Time-limited elevation

For tenant admins, approvers, auditors.

Elevated programs run only as long as you allow. Set a maximum runtime per approved application or rule, or let the approver choose the duration when approving. The user sees the remaining time and a warning before it runs out; at the limit AdminExplorer closes the program and the elevated programs it started. Every stop is recorded in the audit log.

Editions

Setting	Free	Standard	Enterprise
Maximum runtime per approved application	yes	yes	yes
Maximum runtime per rule	no (rules are Enterprise)	no	yes
Tenant default maximum runtime	no	no	yes
Child time limit (with child elevation, Enterprise)	no	no	yes
Approver chooses the duration	no	no	yes (Manual approval is Enterprise)

A tenant default stored while the tenant had Enterprise is kept, but devices ignore it below Enterprise (the device then gets 0, no limit). A limit set on an application keeps working in every edition.

Set a maximum runtime

In Policy, open an approved application or a rule and choose Maximum runtime:

Choice	Policy value	Meaning
Use tenant default	maxRuntimeMinutes absent	The tenant default applies (Settings, Enterprise); 0 there means no limit
No limit	maxRuntimeMinutes: 0	This entry never has a limit, whatever the default
Minutes	maxRuntimeMinutes: 1 to 1440	The elevated program may run this long (at most 24 hours)

An approved application that may run for 2 hours:

{
  "name": "Contoso Admin Console",
  "dataPath": "C:\\Program Files\\Contoso\\Console\\console.exe",
  "arguments": "",
  "hashSha": "",
  "friendlyName": "Contoso admin console",
  "globalApplication": true,
  "allowChildElevation": false,
  "showInMenu": true,
  "menuCategory": "Tools",
  "assignedGroups": [],
  "maxRuntimeMinutes": 120
}

The tenant default (Enterprise) is on the Settings page, Default maximum runtime (minutes): 0 (the default) is no limit, 1 to 1440 minutes otherwise. It applies to every application and rule without its own maximum runtime, with or without child elevation. One hour for every entry without its own value:

{
  "approvalMode": "Manual",
  "reasonRequired": true,
  "reasonMinLength": 2,
  "approvalTtlMinutes": 60,
  "powerShellExecutionPolicy": "Bypass",
  "defaultMaxRuntimeMinutes": 60
}

The limit for a launch is, in this order: the duration the approver chose, else the entry’s own value, else the tenant default.

Child elevation and the child time limit

With Allow child elevation (Enterprise), every launch of the entry gets its own job, and each elevated child program joins that job: it is tied to the program that started it and starts in that program’s session (also over remote desktop and for right-click starts). At the program’s limit AdminExplorer closes the program and its elevated children together.

Child time limit (Enterprise, shown only with child elevation) gives each elevated child its own, shorter limit: the child’s start plus the minutes, never after the program’s own deadline. Same deadline as the program (childMaxRuntimeMinutes absent) lets the children run until the program’s limit. A child’s own limit closes that child and the programs it started; the program’s limit ends the whole tree.

{
  "name": "Contoso Setup Launcher",
  "dataPath": "C:\\Program Files\\Contoso\\Setup\\launcher.exe",
  "arguments": "",
  "hashSha": "",
  "friendlyName": "Contoso setup",
  "globalApplication": true,
  "allowChildElevation": true,
  "showInMenu": true,
  "menuCategory": "Tools",
  "assignedGroups": [],
  "maxRuntimeMinutes": 60,
  "childMaxRuntimeMinutes": 15
}

An elevated child follows its program’s limit: Request more time from a child is answered with reason code ExtensionFollowsParent (event 2071); the child gets more time when the program does.

A blocked child that cannot be tied to exactly one running launch with child elevation is not elevated: it starts without administrator rights and the device writes event 3071.

Approving with a duration

With Manual approval (Enterprise) the Approvals page shows the Time limit of each request: the limit the policy gives the program, No limit, or Not set by the device (a client before 2.0.68). When you approve, pick a Duration: the policy limit (the default), 15 minutes, 1 hour or 4 hours. You cannot go above the policy limit when it is above 0; when the policy has no limit you can still choose one. For a request that shows Not set by the device there is no duration to choose.

