and even live-cancel admin rights or block elevation for sensitive system files.

1. Description
2. How does Privilege Elevation and Delegation Management work?
3. HEIMDAL Agent - Privilege Elevation and Delegation Management
4. Privilege Elevation and Delegation Management view
5. Privilege Elevation and Delegation Management settings

DESCRIPTION

Privilege Elevation and Delegation Management is a PEDM tool that can be used to give users the ability to install software they need for a period of time you select, using the Administrator Session or the Run with Admin Privileges option for single-file elevation. Rights granted can be revoked at any time, and actions are logged for a full audit trail. This is the feature that allows an end-user to request admin privileges over his/her machine by sending a request to the HEIMDAL Dashboard Administrator, who can deny or accept his/her request. The length of the session is limited, and all his/her actions are logged into the HEIMDAL Dashboard. 

HOW DOES PRIVILEGE ELEVATION AND DELEGATION  ACCESS MANAGEMENT WORK?

Privilege Elevation and Delegation Management (PEDM) is the HEIMDAL Agent component responsible for dynamic management of user permissions. It functions on all endpoints (domain or non-domain) and is controlled by the dedicated Heimdal Admin Privilege service (Heimdal.AdminPrivilege.exe). PEDM offers flexibility, capable of running under either the SYSTEM context or the USER context. This flexibility allows you to deploy PEDM for two primary use cases: Run with PEDM/Run as administrator, which grants elevation for a single file execution, or a broader Administrator Session, which provides temporary, full administrator rights.
  

 

A. Run with PEDM/Run as administrator

The Run with PEDM/Run as administrator functionality provides granular, temporary elevation for select file types, including .exe, .msi, .msc, .cmd, and .cpl. When running under the SYSTEM context, upon execution, the file is typically run by the NT Authority\System account, granting it the necessary Administrator permissions. When running under the USER context (User context elevation needs to be enabled in the Group Policy settings), upon execution, the process runs using the logged-in user's security context instead. The user is presented with the Run with PEDM context menu option, whether running under SYSTEM or USER context:

When disabling the Windows UAC (Disable Windows consent needs to be enabled in the Group Policy), the HEIMDAL Agent enforces the the HEIMDAL UAC, and the custom Run as administrator option is available within the context menu. 

IMPORTANT
To successfully execute files directly from a Network Drive (Shared Folder) using this feature, you must have User context elevation enabled.

If the Require reason option is enabled in the Group Policy, then the pop-up below will appear to add details for the elevation request (more than 2 characters should be added to be able to submit the elevation request reason). This step is skipped if the 'Require reason' option is disabled. The Other option in the dropdown is the only option that requires at least 30 characters to be able to submit the elevation request reason.

After clicking Elevate, depending on the Group Policy configuration, a request can be sent to the server to ask permission from the HEIMDAL Dashboard Administrator (if Approval via Dashboard is selected in the GP), and the following toaster notification will be displayed to the user: 
 

When a HEIMDAL Dashboard Administrator approves the elevation, or it is automatically granted (if Auto-mode is selected in the Group Policy settings), the following toaster notification will appear:

The elevation starts after pressing the Start Now button, and the following toaster notification informs the user that the file has been elevated.

IMPORTANT
The response to an elevation request is automatically propagated to the HEIMDAL Agent within a 5-minute interval after being approved by the HEIMDAL Dashboard Administrator. 

