---
title: Local Administration Right
slug: kronpam-agent-reference-guide-3-8-0/local-administration-right
docTags: 
createdAt: 2025-01-02T12:00:38.386Z
---

relogs end users need to have local administration rights on the endpoint. At this point agent supports flexibility to manage this process. On the endpoint, end-user requests the local administration right over the agent’s tray application as shown below.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/1OdjCIERw54wncy0UVliJ_image.png" size="48" width="371" height="318" position="center" caption="Menu of Tray App icon" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/BuEKsQ2ajGJgg4PVL4pb4_image.png" size="38" width="240" height="300" position="center" caption="Managerial Approval Prompt" showCaption="true"}

Then the end user needs to choose a time limitation for being a local administrator. At the end of this time Local administrator right will be taken back and the session will be terminated in a configurable time. To configure this session, the kill time below parameter should be set on the System Configuration Management page as second. The default value is 30 seconds. 

:::hint{type="info"}
win.agent.local.admin.right.expire.session.kill.time = 30
:::

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/5eA_jjFwPmCiql2zFEP_h_image.png" size="48" width="634" height="286" position="center" caption="A prompt appears after requesting the local admin right" showCaption="true"}

When the time limitation is chosen, the request goes to Kron PAM, and the end user’s manager can observe it on the My Approvals page. The manager can approve or reject it. The screen below shows that a user called demo\_user1 requested to be a local administrator for one hour.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/XnSvGh4ZsHvTlgzmGe53E_image.png "Approval request is seen on My Approval page")

If approved, a notification is shown to the end user. To gain local administrator access, the end user needs to log out and then log in again.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/O-UZlLjL82IXR2tRxyhoO_image.png" size="64" width="769" height="252" position="center" caption="Prompt appears when approval is approved " showCaption="true"}

When the end user relogs to the endpoint again, who has the local administrator right anymore till the time limitation is ended? When the time limitation is reached below kind of warning appears again and warns the end user to kill the session in a configurable time.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/nbPZyeg7fcGn0slfMgCHY_image.png" size="64" width="763" height="239" position="center" caption="Prompt appears when time is expired " showCaption="true"}

:::hint{type="info"}
\* Giving local admin rights is the online feature. Approval from the Manager is required. So, the agent and Kron PAM should communicate. If the client is offline, this feature is not going to work.
:::