Skip to main content

If any Process starts with admin rights added to token, then won’t it be possible to give control of that application while sharing screen in a Microsoft Team’s or Google Meet call?

You are spot on, but they are typically related to integrity issues more than EPM.

Tools like Teams and Google Meet, would typically run with Medium integrity (passive token), and would not be allowed to interact with application running with a high/system integrity. https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control

Process Explorer is a great tool to validate the integrity levels of application once launched. (has to run with Elevated permissions to see high and system integrity levels)

For teams and Google Meet to be able to interact with Elevated application, they would need to be elevated also. This is NOT a best practice to allow that.

We should be using tools that is dedicated for Remote Support, that being BT Remote support or Microsoft Remote Assist etc. who can fall under the category in the MS article.

https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration?tabs=intune

They are designed to be allowed to interact with UAC etc. but require to be running from controlled locations.

I hope this helps.


Hey @Binoy_Dey  , even if the  Process starts with admin rights added to token , then even when you share the application control over screen share via teams or any other application. That will not be able to get elevated access as @Jens Hansen  added in his explanation. 

As per our environment , all the applications such as teams , google meet , Zoom and others are not allowed to be executed as administrator being presented by block rule.

 


Reply