A request approved from a Teams card uses the policy limit.

What the user sees

• The tray shows the remaining time of every running time-limited program.
• A warning 5 minutes and again 1 minute before the limit.
• At the limit AdminExplorer asks the program to close (as if the user closed its windows), waits 30 seconds, and then ends it. Unsaved work in the program can be lost: the warnings are the user’s chance to save.
• When the program ends after the close request, whatever is still running in its job (its elevated children) is ended at once: the job is emptied at the limit.

The deadline is wall-clock time, not processor time, and it survives a restart of the AdminExplorer service. A reboot ends every elevated program anyway.

Request more time

When 5 minutes or less remain, the tray offers Request more time. The user types a reason and the device handles it like a new request for the same program:

• On demand with a reason or pre-approved: granted at once for another full period (the effective limit).
• Manual approval: the request goes to the approvers like any other, marked Extension of the running elevation. The approver picks a duration. If it is rejected or expires, the program keeps its current deadline.

A launch can be extended at most 3 times.

Audit

Every elevation record carries:

Field	Meaning
maxRuntimeMinutes	The effective limit of the launch; 0 = none
runtimeSeconds	How long the elevated program actually ran
endReason	exited (it ended by itself), timeLimit (closed or ended at the limit), serviceStopped, unknown
extensionOf	For a Request more time record: the request id of the elevation it extends

In Audit the columns Time limit and Ended show them (Stopped: time limit or Exited), and the Ended filter finds every program stopped at its limit. The CSV export has the four fields as the last columns. Records from older clients have none of them.

Event ids

The service writes these to the Windows Application log, source AdminExplorer:

Id	Meaning
1070	Time limit applied to an elevated launch (minutes, deadline); also after a service restart
1071	Warning shown to the user (5 or 1 minute left)
1072	Program closed at the limit (it closed when asked)
1073	Request more time granted (minutes added, new deadline, automatic or by an approver)
2070	Program ended at the limit (it did not close within 30 seconds)
2071	Request more time denied, rejected or expired; the deadline is unchanged. Reason code ExtensionFollowsParent: the program is an elevated child and follows its parent’s limit
3070	A time limit could not be stored, restored or enforced
3071	An elevated child was refused: it could not be tied to exactly one running launch with child elevation, so it started without administrator rights

Limits

• Installers. Windows Installer runs its work in the msiexec service, outside the elevated program. The limit does not stop that work, and stopping an installer midway can leave a broken install. For .msi entries use no limit or a generous one.
• Not a security boundary. An elevated program can create a scheduled task or a service that keeps running after it ends. The time limit bounds the elevated session; your approved applications, rules and approvals decide what may be elevated at all.

Known behaviour

• Non-elevated children. Programs a time-limited program starts without elevation (an entry without child elevation, or a child refused with event 3071) run outside its job and can outlive the limit. They hold no administrator rights.
• Launchers that exit at once. A program that starts another program and exits immediately has ended before its child is checked: that child cannot be tied to it and is refused with event 3071. After a launch without a limit has ended, its late children are started as before.
• Child elevation without a limit. A launch with child elevation but no time limit still gets a job for its children, but the tray shows no remaining time and the device writes no event 1070.
• A child’s own limit closes that child and the programs it started; the parent’s limit ends the whole tree.
• A brief moment before the service takes over. When the driver catches a program, the non-elevated original can run briefly until the service has taken the event. A child it starts in that moment is not governed and stays without administrator rights.
• Driver version. Tying a child to its parent needs the driver that ships with client 2.0.68. With an older driver, children of watched launches are refused (event 3071).
• Approver’s duration applies only on Enterprise; below Enterprise the device uses the policy limit.
• Any application on demand under Auto is extended only after the user confirms again on the secure desktop.
• A granted extension reaches the portal audit when the program ends; until then event 1073 on the device shows it. Every refused Request more time is its own audit record and a 2071 event.
• Wall-clock time. An elevated program can change the system clock; that is part of “not a security boundary” above.

Related guides

• Policy guide with example configurations
• How AdminExplorer elevates
• Audit and reports