2

I was trying to debug an application that was not working on specific environments and in my research I had multiple sources refer me to the tool Process Monitor found in \live.sysinternals.com\tools.

Not having admin access to my machine I made a request to IT to get permission to install and use this tool.

Fast forward a few days and I get a response saying that I would be able to use it under supervision and that "they are allowing it this time, but was definitely given a serious cautionary note with it."

By this time I had already used another tool to read the ".bin" files in the library and I was able to find the error (the library had an updated bin file while the library required a previous version) and I no longer needed the tool.

I'm a little perplex at the response I got from IT. My question is how can the use of this tool be a concern to IT?

Improve this question
2
  • 3
    Why not ask IT?
    – Teun Vink
    Commented Nov 18, 2020 at 19:38
  • I'm having trouble formulating a request that would not be taken in an adversarial manner. After being given permission to use it with supervision, I asked them which of the tools in \live.sysinternals.com\tools I would be able to use under admin/IT supervision and it got me the quote I posted. I do think that there is a little tension in our relationship. My previous jobs were contracts and start ups where I had admin privileges and I've been hitting many soft issues asking for non standard applications t be installed. I'm sure I'm very unique for this at the company.
    – Mandelbrotter
    Commented Nov 18, 2020 at 20:21

1 Answer 1

Reset to default
3

Process Monitor needs to run with Administrator rights. In fact, it installs a driver to peek on the actions performed on the filesystem, registry, network, etc.

As it obtains data system-wide, the concern of IT might be that you might get access to data you shouldn't, either for the system/setup or -if this was a shared machine- of other users. ProcessMonitor only shows metadata but even that might be too much information (e.g. suppose someone was working on file Z:\Departments\Human resources\Dec 2020 massive layoff\Schedule.docx!).

However, I think the concern will be more basic. Process Monitor need to run as administrator, and it is likely it would be possible to escalate privileges from it. I think their decision of letting you use the program needed, but with someone from IT supervising you is a good solution.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .