Topic starter
06/11/2026 6:36 pm
TL;DR: Gunnebo replaced permanent endpoint admin rights with just-in-time access, improving control, visibility, and the attack surface without disrupting productivity, according to Admin By Request. The underlying governance shift is that privileged access must be issued on demand, not treated as a standing entitlement.
Editorial analysis by NHI Mgmt Group, based on content published by Admin By Request: “How Gunnebo Strengthened Its IT Security with Admin By Request”.
Key questions
Q: How do teams remove standing local admin rights without disrupting users?
A: Teams remove standing local admin rights by moving users to standard accounts and granting elevation only when needed through just-in-time access, endpoint privilege management, or approved support workflows.
Q: Why do temporary admin rights become risky when they are managed manually across many endpoints?
A: Manual elevation increases risk because it is easy to lose track of who still has access, especially in remote or bulk-managed environments.
Q: What is just-in-time elevation in endpoint security?
A: Just-in-time elevation in endpoint security grants admin or other privileged rights only for a short, approved window, then removes them automatically.
Practitioner guidance
- Remove permanent local admin rights Map every endpoint population that still carries persistent elevation and remove standing access where day-to-day work does not require it.
- Define task-scoped elevation rules Set clear approval, duration, and scope rules for admin elevation so privileged access exists only for a specific task window.
- Pilot the change before broad rollout Test the new privilege model with representative user groups, then adjust communication and workflows before expanding across regions.
Bottom line: Permanent endpoint admin rights create a durable privilege boundary that weakens least privilege and makes governance harder to prove.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Permanent endpoint admin rights are a standing privilege problem, not a productivity feature. Once elevation is granted broadly, the organisation inherits a permanent trust boundary on every device. That weakens least privilege because the entitlement exists independent of task need. The practical consequence is that endpoint governance becomes harder to prove, not just harder to enforce.
A question worth separating out:
Q: How do teams get users to accept tighter privilege controls?
A: Teams get users to accept tighter privilege controls by introducing them in a phased rollout, starting with low-risk groups, clear business justification, and an alternative path for urgent work. For users, the change is easier to accept when access requests are quick, approvals are visible, and breaks in workflow are minimal. Audit trails and time-bound access help.
👉 Read our full editorial: Permanent admin rights give way to just-in-time access in IT estates