B. Administrator Session

The Administrator Session feature allows the user who is requesting elevation to get elevated for a specific number of minutes to run applications/processes with Administrator rights. When an Administrator Session elevation is started, the requesting user is temporarily promoted as a member of the local Administrators group (this feature supports computers managed through Azure Active Directory, Active Directory, or hybrid setups). This will ensure that the user can use his/her own credentials (username and password) to run processes/applications. To run a process/application with Administrator rights, you need to right-click the executable file and click Run as Administrator (just like you would if your user were already an Administrator), and when you get prompted by the UAC, you need to type in your user credentials (because your user has been temporarily elevated to Administrator level). 
Elevations can be requested from the HEIMDAL Agent by pressing the Elevate button, or by going into the System Tray and right-clicking the Heimdal icon and selecting Request admin rights. 
If the Require reason option is enabled in the Group Policy, then the pop-up below will appear to add details for the elevation request (more than 2 characters should be added to be able to submit the elevation request reason). This step is skipped if the 'Require reason' option is disabled. The Other option in the dropdown is the only option that requires at least 30 characters to be able to submit the elevation request reason.

After clicking Elevate, depending on the Group Policy configuration, a request can be sent to the server to ask permission from the HEIMDAL Dashboard Administrator (if Approval via Dashboard is selected in the GP), and the following toaster notification will be displayed to the user: 

When a HEIMDAL Dashboard Administrator approves the elevation, or it is automatically granted (if Auto-mode is selected in the Group Policy settings), the following toaster notification will appear:

The elevation starts after pressing the Start Now button, and the following toaster notification informs the user that the file has been elevated.

IMPORTANT
The response to an elevation request is automatically propagated to the HEIMDAL Agent within a 5-minute interval (or in less than a minute if Real-time communication is enabled on the Group Policy that is applying to the endpoint) after being approved by the HEIMDAL Dashboard Administrator.

• On multi-user sessions that usually occur on Windows Servers acting as RDP/Terminal Servers, the Do not show GUI option is required to stop the HEIMDAL Agent from wasting CPU and Memory. In this type of case, an elevation can be requested using the Heimdal Session Elevator for Servers (by pressing the Start button), which will differentiate between the requesting users. 
   
• While the option Do not show GUI is in effect, the Run with PEDM functionality will not work, and the Reason window will not show up. To use Run with PEDM, you must first use Heimdal Session Elevator for Servers, which will trigger the GUI and start an elevated session. If you use Run with PEDM during elevation, the file will be elevated as part of the session (a new File elevation will NOT be created, and the elevated process will appear as part of the existing elevation).
• For cases where you connect to a device through RDP or Hyper-V enhanced mode, you must have the the User context elevation enabled in the Group Policy so that the Run with PEDM mechanism can work properly on the device.

HEIMDAL AGENT - PRIVILEGE ELEVATION AND DELEGATION MANAGEMENT

On the HEIMDAL Agent's home page view, you can see the current status of the Agent and the modules that are enabled for your computer. To access the Privilege Elevation and Delegation Management module, you can click on the Privileges & App Control icon or use the left-side menu. 

The Privilege Elevation and Delegation Management module displays information about the elevation requests made on the endpoint and gives the user (or a supporter) the ability to request elevation. 

Pressing the Elevate button will elevate the user or will display a reason for elevation pop-up to be sent to the HEIMDAL Dashboard.
The Sign In button becomes available when the HEIMDAL Dashboard administrator enables the Azure Login functionality from the Group Policy settings. Azure Login will allow pre-selected users (based on the mentioned Azure AD Group) to log in using their Azure AD account and elevate as Administrator (on their account) instead of the logged-in user. The information displayed in the Privilege Elevation and Delegation Management section is reported to the HEIMDAL Dashboard -> Privileges & App Control -> Privilege Elevation and Delegation Management. The HEIMDAL Agent's context menu allows you to request an Administrator Session elevation or to run a series of Windows applications that can be handy for users or IT Administrators.
The Tools menu will be greyed out in the following scenarios:
-Allow run as administrator is disabled;
-Allow run as Administrator is disabled and Do not allow Run with AP when session is elevated is enabled, the user is not elevated;
-the user is elevated, or is found in the local Administrators group;
-Deny elevation of system files is enabled.

PRIVILEGE ELEVATION AND DELEGATION MANAGEMENT view

The Privilege Elevation and Delegation Management view displays all the information collected by the HEIMDAL Agent that is running on the endpoints in your organization. The collected information refers to the elevation requests, the processes that are running during the elevations, the Zero-Trust processes that are executed in your environment, and the Primary User Management. 

