Skip to main content
Question

EPM Windows - On-demand app rule triggers another rule for CMD

  • November 19, 2025
  • 1 reply
  • 97 views

Forum|alt.badge.img+1

Hello,

We have a on-demand rule for Command prompt for a set of users . This rule allows running of child processes with Basic Admin token for Windows Command Prompt - Run-As-Admin action.

For same set of users , when they try to install another application using Run-As-Admin option , based on quick-start rules it gets Admin token which gets applied to child processes as well. But at one point in installation Command Prompt is launched by the installer , this results in additional prompt for the user . Logs show that it is hitting the Command Prompt on-demand rule.
 

I think as the application is triggering the Command Prompt and it has application name as parent process, it should ideally get the admin token and not hit the CMD on-demand rule ?

1 reply

Forum|alt.badge.img+4
  • Guru
  • November 19, 2025

Hey bt101.

You will run into application that can break the child parent relationship, an easy tool to validate is using the Process Explorer (Sysinternals) and monitor the install.

Then of course if you have rules above with no auditing that could be hit also.

What is the App and how does the policy look?

Kind regards
Jens