Elevated Access via BeyondTrust Jump Client
1. Purpose
With the transition to the new Intune Autopilot deployment process, Windows devices no longer receive the legacy Group Policy Object (GPO) that automatically added the FSIT Staff security group to the local Administrators group. Administrative access is now primarily managed through Microsoft LAPS (Local Administrator Password Solution).
While LAPS provides strong, auditable, per-machine local administrator passwords, retrieving and using these passwords adds several steps for technicians during routine support. The BeyondTrust (formerly Bomgar) Jump Client, deployed via Intune as a system application, runs in an elevated system context. This enables technicians to launch an elevated Command Shell that executes commands with administrative privileges (typically NT AUTHORITY\SYSTEM) without requiring the LAPS password.
Preferred Approach: This method is the preferred first approach for command-line and scripted administrative tasks on Autopilot devices. Use LAPS only when interactive GUI elevation in a specific user context or direct local admin login is required.
2. Policy & Responsible Use IMPORTANT
Jump Client Restrictions and Requirements
1) Eligibility Restrictions
- Disciplinary Status Restriction: FS IT staff may not initiate or participate in any Jump Client session while under active disciplinary action (written warning or higher, or any active performance/disciplinary plan).
- Probationary Period Restriction: FS IT staff may not use Jump Client during their first six (6) months of employment (probationary period).
2) Operational Requirements
- Ticket Requirement (Mandatory): A corresponding TeamDynamix (TDX) ticket must exist before initiating a Jump Client session. The ticket must clearly document the following.
- the reason for access,
- the computer/device accessed, and
- actions taken during the session.
- Authorized Business Use Only: Jump Client access is restricted to official Facilities Services IT support and administrative tasks. Personal use, curiosity-driven access, testing on non-assigned devices, or any non-work-related activity is prohibited.
- User Notification — Attended Sessions: If a user is actively logged on and present, FS IT staff must notify the user prior to connecting via Teams chat, phone, or the BeyondTrust chat window.
- Unattended Access (Permitted and Encouraged): Jump Clients may be used without user notification when no user is present (e.g., servers, lab equipment, conference rooms, classroom devices, after-hours maintenance, Autopilot troubleshooting).
3) Monitoring, Accountability, and Enforcement
- Audit Logging: All Jump Client sessions and commands executed in the Command Shell are recorded in BeyondTrust, attributable to the user, and subject to review.
- FS IT Supervisors shall audit the Jump Client sessions log twice per year or when requested by an investigation.
Consequences: Violations of these restrictions and requirements (including use without a ticket, without business justification, or without required user notification when applicable) may result in disciplinary action.
3. Scope
This procedure applies to all Windows 10 and Windows 11 devices that have been deployed or re-provisioned using the new Autopilot process and have the BeyondTrust Jump Client installed as a required/system application through Intune.
In Scope
- Command Shell operations performed through active Jump Client sessions in the BeyondTrust Representative Console.
- File Transfer + elevated execution of installers, scripts, and configuration changes.
- Common troubleshooting, repair, deployment, and maintenance tasks that can be performed non-interactively or via elevated shell.
- Verification of elevation status and privileged command execution.
- Both attended (user present, with notification) and unattended (no user present) scenarios.
Out of Scope
- Interactive desktop sessions requiring per-user elevation or user-context application troubleshooting (use LAPS in these cases).
- Tasks that require the BeyondTrust session to be elevated via end-user credentials (attended sessions where the user must approve elevation).
- Jump Client deployment or configuration changes (see separate Intune application SOP).
4. Prerequisites & Requirements
| Requirement |
Details |
| BeyondTrust Access |
Active Representative Console (desktop or web) with permissions to initiate Jump Client sessions for the relevant asset groups (FS devices). |
| Device State |
Target device must be powered on, network-connected, and the Jump Client must be reporting as online/healthy in the BeyondTrust console. |
| Jump Client Type |
Must be the Intune-deployed system application version (elevated/service context). User-mode Jump Clients do not support the elevated shell option. |
| Knowledge |
Technician should be comfortable with Windows command-line and PowerShell administration. Basic BeyondTrust session navigation required. |
| Ticket |
A TeamDynamix (or approved) ticket must be open and associated with the work before starting the session. |
5. Procedure
5.1 Initiate a Jump Client Session
- Open the BeyondTrust Representative Console and authenticate.
- Navigate to the Jump Clients or Assets view.
- Locate the target device using search (hostname, username, IP address, or asset tag).
- Select the device and click Start Session (or equivalent). Because this is a pre-installed Jump Client, the unattended session should connect immediately.