A. PEDM

At the top, you see a statistic regarding the number of Pending Requests and the number of used Admin Rights.

The collected information is placed in the following views: Pending Approvals, History, Most Escalated Process, Most Escalating Hostname, Compliance, and Zero-Trust Execution Protection.

• Pending Approvals
  This view displays a table with the pending elevation requests and the following details: Hostname, Username, Reason given, Request Time, Type, Application, and Status. If the Status is Requested and written in red, this means the endpoint is running a 3rd-party application that has a vulnerability with a CVSS score of 7 or higher. 
  
  Clicking on the process listed under the Application column, you will get additional information regarding the elevated process: Full Path, Publisher, Version, and MD5.
  When you select an elevation request, you have the option to send a message to the user by enabling the Administrator message tickbox and filling in your message.
   
  The Pending Approvals view includes advanced filtering options that allow administrators to refine and narrow down elevation requests based on multiple criteria, including the operating system (Devices OS), elevation type such as Session, File, IASME Session, IASME File or non‑elevated executions, and request status such as Requested, Awaiting elevation, Awaiting file elevation, or requests restricted due to risk‑based conditions. These filtering capabilities enable administrators to quickly identify and prioritize elevation requests, improve visibility over pending actions, and streamline approval workflows in environments with a high volume of requests.

• History
  This view displays a table with the elevated/de-elevated requests and the following details: Hostname, Username, Start Time, End Time (an info bubble with the number of extensions is displayed when an elevated session has been extended), Reason Given, Action, Executed Process(es), Handled By:
  
  Process Details will provide all the additional information related to a process that has been executed via PEDM. You can access this view just by pressing on one of the processes listed in the Executed Process column.
  
  The History view includes filtering options that enable administrators to efficiently navigate past elevation events by refining results based on criteria such as operating system (Devices OS) and elevation type, including Session, File, IASME Session, IASME File, or non‑elevated executions. These capabilities allow administrators to quickly isolate relevant elevation activity, improve auditing and troubleshooting workflows, and efficiently analyze historical data across endpoints, while maintaining consistency in filtering behavior and terminology across PEDM views.

  

• Most Executed Processes
  This view displays a table with the number of executed processes (during the elevated session) and the following details: Process Name, Number of Executions, Hostname, and Username. If you use Application Control next to Privilege Elevation and Delegation Management, and need to allow or block an executed application, you can select the elevated application from the Most Executed Processes view and add it via a rule in the Application Control module. Select the process, and from the drop-down menu, select the action you want to take.
  
• Most Escalating Hostname
  This view displays a table with the number of escalating hostnames and the following details: Hostname, Username, and Total Number of Elevations.
  
• Compliance
  This view displays a table with the compliant endpoints and the following details: Hostname, Active User, Domain Name, Local Groups, AD Groups, and Admin rights (Y/N). The Local Group field populates if the active user is found in any of the local groups or AD Groups. If it is found, it is marked as Admin (Yes). 
  
• Zero - Trust Execution Protection
  
  This view displays a table with the processes (non-signed executable files) intercepted by the Zero-Trust Execution Protection engine and the following details: Hostname, Username, Process Name, MD5 Hash, Timestamp, and Status. Clicking the 3-dot button will give you the option to search the file hash on VirusTotal or to copy the file path to the Clipboard. The status of detection can be: Unknown (intercepted by ZTEP and not found in our database; files that are whitelisted globally by the Heimdal Support Team propagate to the endpoints after 3 days since the whitelist), Allowed (intercepted by ZTEP, but whitelisted in our database or the Exclusion list). The data in this view gets updated in real-time.
  
  Selecting a file from the list allows you to add it to the exclusion list or upload it to the storage. 

The tables in each view have a 60-second refresh rate.

