Skip to main content

Endpoint Privilege Management (EPM) — End-user guide

One-liner
EPM (powered by CyberArk) lets you run tasks that need admin rights safely—without keeping permanent local admin. You request elevation when needed; EPM grants it in a controlled, audited way.

oaicite:0

Why this matters​

  • Too many permanent local admins increase risk: malware, software tampering, data leakage, and lateral movement. EPM reduces these risks without blocking your work.
    oaicite:1
  • ABB has already migrated a large share of users from Local Admin Rights (LAR) to EPM with minimal incidents recorded during rollout.
    oaicite:2

What changes for you​

  • You won’t stay local admin all the time.
  • You can elevate when needed (install or run something with admin rights) using EPM prompts or Just-in-Time (JIT) access.
  • Your elevation actions are monitored and logged to keep devices and data safe.
    oaicite:3

How EPM works (modes)​

EPM policies are assigned by function to balance continuity and security:

  • Open-Wide Policy — similar to LAR but monitored; used where broad elevation is required. Works offline.
    oaicite:4
  • Standard/Restricted Policy — tighter by default; request JIT elevation for special cases.
    oaicite:5

We aim for zero business impact: you get the access you need, when you need it—safely.

oaicite:6

Typical tasks you can do with EPM​

  • Install approved apps from Company Portal; request elevation when an installer needs admin rights.
  • Run tools “as administrator” via an EPM elevation prompt.
  • Ask for temporary elevated rights for edge-cases (JIT).
    oaicite:7

Requesting EPM access (SNOW)​

  1. Open ServiceNow → Catalog → My Services and select the EPM item.
  2. Provide business justification and note any corner use-cases.
  3. Your Line Manager approves; the EPM + AD/Intune teams fulfill.
  4. SLA: approval target 2 business days, fulfillment target 3 business days. Track your ticket in SNOW.
    oaicite:8

Best practices

  • Be specific about what you need elevated.
  • Plan ahead for project deadlines; some requests involve multiple teams.
    oaicite:9

If you still have Local Admin Rights (LAR)​

  • LAR is being retired. If you find you have LAR, raise an EPM request to switch. Bulk onboarding is available for teams.
    oaicite:10

Support & escalation​

  • Check the End-User KB / FAQ and short demo videos (install, elevate, JIT, block behavior).
  • Use the Support Channels & Escalation Matrix if something blocks your work.
    oaicite:11

Quick FAQ​

  • Will this slow me down? No. Elevation is on-demand and monitored; standard tasks run as usual.
    oaicite:12
  • Do I need internet? EPM supports offline operation for approved policies.
    oaicite:13
  • What about privacy? EPM logs admin-level actions to protect systems and data; it’s not for personal monitoring.
    oaicite:14

Call to action​

  • If you rely on LAR today, migrate to EPM via SNOW.
  • If you already have EPM, use JIT for exceptions and report blockers early.
    oaicite:15