How to revoke elevation access in ThreatLocker?

This document outlines the step-by-step process of how to revoke elevation access in ThreatLocker Dashboard.

This article is a part of our ThreatLocker How-to Guides series, Chapter 07 – Elevation Control (Privilege Management).

Introduction

Elevation policies in ThreatLocker grant temporary administrator privileges to approved applications. However, there may be times when you need to revoke access, either due to policy changes, user role adjustments, or security concerns.

This guide explains how to disable or remove an existing elevation policy to stop elevated access immediately.

Implementation

Step 1: Confirm That an Elevation Policy Exists

1. Log in to the ThreatLocker Portal.
2. Navigate to Modules > Application Control > Policies
3. Locate the elevation policy you want to revoke and select it.

4. Two options to achieve the goal:

• Deny the policy to temporarily pause elevation access
• Delete the policy to permanently remove elevation access

Step 2: verify and Deploy the Policy to revoke elevation access in ThreatLocker

Once the change is made, click Deploy to apply the changes.

Conclusion

Revoking elevation access helps maintain strict administrative control and reduces the risk of misuse. Whether you’re disabling access for one app or decommissioning a broader policy, ThreatLocker makes it easy to take action in real time.This ensures your Zero Trust environment remains secure and adaptable to changing organizational needs.