B. Primary User Management

In environments with hundreds or thousands of computers, which are often used by multiple users, IT Administrators might want to restrict the ability for users to request elevation to only a predominant user on that specific device. This can be achieved with Primary User Management. On the top, you see a statistic regarding the number of AAD Primary Users, First login primary users, Most logins primary users, and the number of Unassigned hostnames.

In the Standard view, you see a grid containing information about endpoints and their primary users listed as follows: Hostname, Primary user (set on the device), AAD Primary user (the source used to fetch the Primary user, Azure AD or first logged-in user), Most logins user (the user with the highest number of logins in the last 30 days), and Action (a dropdown that allows you to select between the users that logged-in on the device in the last 30 days).

The grid allows you to assign a Primary User by selecting it from the Action dropdown, or you can unassign a Primary User.
Assigning a Primary User
To assign a Primary User, you just need to click on the Action dropdown and select a user that you want to be assigned as Primary User on the specific endpoint. The dropdown includes all the users who have been logging in on each machine during the last 30 days:
When one of the users is selected, a pop-up window will appear, displaying the hostname, the old primary user selection, and the new one, asking you to confirm if you want to update the assignment. 

On the HEIMDAL Agent side, only the user who is configured as Primary User will get the ability to request an elevation (single-file or Administrator Session), while other logged-in users will not be able to elevate.

IMPORTANT

In case there are any WIP elevations in use on the endpoint while a new Primary User info is received, all the elevations will be terminated immediately, and the Elevate button will be grayed out. Also, the Run with Admin Privileges option from the context menu (used for file elevations) will be removed. In case Primary Users is enabled and one of the non-Primary Users wants to request a file elevation while Disable Windows Consent is enabled, the custom consent window will display the following message:

Unassigning a Primary User
To unassign a Primary User, you just need to select a hostname in the grid and apply the Unassign primary user action:
Post clicking on the action, a confirmation modal window will be displayed, showing the hostname(s) and corresponding user(s) which will be unassigned as primary user(s):

The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode corresponding to each view. The Filters button allows you to filter by criteria specific to each section.

PRIVILEGE ELEVATION AND DELEGATION MANAGEMENT SETTINGS

The Privilege Elevation and Delegation Management module allows you to give users the ability to install the software they need for a period you select, using the Administrator Session or the Run with PEDM option for single-file elevation. Rights granted can be revoked at any time, and actions are logged for a full audit trail. This is the feature that allows an end user to request admin privileges over their machine by sending a request to the Heimdal Dashboard System Administrator, who can approve or deny it.

Privilege Elevation and Delegation Management - turns the Privilege Elevation and Delegation Management module ON or OFF.

Note: Some of the options described below are only visible when Advanced mode is enabled in the Group Policy editor.

General Settings

Elevation start window - defines a time limit within which an elevation requester must initiate the approved elevation before the temporary privilege is automatically revoked. If the approved session is not started within the configured window, it is revoked. If this option is disabled, approved elevations are revoked after 24 hours.
Elevation start interval [hours] - sets the time limit (1 to 24 hours) used by the Elevation start window option.
Predefined elevation response message - allows Heimdal Dashboard Administrators to send a predefined message to the endpoint when accepting or revoking an elevation request. When enabled, configure at least one of the two sub-options, and provide the corresponding message text:

• Add approval message - the message sent when a request is approved.
• Add denial message - the message sent when a request is denied.

Deny the elevation of System files - automatically detects and prevents system files (e.g., cmd.exe, powershell.exe, services.msc) from obtaining elevated privileges, safeguarding against privilege-escalation attacks.
De-elevate and block elevation for users with risk of infections - automatically removes Administrator privileges and blocks elevation requests for a user whose endpoint has had malware detections by the Heimdal Agent's Next-Gen Antivirus or VectorN Detection in the past 7 days.
Deny elevation request if CVSS is equal/higher than 7 - denies an elevation request if a 3rd-party application managed by the Heimdal Agent (through 3rd Party Patch Management) is detected as vulnerable, with a CVSS score of 7 or higher, when Approve elevation requests automatically is enabled. This applies to endpoints where 3rd Party Patch Management is enabled.

