Restrict an application's process rights

Owned by Max Pinion (Deactivated)
Last updated: Jul 08, 2016
2 min read

You can restrict an application's process rights using Application Control Solution, the default Limit Internet Explorer, and Outlook process rights policy. This document describes the process for restricting an application's process rights. 

In the following scenario, you must have the following:

  • Internet Explorer (IE) installed
  • A user account with administrative rights
  • Network Messenger Service enabled and running

With this configuration, IE has inherited administrative rights from the user and is therefore able to stop Windows services.

Access the application control policies page 

To access the Application Control Policies page, do the following steps:

  1. In the Thycotic Security Manager, click the Policies tab
  2. Click Application Control > Policies> Privilege Management > Limit Internet Browser and Mail Client Process Rights.
     
  3. In the right pane, toggle on the policy.
     

Prevent IE from stopping Windows services

To prevent IE from stopping Windows services, perform the following steps:

  1. In the right pane, enable the application by using the On/Off toggle.
  2. Open IE.
  3. Select File > Open and then browse to cmd.exe in the SYSTEM directory.
  4. Attempt to stop the MSN Messenger service using the command line: NET STOP Messenger.

An Application Control message appears on the taskbar stating "IEXPLORER.EXE has had its rights reduced" and you are unable to stop the service.