Skip to main content

Temporary Administrator Access on Windows with FileWave

ReviewValidation status

DraftRuntime forvalidated technicalAugust review.7, 2026. The exact attached script was exercised as Local System on Windows 11 Pro 10.0.26200 using native 64-bit Windows PowerShell passed5.1.26100.8246. syntaxTesting parsingconfirmed a fresh grant, active-lease renewal, automatic expiration, startup cleanup after the device remained off past expiration, permanent-administrator preservation, protected state and PSScriptAnalyzerscript warning/errorfiles, checks.scheduled-task Itreadback, hasand notremoval yetof completedthe runtimeQA validationaccounts onand aartifacts. The attachment SHA-256 is db196660a5acfe8dfdc8840b1c856e72816cb84b0cdc43c9b7487fe038153730. Start with one representative Windowsdevice device.in Doyour notown publishenvironment orbefore deployauthorizing itproduction broadly until a Windows pilot confirms grant, renewal, expiration, reboot, rollback, and failure behavior.use.

Overview

This recipe uses a FileWave Fileset to add an existing dedicated local Windows account to the built-in Administrators group for a limited period. The default window is 10 minutes. A scheduled task running as Local System removes the membership when the window expires.

Use the dedicated account to answer a UAC credential prompt when approved support work requires administrator rights. The script does not create, enable, unlock, or set the password for the account.

Temporary local administrator access is not a security boundary. During the access window, an administrator can disable the cleanup task, change protected files, create another administrator, install persistent software, or interfere with management. Removing group membership also does not terminate processes that were already elevated or invalidate access tokens that Windows already issued. Use a dedicated support account, keep the window short, retain a separate recovery administrator, and investigate any failed cleanup immediately.

Requirements

  • FileWave Central and enrolled Windows clients.
  • An existing, enabled local Windows account with the same name on each target device. The example uses Filewave.
  • The account is normally a standard user and is not used as a permanent administrator or as the user's daily sign-in account.
  • 64-bit Windows with Windows PowerShell 5.1, the Microsoft.PowerShell.LocalAccounts module, and the ScheduledTasks module. Do not use this workflow on a domain controller.
  • A separate protected administrator or recovery method that does not depend on this workflow.
  • A separate managed method for provisioning and rotating the dedicated account password. This workflow does not need the password, so do not add it to this script, Fileset, or its Launch Arguments.
  • Treat this as an approved, device-specific privilege lease. Do not assign the Fileset broadly or allow another workflow to add the same account to Administrators while a lease is active.
  • A common account name must not mean a shared fleet-wide password. Prefer unique per-device credentials, protect retrieval, rotate them through a separate managed process, and retain an approval and audit record for each request.

Download

Item Purpose
Grant-FileWave-Temporary-Admin.ps1 Activation script that grants or renews temporary administrator membership and registers cleanup as Local System.

How the script works

  1. It relaunches in native 64-bit Windows PowerShell 5.1 when needed, verifies that FileWave launched it as Local System,System identity, confirms the required PowerShell commands are available, and resolves exactly one enabled local account.
  2. It rejectsstores aenforcement reparse-pointartifacts working directory, replacesbeneath the directory ACL with a verifiedprotected Local System-System profile instead of the user-writable C:\ProgramData\FileWave tree. The script rejects reparse points and hard-linked artifacts, applies protected ACLs owned ACL,by Local System, and permits local administrators read-only access to the artifacts.access.
  3. It identifies the account and Administrators group by SID. If the account is already a direct administrator and there is no valid script-owned state,state exists, it treats that membership as permanent and leaves it unchanged.
  4. It serializes all grants, renewals, and cleanup operations with aone namedglobal workspace mutex. Each approved run receives a new lease ID and UTC expiration.
  5. Before adding membership, it writes versioned state plusand athe generated cleanup script with create-new, write-through, atomic replacement; validates their bytes and ACLs; and registers athe scheduledcleanup task as Local System. The script verifies the task action, principal, and triggers before continuing.
  6. It addsreads the scheduled task back and verifies its action, Local System principal, highest run level, expiration, startup and daily triggers, repetition settings, retry policy, battery behavior, and enabled state before changing membership.
It re-resolves the exact account toSID Administratorsimmediately before the transition, adds membership only after cleanup enforcement is prepared,ready, thenand rechecksperforms membership.a Renewalfinal replacesholistic thereadback of membership, lease whilestate, holdingartifacts, theand sametask mutex, so an overlapping cleanup run must reload the current deadline.configuration. The task starts at expiration, retries every five minutes for seven days, then continues daily and also runs at system startup.startup until cleanup succeeds. Cleanup rechecks directverifies membership after removalabsence before deletingremoving enforcement artifacts. If the workflow owns the temporary membership but cannot secure or verify automatic cleanup, it attempts to remove that membership immediately and exits with code 1. IfFailed rollbackremoval fails, it keepspreserves the statetask and cleanup artifactsevidence for investigationretry and retry.investigation.