One-Time use admin account - securely elevates privileges using a temporary admin account (prefixed HeimdalUser-xxxxx). The account is deleted immediately after use, fulfilling IASME compliance requirements. In the Heimdal Dashboard, these elevations appear as IASME Session-type entries in both the Pending Approvals and History views; hovering over the icon next to the elevation type reveals the specific user identity that is or has been elevated.

Note: To be IASME compliant, the following options have to be enabled in the Group Policy settings:

• One-Time use admin account
• User context elevation
• No Administrator session (file elevation only allowed)

Hostname-Username match elevation - allows a standard user to request temporary administrative privileges only if their username is found within the hostname of the endpoint from which the request is initiated. The username must be separated from the rest of the hostname by the "-" (hyphen) character (e.g., MyLaptop-Username1 or Username1-MyLaptop).
PEDM compliance data retrieval - allows the Heimdal Agent to retrieve information about the Administrators found on the endpoints running the Heimdal Agent.
Multi-Factor authentication - requires an MFA code for any type of elevation request, after which it proceeds according to the flow configured in the Group Policy. Once activated, the end user receives an MFA pop-up with a QR code for registration using an authenticator application.

• Heimdal MFA uses a Time-based One-Time Password (TOTP) mechanism, where the authentication code is generated locally on the device using a shared secret between the Heimdal Agent and the authenticator application. Because validation is performed locally, this method does not require an active internet connection and can function offline.
  
• Microsoft MFA typically relies on push-based authentication, which requires communication with Microsoft's authentication services to trigger a challenge (such as a push notification or number-matching request). An active internet connection is required for this method to function.
  

Offline authentication is supported only when using Heimdal MFA, based on the TOTP mechanism.

IMPORTANT
When using the Microsoft MFA option in PEDM, the MFA validation depends on the user's Microsoft Entra ID MFA configuration. PEDM Microsoft MFA relies on the Per-User MFA setting (Enforced). If Multi-Factor Authentication is not enabled and enforced for the user at this level, PEDM will not be able to trigger a Microsoft MFA challenge, and the elevation request will not proceed through MFA verification. Conditional Access policies are not used by PEDM for triggering MFA challenges, so configurations where MFA is enforced only through Conditional Access may not trigger the expected behavior. To ensure correct functionality, users must have a valid Microsoft MFA method configured (such as Microsoft Authenticator, FIDO2, or SMS) and must have Per-User MFA set to Enforced in Microsoft Entra ID.

Resetting the authenticator: Heimdal Agent -> Settings -> Privileges and App Control -> Privilege Elevation and Delegation Management -> Reset MFA button. The password to reset the MFA is the Master Uninstall Password, which can be generated in the Heimdal Dashboard under Guide -> Your Heimdal activation key.

Primary user - allows only the primary user to request admin privileges on that specific machine. The Heimdal Agent collects information (over 30-day timeframes) about each user that logs in on that machine to determine the primary user, based on the selected settings:

• Primary user based on Azure AD (Entra ID) - sets the primary user to the one defined in the Microsoft Entra ID (Azure AD) configuration, retrieved through a Microsoft Graph API call if available.
• Primary user based on first login - sets the primary user to the first non-admin user to log in on each machine in the Group Policy where the feature is enabled, whether a local or a domain account.

Note: If both options are enabled, the Azure AD (Entra ID) setting takes priority over the first-login mechanism when determining the primary user.

Webhooks - allow IT Administrators to manage elevations from their own 3rd-party management applications. When enabled, you can configure up to 5 webhooks, each with a Friendly Name and a target URL:

• Adaptive card - when enabled (default), the payload is sent as an Adaptive Card, allowing for a rich, interactive experience. If disabled, the payload is sent as a simple JSON object.

