How to allow an application to run with admin rights in ThreatLocker?

This document outlines the step-by-step process of how to allow an application to run with admin rights in ThreatLocker Dashboard.

This article is a part of our ThreatLocker How-to Guides series, Chapter 07 – Elevation Control (Privilege Management).

Introduction

Some applications require administrator privileges to function properly, such as Command Prompt (CMD), diagnostic tools, or system utilities. Using ThreatLocker Elevation Control, you can allow specific apps to run with elevated rights—without giving full admin access to users.

This guide will walk you through the steps to create a policy that allows CMD to run as local administrator.

Implementation

Step 1: Access the Application Control Module

1. Log in to the ThreatLocker Portal.
2. Navigate to Modules > Application Control
3. Click Create Policy

Step 2: Create the Elevation Policy

1. Fill the policy form:

• In the Details section:
  • Name: Elevation Control – CMD
  • Description: Allow running CMD as local administrator
• In the Applied To section:
  • Select the target computer or computer group where the policy should apply

• In the Condition section:
  • Select the application: Command Prompt (CMD)
  • Choose All Interfaces
  • Select “No Policy Expiration” to ensure the rule remains active indefinitely.
• In the Action section:
  • Enable “Assist with programs that require local administrator privileges”
    • Select “Elevate to run as local administrator”
      • (Optional) Enable “Notify User” to inform the user
    • (Optional) Set a duration for how long elevation should be active (e.g., 30 minutes, 12 hours)

2. Click Create to save the policy once all fields are completed

Step 3: Deploy the Policy to allow an application to run with admin rights in ThreatLocker

Deploy the policy from the policy list to enforce it on the target devices

Conclusion

Granting admin rights to specific applications like CMD through ThreatLocker Elevation Control helps support IT operations while enforcing the principles of least privilege and Zero Trust.

This approach limits risk, ensures visibility, and gives users the access they need, only when they need it.