Gate 2: Escalation

Escalation — Least Privilege (Windows)

Audience: Windows administrators deploying a layered Keeper EPM anti-ransomware baseline.

---

For an overview of the layered anti-ransomware model and how this gate fits in, see Anti-Ransomware Policies.

This policy is the escalation gate in a layered Keeper EPM anti-ransomware deployment on Windows. It removes standing membership in the local Administrators group from in-scope users, replacing persistent admin rights with policy-gated, just-in-time elevation through Keeper's ephemeral account mechanism. Ransomware running in a user's session inherits the user's token; with that token no longer carrying admin rights, the malware cannot disable Defender, stop backup services, install persistence as a service, write to protected system locations, or modify other users' files. The escalation step that virtually all impactful ransomware depends on simply fails.

Step-by-Step: Create the Policy

1

Plan the Rollout

Least Privilege is the highest-friction policy in the entire EPM deployment. Removing users from the local Administrators group will surface every undocumented admin-dependent workflow in the environment — line-of-business installers, legacy applications that write to Program Files or HKLM, developer tooling, vendor agents. Do not deploy this policy environment-wide on day one.

Before creating the policy, review the Policy: Phased Rollout Planning guidance and identify:

1. A pilot machine collection. Five to ten endpoints belonging to users who represent typical workloads but who are technically capable of reporting issues clearly. Avoid C-suite, avoid heavy developers, avoid finance during close.
2. Exemptions. Service accounts, break-glass admin accounts, and any users whose role legitimately requires standing admin rights (rare, but real). These will be handled via a separate higher-priority policy or by excluding their endpoints from scope.
3. A Privilege Elevation companion policy. Least Privilege removes admin rights; users still need a path to elevate when legitimately required. Pair this policy with a Privilege Elevation policy that allows specific applications (or requires Justification/MFA/Approval) so users have a defined route to elevated work.

2

Create the Machine Collection

Least Privilege is scoped by machine collection. A user on an in-scope machine has their admin rights removed; the same user on an out-of-scope machine is unaffected.

1. From the Keeper Admin Console, navigate to Endpoint Privilege Manager → Collections → Machines.
2. Click New Collection.
3. Name: Least Privilege Pilot Endpoints (Windows).
4. Add the five-to-ten pilot endpoints identified in Step 1.
5. Save the collection. Note the collection's UID.

For broader rollout phases: create additional machine collections (Least Privilege Cohort 1, Cohort 2, Broad Deployment) and either duplicate this policy with a different MachineCheck or expand the existing collection's membership as each cohort completes its pilot window successfully.

3

Create the Policy

1. Navigate to Endpoint Privilege Manager → Policies and click Create Policy.
2. Fill in the policy details:

   • Policy Name: Least Privilege — Remove Local Admin (Windows)
   • Policy Type: Least Privilege
   • Status: Monitor for the initial pilot. Monitor mode logs which users would have been removed from the local Administrators group without actually removing them, giving you a preview of impact before enforcement.

4

Set Filters

1. User Groups: Leave empty (or wildcard) to apply to all users on the in-scope machines. If you have specific exempt user collections, handle those via a separate higher-priority policy rather than excluding them here.
2. Machine Collections: Select the Least Privilege Pilot Endpoints (Windows) collection from Step 2.
3. Applications: Not applicable — Least Privilege operates at the user-account level, not per-application.
4. Leave Date & Time Window unset.

5

Set the Notification and Risk Level

1. Notification Message: Keeper EPM has removed your standing local administrator rights as part of your organization's least-privilege security policy. When you need to perform an administrative task, use the Keeper Agent to request elevation.
2. Requires Acknowledge: leave unchecked. The notification appears once when the policy takes effect; users do not need to acknowledge it every time.
3. Risk Level: 50 — this is a preventive control, not an incident event, so the risk level is set lower than the DENY events from Gates 3 and 4.

6

Save and Pilot

1. Click Save. The policy is pushed to all in-scope endpoints within approximately 30 minutes.
2. Run in Monitor mode for at least two weeks. Review the audit log to see which users would be impacted and what elevated actions they were taking. Use this data to:

   • Validate that no business-critical workflows are silently dependent on standing admin rights.
   • Build out the companion Privilege Elevation policy so legitimate admin tasks have a documented elevation path.
   • Identify any users who need exemption.
3. When Monitor mode is clean and the elevation path is in place, edit the policy and change Status to Enforce. Users will be removed from the local Administrators group within approximately 30 minutes; affected users receive the notification message.
4. Expand the machine collection one cohort at a time until full rollout is complete.

Reference: Policy JSON

The following JSON is the exported form of the finished policy. The <generated-policy-uid> and <uid-of-Least-Privilege-Pilot-Endpoints-collection> placeholders are filled in by the Admin Console when the policy and collection are created.

{
	"PolicyName": "Least Privilege — Remove Local Admin (Windows)",
	"PolicyType": "LeastPrivilege",
	"PolicyId": "<generated-policy-uid>",
	"Status": "enforce",
	"Actions": {
		"OnSuccess": {
			"Controls": []
		},
		"OnFailure": {
			"Command": ""
		}
	},
	"NotificationMessage": "Keeper EPM has removed your standing local administrator rights as part of your organization's least-privilege security policy. When you need to perform an administrative task, use the Keeper Agent to request elevation.",
	"NotificationRequiresAcknowledge": false,
	"RiskLevel": 50,
	"Operator": "And",
	"Rules": [
		{
			"RuleName": "UserCheck",
			"ErrorMessage": "This user is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckUser()"
		},
		{
			"RuleName": "MachineCheck",
			"ErrorMessage": "This Machine is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckMachine()"
		},
		{
			"RuleName": "ApplicationCheck",
			"ErrorMessage": "This application is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckFile(false)"
		},
		{
			"RuleName": "DateCheck",
			"ErrorMessage": "Current date is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDate()"
		},
		{
			"RuleName": "TimeCheck",
			"ErrorMessage": "Current time is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckTime()"
		},
		{
			"RuleName": "DayCheck",
			"ErrorMessage": "Today is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDay()"
		},
		{
			"RuleName": "CertificateCheck",
			"ErrorMessage": "Certificate hash is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckCertificate()"
		}
	],
	"UserCheck": [],
	"MachineCheck": [
		"<uid-of-Least-Privilege-Pilot-Endpoints-collection>"
	],
	"ApplicationCheck": [],
	"DayCheck": [],
	"DateCheck": [],
	"TimeCheck": [],
	"CertificationCheck": [],
	"Extension": {}
}

Companion Policy: Privilege Elevation Path

Least Privilege without a defined elevation path will break the user experience. Pair this policy with a Privilege Elevation policy that grants on-demand admin rights to specific approved applications (for example, signed installers, IT-approved configuration tools, vendor management consoles) — with Justification, MFA, or Approval controls as appropriate to the risk level of each application.

Without that companion policy, users will be unable to perform legitimate administrative work and will route around the control by filing help-desk tickets or requesting blanket exemptions. With the companion policy in place, users have a clear, audited, friction-appropriate path to elevation for the work they're supposed to be doing — and ransomware does not, because malware cannot complete a Justification prompt or an MFA challenge.