Run with PEDM

"Run with PEDM" allows standard users to perform on-demand elevation for individual executable files, granting temporary administrative privileges for that specific task (single-file elevation).

Run with PEDM (Run as administrator) - turns the single-file elevation request feature ON or OFF.
Require reason - the Heimdal Agent displays a pop-up requesting a reason for the elevation. You can also enable Require phone number, Require email address, and Number of characters for the elevation reason (if the character-limit option is disabled, the default range remains 30–1000 characters).
Approve elevation requests automatically - all single-file elevation requests are automatically approved and listed in the Heimdal Dashboard (under Products -> Privileges & App Control -> Privilege Elevation and Delegation Management -> History).
Approve elevation requests from the Heimdal Dashboard - all single-file elevation requests require the approval of the Heimdal Dashboard Administrator (or the PEDM app). Pending elevations are displayed in the Heimdal Dashboard (under ... -> Pending Approvals). Once approved, the requesting user can start the session after receiving a Start elevation pop-up (displayed automatically within 1–5 minutes).

Approve elevation requests with a local token - requires the requesting user to enter a local token (whether the endpoint is online or offline) provided by the Heimdal Dashboard Administrator. A local token can be generated from each client's specifics in the Privileges & App Control tab -> Privilege Elevation and Delegation Management.

Online/Offline elevation approval - automatically adapts the elevation approval method based on the endpoint's online status: when online, requests are routed to the Heimdal Dashboard (or PEDM app) for real-time approval; when offline, the request can be approved via the local token provided by the Administrator. Data about an elevation that occurred while offline is passed to the Heimdal Dashboard after the endpoint is restarted; the Heimdal Agent can fetch the data for the last 7 days.
Local token elevation expiry [minutes] - sets the validity period of local tokens (1 to 5 minutes).
Cloud AV scanning of admin executed files - scans files executed via Run with PEDM (or under an active Replace the Windows UAC prompt clause) with the real-time Cloud AV before the elevation request follows the approval flow. In Approve elevation requests automatically mode, detecting a file whose risk score exceeds the set limit triggers a pop-up on the device informing the user the file is flagged as malicious and advising them to contact the administrator. In Approve elevation requests from the Heimdal Dashboard mode, the request displays the risk score and approving it triggers an additional confirmation dialog. This option is available only for automatic approval and Dashboard approval; enabling local token elevation disables it.
De-elevate user when scan risk score exceeds: - sets the maximum allowed risk-score threshold (0 to 100) for the scanned file before the elevation request is blocked.
Prevent spawning other processes - any child process spawned by an application started with Run with PEDM is automatically terminated.
User context elevation - installs a kernel mini-filter driver that allows the user to elevate files only under the User context (instead of the System context). The software VC Redistributable 2015-2022 is required for this option to function properly. It does NOT work if the user is a member of the Network Configuration Operators group; however, Run with PEDM works if the user is moved to any of the following groups: Device Owners, Distributed COM Users, Event Log Readers, Hyper-V Administrators, Access Control Assistance Operators, IIS_IUSR, Network, Performance Log Users, Performance Monitor Users, Power Users, Remote Desktop Users, Remote Management Users, System Managed Accounts Group, Backup Operators.
Replace the Windows UAC prompt with the Heimdal PEDM UAC prompt - when enabled, the Windows UAC prompt is replaced with the Heimdal PEDM prompt, and running an application requires just a double-click. This option is editable only when User context elevation is enabled.
Group-based elevation control - allows you to specify a single local group name so that only members of that group can request elevations (this field is case-sensitive). The group must exist locally in Local Users and Groups.

Machine Learning auto-approval - allows a file elevation request to be automatically approved by the Heimdal server if the elevation for the same file/process has historically been granted by an IT Administrator a number of times equal to or higher than the set threshold. ML auto-approved files/processes are listed in the History tab of the Privilege Elevation and Delegation Management view.
Machine Learning auto-approval threshold - sets the approval threshold for Machine Learning auto-approval.

