Product security information

For tenant admins, partner admins, security reviewers and auditors.

This page collects the security information that Logic Unknown ApS gives the users of AdminExplorer, in the order of Annex II of the EU Cyber Resilience Act (Regulation (EU) 2024/2847). Most points link to the guide or reference page with the details.

Manufacturer and contact

Manufacturer	Logic Unknown ApS
Company registration (CVR)	40560483
Postal address	Humlevej 20, 8543 Hornslet, Denmark
Email	support@adminexplorer.io
Website	adminexplorer.io
Report a vulnerability	Vulnerability disclosure policy

Product

Name	AdminExplorer Standard and AdminExplorer Enterprise (one client and one portal; the edition comes from your license)
Type	Endpoint privilege management software: a Windows client (kernel driver, service, secure-desktop confirmation prompt, tray app, right-click menu entries, delivered as one MSI) and the portal at portal.adminexplorer.io, which the client needs for its policy, license, approvals and audit
Version	The client version is shown in Apps and features in Windows and on Devices in the portal. The changes in each version are in the release notes

Intended purpose

AdminExplorer lets an organisation run Windows devices without giving users local administrator rights. Programs that the organisation approves are started elevated per program, after a reason and, where configured, an approval; every attempt is audited. It can also remove and keep out unwanted members of the local administrator groups, run untrusted files in Windows Sandbox and report installed software. How it works is in How elevation works and the Security model overview.

It is meant for organisations that manage their Windows devices centrally (for example with Microsoft Intune), on Windows 10 22H2 and Windows 11 x64 devices used by one person at a time.

Support period

• Security updates for at least 5 years. For every client version, Logic Unknown ApS handles vulnerabilities and provides security updates free of charge for at least 5 years from the date that version is placed on the market (first published for download).
• The end date is stated per version. The table below gives the end of the support period, at least month and year, for every published client version; the release notes link to it. The same end date is stated on the price list, on quotes and in the portal at the time of purchase.
• How you receive the security updates. A security update is delivered as a newer client version of the same release line (for example 2.0.68 for a device on 2.0.66), not as a patch to the old version. Install the newest client version to stay supported.
• The portal is a hosted service and always runs its current version; it is supported for as long as the service is offered.
• Free of charge. Security updates are not charged separately, on any plan. Using AdminExplorer requires a valid plan; the Free plan (up to 25 devices) is available at no cost, so a device whose subscription has ended can stay on a supported, updated client version on the Free plan or uninstall.

Client version	Placed on the market	Security support until (at least)
2.0.68	2026-10-30	October 2031
2.0.66	2026-10-21	October 2031
2.0.65	2026-10-20	October 2031
2.0.64	2026-10-20	October 2031

Security updates

• How they are delivered. A new client version is a new MSI. It replaces the previous MSI in the download bundles in the portal (Download). The release notes list every version and what it changes; security fixes are also published as security advisories.
• No automatic update today. The client does not update itself, and the portal does not install updates on your devices. Your administrators deploy each new version, typically by updating the AdminExplorer Win32 app in Microsoft Intune. The portal shows the client version of every device under Devices, so you can see which devices still run an older version.
• How to install them. Install the new MSI over the old one, with the same command and transform as the first install. Every version is a major upgrade: the previous version is removed and the new one installed, and settings, the license, the enrollment and records not sent yet are kept. See Installer and Intune, Upgrades.

Secure installation and configuration

• Deploy from the download bundle of your own tenant, as SYSTEM, for example with Intune: Getting started and Installer properties and Intune deployment. Treat the bundle like a credential, and build a new bundle after the rollout to retire the enrollment key of the old one.
• Until the signed release, the MSI and its programs are not code-signed (the kernel driver is attested and signed by Microsoft). Use hash rules, not publisher rules, for AdminExplorer in AppLocker or WDAC, and download the MSI only from your tenant’s portal.
• Start from a starter policy and keep the approved list narrow: Policy guide and Policy and rules. Do not approve shells, script hosts or other general-purpose tools, and keep publisher rules to one specific vendor.
• Sign in to the portal with Microsoft Entra and Conditional Access where you can: Microsoft Entra sign-in. Give people the smallest role they need.
• Consider local administrator removal and protection, so that no user keeps standing administrator rights next to AdminExplorer.
• What runs on the device, what the portal stores and for how long: Security and privacy and Data collected by the device.

Decommissioning and data deletion

To take a device out of use:

1. Uninstall the client with msiexec /x <product code> /qn /norestart, without KEEPCONFIG=1, or remove the Intune assignment with uninstall. This removes the service, the driver, the tray, the menu entries and the settings, and deletes records that were not sent to the portal yet. Tools that set DISABLEROLLBACK=1 leave the settings on the device. Entries already written to the Windows event log stay there as configured in Windows. See Installer and Intune, Uninstall.
2. Revoke the device under Devices in the portal. Its tokens stop working, and its current software inventory and local administrator state are deleted. Its audit records and histories stay as evidence until they expire.

To stop using AdminExplorer entirely, uninstall the client from every device and have the tenant deleted by your provider or by Logic Unknown ApS (support@adminexplorer.io). The tenant is deleted on request, within 30 days. Deleting the tenant deletes every record of the tenant, and users who belong only to this tenant are removed. What is deleted when, and what is kept, is listed under Data deletion and Retention.

Known limits and foreseeable misuse

• Elevation is administrator rights for that program. An elevated program can do anything an administrator can, for example create a scheduled task or a service that keeps running after it ends. AdminExplorer decides which programs may start elevated; it is not a security boundary around a program once it runs elevated. Approving a shell, a script host, a remote-control tool or a broad publisher rule effectively gives users administrator rights on request.
• Time limits do not stop installers. Windows Installer does its work in the msiexec service, outside the elevated program, so a time limit does not stop an .msi installation that is already running (see Time-limited elevation).
• No multi-session hosts. AdminExplorer does not support multi-session hosts such as Remote Desktop Session Host or Windows multi-session (Azure Virtual Desktop). Do not install it there.
• x64 only. The client is for x64 Windows; ARM64 is not supported yet.
• Further known limitations are in the release notes.

Software bill of materials (SBOM)

An SBOM for a client version, in CycloneDX 1.6 JSON format, is available on request from support@adminexplorer.io. Name the client version you run.

EU declaration of conformity

Planned: the EU declaration of conformity for AdminExplorer under the Cyber Resilience Act will be published on this page from 11 December 2027, when the Regulation applies in full.

Reporting a vulnerability

Report a security vulnerability as described in the vulnerability disclosure policy. Fixed vulnerabilities are published as security advisories.