---
title: Commmand Policy
slug: kronpam-agent-reference-guide-3-8-1/commmand-policy
docTags: 
createdAt: 2026-06-24T09:09:34.566Z
---

The "reboot" command might be blocked for all users globally, but through an **Advanced Policy**, we can grant the "Linux Administrator" group permission to use it. If an advanced rule exists for a command, it overrides the general policy for those specific users, and the advanced rule takes precedence.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/GCX4SvRFMr9sZMUPEULU3_image.png "Advance Policy")

To create an **Advanced Policy**, click the **ADD** button in the top-right corner of the screen and proceed by filling in the required information.

1.      **First Step:** You must assign a name to the Advanced Policy and select the specific **users or user groups** to whom this policy will apply.

2.      **Second Step:** You add the specific command to be governed by the policy, along with any necessary details (parameters, paths, etc.).

3.      **Third Step:** You must select the policy type. There are three options available, and the subsequent steps vary slightly based on your choice:

a.      **Allow:** If selected, you will be asked to specify the **endpoints** where this policy is valid and define the behavior for **subprocesses**.

b.      **Block:** If selected, you must specify the relevant **endpoints** and decide whether or not to display a **warning notification** to the end user when the command is blocked.

c.      **Elevation:** If selected, you will define the target **endpoints** and **subprocess** behavior. Most importantly, you must configure the approval mechanism: whether the command requires **OTP (One-Time Password)**, **Managerial Approval**, or both.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/kzV_DV6H4KBhsXb1U2rln_image.png "Choosing the User / User Group in Advance Policy")

:::hint{type="info"}
When selecting users in **Advanced Policy**, the listed users are those who have been imported into **Kron PAM** from **Active Directory**. Local users are not populated or displayed in this section.
:::

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/lNEYQXsCNbEGbPCGDPTct_image.png "Entering Command related parameters")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/KQEIVNM_TcLtiZGhBainp_image.png "Choosing Policy in Advance Policy")

If Allow policy is selected, the steps below will be configured.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/29_0AlAuV0EJCzLQcQyr-_image.png "Choosing Endpoints to apply the Advance Policy")

:::hint{type="info"}
If "Apply to All Agents" is selected, the policy will be **received by **every endpoint where an agent is installed.
:::

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/P8XHtCcgjIneLUALWZBMX_image.png "Choosing the Subprocess policy in the case of Allow Advance policy")

If Block policy is selected, the steps below will be configured.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/_dR7jRAJDIxPVsaXy7vLk_image.png "Choosing Endpoints to apply the Advance Policy")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/bWD-EymNNDJUslZEwEy2e_image.png "Choosing whether to display warnings to the End User or not")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/iLA2y8648LMM-Mef_EBgE_image.png "Choosing the Elevation type for Block Advance Policy")

If Elevation policy is selected,the steps below will be configured.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/CUOplMmiv0R-eR6-OnHB__image.png "Choosing Endpoints to apply the Advance Policy")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/2Z_l-i7mCCECXnz8h6YKn_image.png "Choosing the Subprocess policy in the case of Elevated Advance policy")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/zxL61oy9XbuAd6XJ15YEQ_image.png "Choosing the Elevation type in Advance Policy")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/-ABKJiDTWpR0WIjbPLmgq_image.png "OTP Elevation for Date command")