Skip to main content

Temporary Administrator Access on Windows with FileWave

Validation status

Runtime validated August 7, 2026. The exact attached script was exercised as Local System on Windows 11 Pro 10.0.26200 using native 64-bit Windows PowerShell 5.1.26100.8246. Testing confirmed a fresh grant, active-lease renewal, automatic expiration, startup cleanup after the device remained off past expiration, permanent-administrator preservation, protected state and script files, scheduled-task readback, and removal of the QA accounts and artifacts. The attachment SHA-256 is db196660a5acfe8dfdc8840b1c856e72816cb84b0cdc43c9b7487fe038153730. Start with one representative device in your own environment before authorizing production use.

Overview

This recipe uses a FileWave Fileset to add an existing dedicated local Windows account to the built-in Administrators group for a limited period. The default window is 10 minutes. A scheduled task running as Local System removes the membership when the window expires.

Use the dedicated account to answer a UAC credential prompt when approved support work requires administrator rights. The script does not create, enable, unlock, or set the password for the account.

Temporary local administrator access is not a security boundary. During the access window, an administrator can disable the cleanup task, change protected files, create another administrator, install persistent software, or interfere with management. Removing group membership also does not terminate processes that were already elevated or invalidate access tokens that Windows already issued. Use a dedicated support account, keep the window short, retain a separate recovery administrator, and investigate any failed cleanup immediately.

Requirements

  • FileWave Central and enrolled Windows clients.
  • An existing, enabled local Windows account with the same name on each target device. The example uses Filewave.
  • The account is normally a standard user and is not used as a permanent administrator or as the user's daily sign-in account.
  • 64-bit Windows with Windows PowerShell 5.1, the Microsoft.PowerShell.LocalAccounts module, and the ScheduledTasks module. Do not use this workflow on a domain controller.
  • A separate protected administrator or recovery method that does not depend on this workflow.
  • A separate managed method for provisioning and rotating the dedicated account password. This workflow does not need the password, so do not add it to this script, Fileset, or its Launch Arguments.
  • Treat this as an approved, device-specific privilege lease. Do not assign the Fileset broadly or allow another workflow to add the same account to Administrators while a lease is active.
  • A common account name must not mean a shared fleet-wide password. Prefer unique per-device credentials, protect retrieval, rotate them through a separate managed process, and retain an approval and audit record for each request.

Download

Item Purpose
Grant-FileWave-Temporary-Admin.ps1 Activation script that grants or renews temporary administrator membership and registers cleanup as Local System.

How the script works

  1. It relaunches in native 64-bit Windows PowerShell 5.1 when needed, verifies Local System identity, confirms the required commands are available, and resolves exactly one enabled local account.
  2. It stores enforcement artifacts beneath the protected Local System profile instead of the user-writable C:\ProgramData\FileWave tree. The script rejects reparse points and hard-linked artifacts, applies protected ACLs owned by Local System, and permits local administrators read-only access.
  3. It identifies the account and Administrators group by SID. If the account is already a direct administrator and no valid script-owned state exists, it treats that membership as permanent and leaves it unchanged.
  4. It serializes all grants, renewals, and cleanup operations with one global workspace mutex. Each approved run receives a new lease ID and UTC expiration.
  5. Before adding membership, it writes state and the generated cleanup script with create-new, write-through, atomic replacement; validates their bytes and ACLs; and registers the cleanup task as Local System.
  6. It reads the scheduled task back and verifies its action, Local System principal, highest run level, expiration, startup and daily triggers, repetition settings, retry policy, battery behavior, and enabled state before changing membership.
  7. It re-resolves the exact account SID immediately before the transition, adds membership only after cleanup enforcement is ready, and performs a final holistic readback of membership, lease state, artifacts, and task configuration.
  8. The task starts at expiration, retries every five minutes for seven days, then continues daily and at system startup until cleanup succeeds. Cleanup verifies membership absence before removing enforcement artifacts.
  9. If the workflow owns temporary membership but cannot secure or verify automatic cleanup, it attempts to remove that membership immediately and exits with code 1. Failed removal preserves the task and evidence for retry and investigation.

