Admin rights for one program. Never for the user.
AdminExplorer lets standard users run the programs that need administrator rights, without ever making them local administrators. You set the policy in the portal, and every attempt is audited.
The problem
Local administrator rights give users, and anything they run, full control of the device. Take them away, and every installer and driver update becomes a helpdesk ticket.
How it works
-
Deploy one MSI with Intune
Download the client configured for your tenant from the portal and deploy it as a Win32 app. The device enrolls with the key in your bundle; the same client serves both editions.
-
Set the policy in the portal
Choose which programs may run elevated, whether users give a reason, and how local administrator membership is handled. Devices pick up changes from the portal.
-
Users elevate one program
Pre-approved programs start elevated as usual, or users right-click and choose Run with AdminExplorer. Only that program is elevated, and every attempt is audited.
What you get
-
Decided on the device
The AdminExplorer service makes every decision from your policy and license. The user is never a local administrator, and no standing admin account is created.
-
Pre-approved or on demand
Approved programs start with no prompt. Other approved files are started on demand with a reason prompt and, on Enterprise, manual approval by an approver.
-
Local administrator removal
Standing membership of the local Administrators group is removed and kept removed, with report and enforce modes, presets, exceptions, a preview and a lock-out guard.
-
Every attempt audited
Device, user, file, SHA-256, publisher, decision, reason and approver are recorded in the Windows Application log and in the portal, with filters, summaries and CSV export.
-
Installed software tracking
See every product with device counts per version, and a feed of changes, including those installed with an AdminExplorer elevation.
-
Run in sandbox
Let users open an unknown installer or tool in Windows Sandbox, a disposable virtual machine, without administrator rights on the device itself.
Standard and Enterprise
| Feature | Standard | Enterprise |
|---|---|---|
| Pre-approved programs (no prompt) | Yes | Yes |
| On-demand elevation of approved programs, reason prompt, portal audit | Yes | Yes |
| Local administrator removal and protection | Yes | Yes |
| Installed software tracking | Yes | Yes |
| Run in sandbox | Yes | Yes, also limited to Entra groups |
| Rules (path, publisher, hash) | No | Yes |
| Manual approval by an approver | No | Yes |
| Any application on demand with secure-desktop confirmation | No | Yes |
| Child elevation per entry or rule | No | Yes |
| Entra group targeting | No | Yes |
The edition comes from your license; the same client is installed for both.
See it in two minutes
Get started
The Getting started guide takes you from a new tenant to the first enrolled device. Requires Windows 10 22H2 or Windows 11, x64.