- Critical – User Notification: If an end user is currently logged on and present, notify them first via Teams, phone, or BeyondTrust chat before connecting.
Unattended devices: No notification is needed when there is no active user session. This is the primary strength of Jump Clients for servers, labs, and after-hours work.
5.2 Start the Elevated Command Shell
- In the active session, open the Command Shell tool (usually in the sidebar or tools panel).
- By default, new shells may start in the context of the logged-in user.
- Activate the option to open an elevated shell, Go System/Root, or System Context tab. This option is available because our Jump Client is deployed in the system context via Intune.
- A new shell tab will open running with high administrative privileges (typically NT AUTHORITY\SYSTEM).
- Immediately verify elevation by running these commands:
whoami
whoami /priv
net localgroup administrators
Expected result for whoami: nt authority\system
5.3 Perform Administrative Tasks
Type commands directly into the elevated shell tab. Commands execute on the remote device in the privileged context. You may open multiple shell tabs for parallel work.
For repetitive procedures, request that BeyondTrust administrators create Canned Scripts that can be run with one click.
5.4 File Transfer + Elevated Execution
Use the File Transfer tool to copy installers or scripts to C:\Temp (or another location), then execute them from the elevated Command Shell using silent switches.
msiexec.exe /i "C:\Temp\AppName.msi" /qn /norestart /l*v "C:\Temp\install.log"
5.5 End Session & Documentation
- Close shells properly and end the BeyondTrust session.
- Document in the ticket: “Used elevated Jump Client Command Shell (SYSTEM context) for [specific actions]. User was notified prior to connection (if applicable).”
6. Quick Reference: Common Commands in Elevated Shell
All commands below assume execution inside an elevated (SYSTEM context) Command Shell tab.
Verification & System Information
| Command |
Purpose |
whoami |
Confirm current user context (expect nt authority\system) |
whoami /all |
Full details: groups, privileges, logon ID |
systeminfo |
Detailed OS, hardware, hotfix, and network info |
hostname |
Quick device name confirmation |
Group Policy, Updates & Servicing
| Command |
Purpose |
gpupdate /force |
Force immediate Group Policy refresh |
gpresult /r /scope computer |
Display applied computer GPOs |
DISM /Online /Cleanup-Image /RestoreHealth |
Repair Windows component store |
sfc /scannow |
Scan and repair protected system files |
Network Troubleshooting
| Command |
Purpose |
ipconfig /all |
Full IP configuration and DNS info |
ipconfig /flushdns |
Clear DNS resolver cache |
netsh winsock reset |
Reset Winsock catalog |
Test-NetConnection -ComputerName server -Port 443 |
PowerShell connectivity and port test |
Services, Processes & Tasks
| Command |
Purpose |
sc query servicename |
Check service status |
sc stop servicename / sc start servicename |
Stop or start a service |
Restart-Service -Name servicename -Force |
PowerShell restart service |
taskkill /PID #### /F |
Force-kill process by PID (use with caution) |
Software Installation Examples
| Command / Example |
Notes |
msiexec /i "C:\Temp\App.msi" /qn /norestart |
Standard quiet MSI install |
"C:\Temp\Setup.exe" /silent /norestart |
Many EXE installers support /silent or /quiet |
winget install --id Publisher.AppName -e --silent |
Windows Package Manager (if available) |
Launching Administrative GUI Tools
These launch on the remote device in SYSTEM context (visible if screen sharing with a logged-on user):
| Command |
Tool |
compmgmt.msc |
Computer Management |
services.msc |
Services |
eventvwr.msc |
Event Viewer |
regedit.exe |
Registry Editor |
devmgmt.msc |
Device Manager |
ms-settings: |
Settings menu |
ms-settings:windowsupdate |
Windows Update |
ms-settings:display |
Display settings |
Note: For fully remote/headless work, prefer pure CLI or PowerShell commands.
7. When to Use LAPS Instead
Use LAPS password retrieval when:
- You need to perform actions in the specific context of the logged-on user’s profile.
- The task requires an interactive graphical application without reliable silent options.
- You need to log on directly as the local administrator account.
- The elevated Command Shell is not functioning as expected for that device.
8. Best Practices & Security
- Always verify elevation with
whoami at the start of every elevated shell session.
- Document in the ticket — note that you used the elevated Jump Client shell and whether the user was notified.
- Prefer specific commands over broad or destructive ones.
- Use Canned Scripts for repetitive tasks when available.
- Report any issues with Jump Client elevation to the infrastructure team.