Create the Fileset

  1. Download Grant-FileWave-Temporary-Admin.ps1.
  2. In FileWave Central, open Filesets and create an empty Fileset named Temporary Administrator Access - Windows.
  3. Select the Fileset and open the Scripts view.
  4. Import the PowerShell file as an Activation script.
  5. Open the script properties and add these Launch Arguments in order:
Position Value Purpose
1 -UserName Names the first parameter.
2 Filewave The dedicated local account. Allowed characters are letters, numbers, periods, underscores, and hyphens, up to 20 characters.
3 -DurationMinutes Names the duration parameter.
4 10 Temporary access duration. The script accepts 1 through 1,440 minutes; use the shortest operational window.

GrantTempAccessScriptArguments.pngFileWave activation-script settings showing the ordered UserName and DurationMinutes launch arguments

Launch Argument order: -UserName, account name, -DurationMinutes, duration. The other execution-control values visible in the screenshot are examples, not additional requirements for this recipe.

Current FileWave Windows clients and newly createdNew Filesets use 64-bit execution.script Upgradedexecution by default starting with FileWave 15.5. Filesets created before upgrading can retain atheir legacyprevious 32-bit setting.setting, Reviewso review the Fileset bitness before deployment. The script also relaunches itself through Sysnative whenfrom a 32-bit processhost, startsor itthrough onSystem32 from PowerShell 7, to ensure that both grant and cleanup run in native 64-bit Windows becausePowerShell Microsoft's LocalAccounts module is unavailable in that process.5.1.

Deploy and grant access

  1. Create a Deployment for one representative Windows test device. If your environment still uses legacy Fileset Associations, associate the Fileset only with that device.
  2. Select Update Model. The lease begins when the activation script runs, not when the account is first used at a UAC prompt.
  3. Wait for the Fileset to activate,activation, then confirm the grantgrant, task definition, protected state, expiration, and startup cleanup task using the verification steps below.
After the pilot passes, target the Fileset only to the individually approved device or request. Do not assign this privilege workflow to a broad standing group. Use the dedicated account only for the approved UAC prompt or support task. Do not sign in interactively withuse it for ordinary work. After expiration, confirm that membership and temporary state were removed before expandingas the pilot.daily sign-in account.

The Deployment can remain assigned after cleanup; a completed Fileset does not run again merely because it remains assigned. For aeach later approved request, use Reinstall Fileset from Client Info or Fileset Reports on FileWave 16.3 or later. Reinstalling while accessa lease is active renewsreplaces theit expirationwith window.a new window beginning at that activation. On an earlier FileWave version, remove the Deployment only after cleanup is verified, select Update Model, then deploy the Fileset again for the next approved request.

Verify the test device

Run the following in 64-bit Windows PowerShell as an administrator immediately after activation:

$UserName = 'Filewave' # Use the exact Launch Argument value
$WorkingDirectory = Join-Path $env:WINDIR 'System32\config\systemprofile\AppData\Local\FileWave\TempAdmin'
$TaskName = 'FileWave-Remove-Temporary-Admin-' + $UserName
$StateFile = Join-Path $WorkingDirectory ($UserName + '.temporary-admin.json')
$User = Get-LocalUser -Name 'Filewave'$UserName

Get-LocalGroupMember -SID 'S-1-5-32-544' |
    Where-Object { $_.SID.Value -eq $User.SID.Value }

$Task = Get-ScheduledTask -TaskName $TaskName
$Task | Select-Object State,
    @{Name='FileWave-Remove-Temporary-Admin-Filewave'Action';Expression={$_.Actions[0].Execute}},
    @{Name='Principal';Expression={$_.Principal.UserId}},
    @{Name='RunLevel';Expression={$_.Principal.RunLevel}}
$Task.Triggers | Select-Object @{Name='Type';Expression={$_.CimClass.CimClassName}}, StartBoundary, Repetition
$Task.Settings | Select-Object StartWhenAvailable, RestartCount, RestartInterval, MultipleInstances

Get-Content (Join-Path $WorkingDirectory 'C:\ProgramData\FileWave\TempAdmin\Temporary-Admin.log') -Tail 20
Get-Content 'C:\ProgramData\FileWave\TempAdmin\Filewave.temporary-admin.json'$StateFile -Raw

The account should appear in the Administrators group.Administrators. The scheduled task should existrun withas Local System at highest privilege and show an expiration triggertrigger, a daily trigger, and a startup trigger. The log and state file should show the current lease ID and UTC expiration.

