Local admin rights, only for as long as they’re needed.
AdminNow lets people request temporary membership in the local Administrators group on their own Windows machine — checked against your policy, watched the whole time, and automatically taken back. No standing privilege left lying around. No help‑desk ticket for something as small as installing a printer driver.
Self‑hosted Windows Service + client apps. Free and open source under GPLv3.
Illustrative recreation of the UserRequestApp tray window — not a screenshot.
Permanent admin rights are a permanent risk.
Give everyone local admin and you’ve handed every phishing email, every malicious download, and every unpatched app a straight line to the whole machine. Take it away completely and your help desk becomes the bottleneck for every driver install and one-off setting.
AdminNow is the middle path. Standard users stay standard users — until they explicitly ask for elevated rights, get checked against policy your organization already controls, and receive them back for a limited, configurable window. Then the rights are gone again, automatically.
Nothing standing
Only the Windows Service can change group membership. Client apps never hold elevation power of their own.
Runs on your infrastructure
A Windows Service plus two small client apps. No cloud account, no external dashboard.
Controlled by Group Policy
Who’s allowed, how long, whether a reason is required — configured the way you already manage Windows.
Free and open source
Released under the GPLv3 license. No per-seat pricing, no license server.
What it does
Everything AdminNow needs to grant, watch, and take back a temporary privilege — nothing it doesn’t.
Self-service elevation
A simple tray app with one job: “Grant Me Administrator Rights” and “Remove My Administrator Rights.” No ticket for routine work.
Automatic expiration
Every grant carries a timeout. When it runs out, rights are revoked automatically — no one has to remember.
Optional renewal
Where policy allows it, a user can accept a renewal prompt before time runs out, up to a limit you set.
Remote elevation for IT
RemoteUI lets support staff grant rights on someone else’s machine over the network, authenticated with their own Windows credentials.
Reason & re-authentication
Optionally require a stated reason or a fresh sign-in before elevating — enforced on the server, not just requested by the client.
Allow / deny lists
Decide exactly who can request rights — locally, remotely, or automatically at logon — by user or by security group.
Full audit trail
Every grant, revocation, and denial is written to the Windows Event Log, with structured ETW events and optional syslog forwarding for your SIEM.
Elevated-process visibility
AdminNow watches for processes launched with an elevated token while a grant is active, so “what did they do with it” has an answer.
Request, verify, grant, revoke
Every decision is re-checked on the server. A client can prompt for a reason or a fresh sign-in, but it can’t grant itself anything.
Request
A user clicks “Grant Me Administrator Rights,” or IT support runs RemoteUI against their machine.
Verify
The service independently checks policy — who’s allowed, whether a reason or re-authentication is required.
Grant
The account is added to the local Administrators group for a timeout your policy defines.
Revoke
Rights are removed automatically on timeout, at logoff, or on demand — and every step is logged.
AdminNow is in final development.
It’s being built for Windows environments that want an alternative to permanent local admin rights — without taking on a commercial PAM platform or a cloud dependency. Check back here for the release announcement.
- Windows Service
- Self-service tray app
- Remote IT tool
- GPLv3, free