In our instance, we’ve allowed a few on-site technicians to access and perform basic administration of some ConnectWise tools. However, we’ve discovered that to whitelist Access Management requests, a user must have full Admin rights on the ScreenConnect portal. Unfortunately, we can’t grant this level of access due to security concerns and the visibility it provides into other customers’ environments. It would be ideal if the ability to create a rule for auto-approving certain UAC prompts could be separated from the main Admin permissions, allowing it to be assigned individually.

I have a rule like this:

Event.EventType = 'RequestedElevation' AND (GETDATAFIELD(CorrelationEvent.Data, 'PublisherName') = 'Adobe Inc.' OR GETDATAFIELD(CorrelationEvent.Data, 'PublisherName') = 'Adobe Systems, Incorporated')

and it does not seem to be working and wondering if my syntax is off - I want to do something if the EventType is RequestedElevation and the publisher name is 1 of 2 options

Currently, tickets generated by CAM requests are only assigned to one Company in PSA.  Since the CompanyID should match, I would like to be able to automatically assign these to the client, dynamically.

If a staffer is unavailable to approve/deny a UAC elevation request, you should be able to queue that request so that a staffer can approve/deny the request when they're available next. 

Auto-Elevate from CyberFox does this well. They make a temporary rule allowing for a one-time elevation of whatever the request was. That way, the next time the end user makes the elevation request, it will auto-approve.

RiskAssessment script or MSI so it can be deployed via GPO for easier deployment on clients

Sometimes the alerts can be a bit slow to come through but a webhook to Teams maybe that gives link to the request for approval  

When the following criteria are met:

• Performing an administrative logon with CAM
• The guest is a domain controller

The temp admin account should be added to the domain admins group prior to logon. This would allow some tasks that are restricted to domain admins, such as editing the default domain controllers GPO.

I would like to have CAM bring in more details to create rules on, specifically fields like product version and product name. This way we could whitelist in this example publisher=Microsoft, product name=PowerToys*, version > 0.69.1 and it would be safely scoped to only Microsoft powertoys with version greater than 0.69. Currently with the options we have available the closest I can do is to whitelist all Microsoft products with filename of PowerToys* which a clever user could rename any Microsoft application and install. More granularity in the fields to create rules on would help.

When using CAM for UAC prompt approval the UAC prompt appears for a few seconds before it is approved and the elevation continues.

As I understand it some of the delay is from the agent having to check in online to the screenconnect instance to see if the UAC prompt applies to one of the configured CAM rules. 

Is it possible for the CAM rules to be downloaded to the agent on the machine locally so that the approval process is faster?