After the window expires, allow at least one five-minute retry interval, then run:

$UserName = 'Filewave' # Use the exact Launch Argument value
$WorkingDirectory = Join-Path $env:WINDIR 'System32\config\systemprofile\AppData\Local\FileWave\TempAdmin'
$TaskName = 'FileWave-Remove-Temporary-Admin-' + $UserName
$StateFile = Join-Path $WorkingDirectory ($UserName + '.temporary-admin.json')
$User = Get-LocalUser -Name 'Filewave'$UserName

[bool](Get-LocalGroupMember -SID 'S-1-5-32-544' |
    Where-Object { $_.SID.Value -eq $User.SID.Value })
Get-ScheduledTask -TaskName 'FileWave-Remove-Temporary-Admin-Filewave'$TaskName -ErrorAction SilentlyContinue
Test-Path 'C:\ProgramData\FileWave\TempAdmin\Filewave.temporary-admin.json'$StateFile
Get-Content (Join-Path $WorkingDirectory 'C:\ProgramData\FileWave\TempAdmin\Temporary-Admin.log') -Tail 20

The membership check and Test-Path should return False, and the scheduled-task command should return nothing. The log should include Removed temporary administrator access from Filewave.<account> for lease <lease-id>.

Windows does not revoke existing elevated processes when group membership is removed. Close any elevated tools and sign out of sessions that used the account. TheMembership scriptremoval prevents newelevation elevationsby afternewly cleanup;created tokens that no longer contain administrator membership; it cannot terminate existing processes or undo changes made or access already granted during the window.lease.

Troubleshooting

Symptom Check
The Fileset script exits with code 1 Read the FileWave-generated script output and C:\ProgramData\Windows\System32\config\systemprofile\AppData\Local\FileWave\TempAdmin\Temporary-Admin.log. Confirm the local account exists, is enabled, and uses an allowed account name.
The account is already an administrator, but no removal task appears This is intentional when no valid script-owned state exists. The script assumes the account is a permanent administrator and does not schedule its removal.
LocalAccounts cmdlets are unavailable Confirm the target is 64-bit Windows and that the script reached C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. Review the Fileset bitness. The Sysnative path applies only when a 32-bit process is crossing into 64-bit Windows.
The device was powered off at expiration The cleanup task uses Start when available and a startup trigger. Start the device, allow Task Scheduler to run, then verify membership and the log.
The account remains an administrator after the retry windowexpiration Treat this as a failed security control. Remove the membership manually, inspect Task Scheduler history and the log, and do not issue another grant until the failure is understood.
A UAC prompt still rejects the account immediately after the grant Confirm the prompt uses the dedicated local account and correct password. If you changed membership for an account that was already signed in, Windows may continue using its existing logon token. This recipe is designed for a separate credential account, not the current daily-user session.
An elevated application still runs after expiration Expected Windows token behavior. Close the elevated process or end the session. Membership removal controls later access but does not terminate processes that already hold an elevated token.

Emergency manual revocation

Use this only for an account that this workflow temporarily elevated. Running it against a permanent administrator removes that permanent membership. Membership removal must succeed and be verified before the task or state is deleted. Existing elevated processes and tokens remain valid until closed or the session ends.

$ErrorActionPreference = 'Stop'
$UserName = 'Filewave' # Use the exact Launch Argument value
$AdminGroupSid = 'S-1-5-32-544'
$WorkingDirectory = Join-Path $env:WINDIR 'System32\config\systemprofile\AppData\Local\FileWave\TempAdmin'
$TaskName = 'FileWave-Remove-Temporary-Admin-' + $UserName
$StateFile = Join-Path $WorkingDirectory ($UserName + '.temporary-admin.json')
$CleanupScript = Join-Path $WorkingDirectory ('Remove-' + $UserName + '-Temporary-Admin.ps1')
$User = Get-LocalUser -Name 'Filewave'$UserName -ErrorAction Stop

Remove-LocalGroupMember -SID 'S-1-5-32-544'$AdminGroupSid -Member $User -Confirm:$false -ErrorAction Stop
$StillMember = [bool](Get-LocalGroupMember -SID $AdminGroupSid -ErrorAction Stop |
    Where-Object { $_.SID.Value -eq $User.SID.Value })
if ($StillMember) {
    throw 'Administrator membership remains. Task and state were preserved for retry and investigation.'
}

if ($null -ne (Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue)) {
    Unregister-ScheduledTask -TaskName 'FileWave-Remove-Temporary-Admin-Filewave'$TaskName -Confirm:$false -ErrorAction SilentlyContinueStop
}
Remove-Item 'C:\ProgramData\FileWave\TempAdmin\Filewave.temporary-admin.json'-LiteralPath -Force$StateFile, -ErrorAction SilentlyContinue
Remove-Item 'C:\ProgramData\FileWave\TempAdmin\Remove-Filewave-Temporary-Admin.ps1'$CleanupScript -Force -ErrorAction SilentlyContinue

ReviewClose any elevated tools and end sessions that used the account, then review the protected workflow log and the Windows Security event log afterward.log. If an unapproved user or process interfered with cleanup, treat the device as potentially changed while administrator access was active.

Back to top