Administrator Session

"Administrator session" allows standard users to get full temporary Administrator privileges to perform any type of task.

Administrator session - turns the full administrator elevation request feature ON or OFF. Note that some changes cannot be committed during an Administrator elevation, even though the user has Administrator rights.
Require reason - the Heimdal Agent displays a pop-up requesting a reason for the elevation. You can also enable Require phone number or Require email address.
Automatically terminate all processes started during the Administrator session when the session ends - all processes started during an Administrator session are terminated once the session ends.
Approve elevation requests automatically - all Administrator Session elevation requests are automatically approved and listed in the Heimdal Dashboard (under ... -> History).
Approve elevation requests from the Heimdal Dashboard - all Administrator Session elevation requests require the approval of the Heimdal Dashboard Administrator. Pending elevations are displayed in the Heimdal Dashboard (under ... -> Pending Approvals). Once approved, the requesting user can start the session after receiving a Start elevation pop-up (displayed automatically within 1–5 minutes).
Approve elevation requests with a local token - requires the requesting user to enter a local token (whether the endpoint is online or offline) provided by the Heimdal Dashboard Administrator.
Online/Offline elevation approval - adapts the approval method to the endpoint's online status, as described under Run with PEDM above.
Local token elevation expiry [minutes] - sets the validity period of local tokens (1 to 5 minutes).
Cloud AV scanning of admin executed files - enables an automatic scan of the non-system files elevated during the session. If a file is detected as infected while running with admin rights, the user is automatically de-elevated and a pop-up informs them of the detection. This option is available only for automatic approval and Dashboard approval; enabling local token elevation disables it.
De-elevate user when scan risk score exceeds: - sets the maximum allowed risk-score threshold (0 to 100) before the elevation is terminated and the user is de-elevated.
Administrator session duration - sets the length of the elevation session (2 minutes to 24 hours).
Allow user to end Administrator session - allows the user to revoke/stop the elevation at any time.
Preserve Administrator session during screen lock - allows end users to remain elevated even when their machine's screen is locked. The following actions will still de-elevate the current user: Shutdown, Restart, Sign out, another user connecting to the machine via RDP, or another user signing in to a different account on the same machine.
Do not allow 'Run with PEDM' during Administrator session - prevents the user from running with Admin Privileges while an Administrator session is already active (the Run with PEDM context-menu option is not available).
Azure AD Admin elevation delegation - allows a member of a specified Azure AD group (configured in the Azure Group Name field shown after enabling the option) to log in with their Entra ID/Azure AD credentials to request elevation on an endpoint. This is intended for Administrators who remotely connect to standard users' endpoints to get elevated with their own credentials. In Azure, you must allow the Heimdal Security PAM Sign-in action. Devices must be present in Microsoft Entra ID as Registered, Joined, or Hybrid Joined. Only hybrid identities (users synchronized from on-premises AD) are supported; cloud-only accounts are currently excluded.
Group-based elevation control - allows you to specify a single local group name so that only members of that group can request elevations (this field is case-sensitive). The group must exist locally in Local Users and Groups.

Allow the end user to extend the Administrator session - allows the end user to extend an ongoing elevated session by the number of minutes configured in Administrator session extension interval.
Administrator session extension interval - the length of an extension (2 minutes to 1 hour).
Number of allowed Administrator session extensions - the number of extensions an end user is allowed to make (1 to 5).