Create the Fileset

  1. Download Grant-FileWave-Temporary-Admin.ps1.
  2. In FileWave Central, open Filesets and create an empty Fileset named Temporary Administrator Access - Windows.
  3. Select the Fileset and open the Scripts view.
  4. Import the PowerShell file as an Activation script.
  5. Open the script properties and add these Launch Arguments in order:
Position Value Purpose
1 -UserName Names the first parameter.
2 Filewave The dedicated local account. Allowed characters are letters, numbers, periods, underscores, and hyphens, up to 20 characters.
3 -DurationMinutes Names the duration parameter.
4 10 Temporary access duration. The script accepts 1 through 1,440 minutes; use the shortest operational window.

FileWave activation-script settings showing the ordered UserName and DurationMinutes launch arguments

Launch Argument order: -UserName, account name, -DurationMinutes, duration. The other execution-control values visible in the screenshot are examples, not additional requirements for this recipe.

New Filesets use 64-bit script execution by default starting with FileWave 15.5. Filesets created before upgrading can retain their previous 32-bit setting, so review the Fileset before deployment. The script relaunches through Sysnative from a 32-bit host, or through System32 from PowerShell 7, to ensure that both grant and cleanup run in native 64-bit Windows PowerShell 5.1.

Deploy and grant access

  1. Create a Deployment for one representative Windows test device. If your environment still uses legacy Fileset Associations, associate the Fileset only with that device.
  2. Select Update Model. The lease begins when the activation script runs, not when the account is first used at a UAC prompt.
  3. Wait for activation, then confirm the grant, task definition, protected state, expiration, and startup cleanup using the verification steps below.
  4. After the pilot passes, target the Fileset only to the individually approved device or request. Do not assign this privilege workflow to a broad standing group.
  5. Use the dedicated account only for the approved UAC prompt or support task. Do not use it as the daily sign-in account.

The Deployment can remain assigned after cleanup; a completed Fileset does not run again merely because it remains assigned. For each later approved request, use Reinstall Fileset from Client Info or Fileset Reports on FileWave 16.3 or later. Reinstalling while a lease is active replaces it with a new window beginning at that activation. On an earlier FileWave version, remove the Deployment only after cleanup is verified, select Update Model, then deploy the Fileset again for the next approved request.

Verify the test device

Run the following in 64-bit Windows PowerShell as an administrator immediately after activation:

$UserName = 'Filewave' # Use the exact Launch Argument value
$WorkingDirectory = Join-Path $env:WINDIR 'System32\config\systemprofile\AppData\Local\FileWave\TempAdmin'
$TaskName = 'FileWave-Remove-Temporary-Admin-' + $UserName
$StateFile = Join-Path $WorkingDirectory ($UserName + '.temporary-admin.json')
$User = Get-LocalUser -Name $UserName

Get-LocalGroupMember -SID 'S-1-5-32-544' |
    Where-Object { $_.SID.Value -eq $User.SID.Value }

$Task = Get-ScheduledTask -TaskName $TaskName
$Task | Select-Object State,
    @{Name='Action';Expression={$_.Actions[0].Execute}},
    @{Name='Principal';Expression={$_.Principal.UserId}},
    @{Name='RunLevel';Expression={$_.Principal.RunLevel}}
$Task.Triggers | Select-Object @{Name='Type';Expression={$_.CimClass.CimClassName}}, StartBoundary, Repetition
$Task.Settings | Select-Object StartWhenAvailable, RestartCount, RestartInterval, MultipleInstances

Get-Content (Join-Path $WorkingDirectory 'Temporary-Admin.log') -Tail 20
Get-Content $StateFile -Raw

The account should appear in Administrators. The task should run as Local System at highest privilege and show an expiration trigger, a daily trigger, and a startup trigger. The log and state file should show the current lease ID and UTC expiration.

