Permanent admin rights give way to just-in-time access in IT estates

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Admin By Request's blog post: Gunnebo replaced permanent endpoint admin rights with just-in-time access, reducing standing privilege and improving control without harming productivity.

Why it matters: This matters because permanent elevation remains one of the simplest ways privilege creep survives inside otherwise mature IAM and PAM programmes, especially across global endpoint estates.

Context

Permanent admin access creates a governance gap because the privilege exists before anyone has to justify it. That model works against modern endpoint security because the entitlement is always present, even when the task is not. In a global estate, the real problem is not just elevation itself but the difficulty of knowing when local admin rights are still needed.

For endpoint privilege management, the control question is whether elevation is an entitlement or a transaction. Endpoint privilege management matters here because it shifts access from a standing state to a task-scoped one, which is the only way to keep local admin use aligned with actual need.

Key questions

Q: How do teams remove standing local admin rights without disrupting users?

A: Teams remove standing local admin rights by moving users to standard accounts and granting elevation only when needed through just-in-time access, endpoint privilege management, or approved support workflows. The account owner, device group, and business role should determine who can elevate, for how long, and for which tasks. Local admin tokens and cached credentials should be tightly controlled.

Q: Why do temporary admin rights become risky when they are managed manually across many endpoints?

A: Manual elevation increases risk because it is easy to lose track of who still has access, especially in remote or bulk-managed environments. The longer elevated rights remain in place, the more opportunity there is for misuse, privilege creep, or accidental changes. Inconsistent revocation also creates gaps between intended access and actual access on the device.

Q: What is just-in-time elevation in endpoint security?

A: Just-in-time elevation in endpoint security grants admin or other privileged rights only for a short, approved window, then removes them automatically. It is commonly used for local administrator access, sudo-style elevation, or workstation management tasks, with approval, expiry, and audit logging limiting standing privilege and reducing the chance of leftover elevated access.

Q: How do teams get users to accept tighter privilege controls?

A: Teams get users to accept tighter privilege controls by introducing them in a phased rollout, starting with low-risk groups, clear business justification, and an alternative path for urgent work. For users, the change is easier to accept when access requests are quick, approvals are visible, and breaks in workflow are minimal. Audit trails and time-bound access help.

Technical breakdown

Why permanent admin rights create standing privilege risk

Local administrator rights are a persistent control problem because they grant broad OS-level authority across software installation, configuration changes, and system modification. Once granted, they often outlive the original reason for access. That creates a wide trust boundary on every endpoint and makes audit evidence weak, because the control does not distinguish between legitimate work and unnecessary persistence. In distributed organisations, this is amplified by local exceptions and legacy dependency handling. The key issue is not just that users can do more, but that the organisation cannot easily prove when that extra power is still justified. Read Admin panels and super admin accounts.

Practical implication: Treat permanent endpoint admin access as a privilege design flaw, not just an operational convenience.

How just-in-time elevation changes endpoint governance

Just-in-time elevation turns admin use into a request-and-approve event tied to a specific need, rather than a permanent identity state. That changes the governance model from who has standing power to when power is issued, for how long, and for what scope. It also creates a cleaner audit trail because elevation events can be reviewed as transactions instead of inferred from broad account state. For endpoint programmes, the architectural shift is from continuous access entitlement to controlled activation, which is materially easier to govern across mixed device estates. See the Endpoint Privilege Management Guide.

Practical implication: Design elevation workflows so privileged access is issued only for the task window and revoked immediately after use.

Why transparency and rollout design matter more than the tool

Access controls fail in practice when users see them as friction without understanding the security rationale. A phased rollout with pilots, feedback loops, and clear communication is often what determines adoption, not the control mechanics alone. In global organisations, local working patterns and cultural differences can make a single deployment plan brittle. The security outcome depends on whether the new model is explainable, observable, and compatible with daily operations. That is why control design and organisational design have to move together. See the Security Operating Model and Organisation Design Guide.

Practical implication: Roll out privilege changes in phases and test user acceptance before scaling the control across the estate.

Threat narrative

Attacker objective: The objective is to gain durable endpoint control that can be used to install, modify, or abuse software and system settings beyond ordinary user limits.

1. Entry begins when a user or process is given persistent local administrator rights on endpoints, creating an always-on elevation path.
2. Escalation occurs when those rights are reused for software installation, configuration changes, or other actions that exceed normal user scope.
3. Impact follows when an attacker or careless user can alter systems, expand control, or weaken endpoint assurance across the environment.

NHI Mgmt Group analysis

Permanent endpoint admin rights are a standing privilege problem, not a productivity feature. Once elevation is granted broadly, the organisation inherits a permanent trust boundary on every device. That weakens least privilege because the entitlement exists independent of task need. The practical consequence is that endpoint governance becomes harder to prove, not just harder to enforce.

Just-in-time access is the correct governance pattern when local admin use is occasional. It changes privileged access from a persistent identity condition into a discrete transaction, which is easier to review and revoke. That matters most in distributed environments where exceptions tend to become the norm unless access is time-bound and visible.

Standing privilege decay: endpoint admin rights that remain active between tasks create entitlement drift faster than most recertification cycles can catch. The control failure is not a missing policy but a model that assumes access can remain in place safely until someone reviews it. In practice, the review arrives after the exposure window has already done its work.

The operational lesson is that endpoint privilege management succeeds when governance and user experience are aligned. Gunnebo’s experience reinforces a broader point: controls that are hard to understand or use become exception factories. When elevation is transparent and fast, adoption improves and the security model becomes durable rather than ceremonial.

Read next: Endpoint Privilege Management Guide

What this signals

Standing privilege is the real endpoint governance problem. When admin rights remain in place between tasks, review cycles become a lagging indicator instead of a control. The programme question shifts from who can administer endpoints to whether elevation can be made temporary by default.

The broader signal is that endpoint privilege management is moving from exception handling to operating model design. Organisations that rely on local admin rights for convenience will keep absorbing risk unless they redesign approval flows, user communication, and rollback procedures together.

For practitioners

• Remove permanent local admin rights Map every endpoint population that still carries persistent elevation and remove standing access where day-to-day work does not require it.
• Define task-scoped elevation rules Set clear approval, duration, and scope rules for admin elevation so privileged access exists only for a specific task window.
• Pilot the change before broad rollout Test the new privilege model with representative user groups, then adjust communication and workflows before expanding across regions.
• Track endpoint privilege exceptions Maintain a register of devices, teams, and workflows that still need temporary exceptions so they can be reviewed and retired deliberately.

Key takeaways

• Permanent endpoint admin rights create a durable privilege boundary that weakens least privilege and makes governance harder to prove.
• The case study shows that a task-scoped elevation model can improve control and visibility without necessarily disrupting user productivity.
• The practical control shift is from persistent entitlement to time-bound issuance, backed by rollout discipline and user communication.

Related NHI Mgmt Group resources: Endpoint Privilege Management Guide · Admin panels and super admin accounts · Security Operating Model and Organisation Design Guide

Key terms

• Endpoint Privilege Management: Endpoint privilege management is the control of what software can do on a workstation, including installation, elevation, and runtime behavior. In shadow AI environments, it becomes a way to discover and constrain local model runtimes, plug-ins, and binaries that might otherwise bypass standard software oversight.
• Just-in-Time (JIT) Access: Just-in-Time (JIT) Access grants permissions only when needed and removes them after use. In IAM and PAM, it reduces standing privilege by issuing time-bound access based on approval, context, or policy, limiting exposure for humans, service accounts, and non-human identities while improving auditability and control.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.