Revoke Administrators

Revoke all local Administrators - downgrades the Administrator users (both local and domain users) to standard users. The Heimdal Agent takes a snapshot of the local Administrators group on each endpoint and removes all members, users, and groups (except the default Administrator user, which cannot be deleted), downgrading them to standard permissions. Once enabled, logged-in users retain their Administrator permissions until the first logoff/reboot. The members of the local Administrators group are cached on service start (preserved users are not cached because they will not be removed) and are added back on service stop, or when this feature is disabled.
Force logoff to refresh access token - forces the revoked Administrator to be logged off so the change takes effect immediately.
Preserved local Administrators - allows you to preserve the Administrator permissions of specified users/domain groups on a specific computer/group of computers (or all computers). If a user/domain group is preserved, the Heimdal Agent will not remove it from the local Administrators group. Preserving a hostname without a username (or domain group) means all users on that endpoint are members of the local Administrators group; preserving a username (or domain group) without a hostname means all users with that username are members of the local Administrators group on all computers applying this Group Policy. You can start a list of preserved users by downloading the sample CSV from the tooltip next to the section title. The Username field lets you select from the local Administrators detected on the endpoints.
Manually input preserved username and SID - enable this option to manually type the username or user SID to preserve when the search fields do not match your search. Note that ".\admin" is not an accepted value.

Disable interactive logon - forces users logging in to enter both the username and password. Enabling/disabling this option modifies the registry value Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername. When Interactive Logon is disabled, Heimdal reads the current value, saves it in its own repository under the key CachedDontDisplayLastUsername, and overrides the value with 1. When Interactive Logon is re-enabled, Heimdal restores the cached value and deletes its cached copy.

Tray Tools

Default Tray Tools - allows the use of the default Heimdal-defined applications (Command Prompt, Windows PowerShell, Services, Registry Editor, Computer Management) that standard users can elevate and run from the Heimdal Agent's tray context menu.
Use the Select Tray Tools to add dropdown to add commonly used applications from the System32 folder:

• Add or Remove Programs - appwiz.cpl. Because this prompt requires Administrator permissions, this action replaces the default Add or Remove Programs with a custom tool that performs the same operations.
  
• Allow Remote Access - SystemPropertiesRemote.exe
• Command Prompt - cmd.exe
• Computer Management - compmgmt.msc
• Device Manager - devmgmt.msc
• Network Adapter Settings - ncpa.cpl. Because this prompt requires Administrator permissions, this action replaces the default Network Settings with a custom tool that performs the same operations.
  
• Regedit - regedit.exe
• Services - services.msc
• Turn Windows Features On or Off - OptionalFeatures.exe
• View Event Logs - eventvwr.msc
• Windows PowerShell - powershell.exe

The grid allows you to change the order of the items according to your preferences.
Custom Tray Tools - manage and customize the applications list (up to 12 applications) displayed in the PEDM Tools functionality from the Agent context menu. A sample CSV is available from the tooltip next to the option. You can add an entry based on the following:

• Friendly name - the custom name displayed in the Heimdal Agent context menu Tools list (e.g., "Command Prompt" for "cmd.exe").
• Path - the path to the directory or file of the application(s).
• File name - populated automatically from the path.
• Action - edit (modify the friendly name and/or file path) or delete an entry.

Zero-Trust Execution Protection

Note: Zero-Trust Execution Protection reporting mode is enabled by default. We recommend leaving it on for at least 2 weeks for monitoring purposes before disabling reporting mode.

Zero-Trust Execution Protection - prevents the execution of zero-hour unsigned processes and files on the endpoints, bolstering your defense against unknown threats (it can also be enabled/disabled from the Endpoint Detection -> Next-Gen Antivirus module). Zero-Trust Execution Protection checks unsigned executable files and blocks their execution if deemed untrusted. Note that this feature can intercept and block applications/processes that you might want to run; make sure you exclude the files/processes that you trust.
Zero-Trust Execution Protection reporting mode - detects and reports all unsigned processes and files attempting to execute on the endpoints, without actively blocking them.

The Zero-Trust Exclusions, Zero-Trust Admin Settings, and PEDM Admin Settings sections (including Enable Zero-Trust driver interception, Allow global administrator backup, and Use upgraded PEDM engine for x64 devices) are documented in the Next-Gen Antivirus article, as they belong to the shared Zero-Trust and admin configuration.