After the window expires, allow at least one five-minute retry interval, then run:

$UserName = 'Filewave' # Use the exact Launch Argument value
$WorkingDirectory = Join-Path $env:WINDIR 'System32\config\systemprofile\AppData\Local\FileWave\TempAdmin'
$TaskName = 'FileWave-Remove-Temporary-Admin-' + $UserName
$StateFile = Join-Path $WorkingDirectory ($UserName + '.temporary-admin.json')
$User = Get-LocalUser -Name $UserName

[bool](Get-LocalGroupMember -SID 'S-1-5-32-544' |
    Where-Object { $_.SID.Value -eq $User.SID.Value })
Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
Test-Path $StateFile
Get-Content (Join-Path $WorkingDirectory 'Temporary-Admin.log') -Tail 20

The membership check and Test-Path should return False, and the task command should return nothing. The log should include Removed temporary administrator access from <account> for lease <lease-id>.

Windows does not revoke existing elevated processes when group membership is removed. Close elevated tools and sign out sessions that used the account. Membership removal prevents elevation by newly created tokens that no longer contain administrator membership; it cannot terminate existing processes or undo changes made during the lease.

Troubleshooting

Symptom Check
The Fileset script exits with code 1 Read the FileWave-generated script output and C:\Windows\System32\config\systemprofile\AppData\Local\FileWave\TempAdmin\Temporary-Admin.log. Confirm the local account exists, is enabled, and uses an allowed account name.
The account is already an administrator, but no removal task appears This is intentional when no valid script-owned state exists. The script assumes the account is a permanent administrator and does not schedule its removal.
LocalAccounts cmdlets are unavailable Confirm the target is 64-bit Windows and that the script reached C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. Review the Fileset bitness. The Sysnative path applies only when a 32-bit process is crossing into 64-bit Windows.
The device was powered off at expiration The cleanup task uses Start when available and a startup trigger. Start the device, allow Task Scheduler to run, then verify membership and the log.
The account remains an administrator after expiration Treat this as a failed security control. Remove the membership manually, inspect Task Scheduler history and the log, and do not issue another grant until the failure is understood.
A UAC prompt still rejects the account immediately after the grant Confirm the prompt uses the dedicated local account and correct password. If you changed membership for an account that was already signed in, Windows may continue using its existing logon token. This recipe is designed for a separate credential account, not the current daily-user session.
An elevated application still runs after expiration Expected Windows token behavior. Close the elevated process or end the session. Membership removal controls later access but does not terminate processes that already hold an elevated token.

Emergency manual revocation

Use this only for an account that this workflow temporarily elevated. Running it against a permanent administrator removes that permanent membership. Membership removal must succeed and be verified before the task or state is deleted. Existing elevated processes and tokens remain valid until closed or the session ends.

$ErrorActionPreference = 'Stop'
$UserName = 'Filewave' # Use the exact Launch Argument value
$AdminGroupSid = 'S-1-5-32-544'
$WorkingDirectory = Join-Path $env:WINDIR 'System32\config\systemprofile\AppData\Local\FileWave\TempAdmin'
$TaskName = 'FileWave-Remove-Temporary-Admin-' + $UserName
$StateFile = Join-Path $WorkingDirectory ($UserName + '.temporary-admin.json')
$CleanupScript = Join-Path $WorkingDirectory ('Remove-' + $UserName + '-Temporary-Admin.ps1')
$User = Get-LocalUser -Name $UserName -ErrorAction Stop

Remove-LocalGroupMember -SID $AdminGroupSid -Member $User -Confirm:$false -ErrorAction Stop
$StillMember = [bool](Get-LocalGroupMember -SID $AdminGroupSid -ErrorAction Stop |
    Where-Object { $_.SID.Value -eq $User.SID.Value })
if ($StillMember) {
    throw 'Administrator membership remains. Task and state were preserved for retry and investigation.'
}

if ($null -ne (Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue)) {
    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction Stop
}
Remove-Item -LiteralPath $StateFile, $CleanupScript -Force -ErrorAction SilentlyContinue

Close any elevated tools and end sessions that used the account, then review the protected workflow log and Windows Security event log. If an unapproved user or process interfered with cleanup, treat the device as potentially changed while administrator access was active.

Back to top