2

I was trying to debug an application that was not working on specific environments and in my research I had multiple sources refer me to the tool Process Monitor found in \live.sysinternals.com\tools.

Not having admin access to my machine I made a request to IT to get permission to install and use this tool.

Fast forward a few days and I get a response saying that I would be able to use it under supervision and that "they are allowing it this time, but was definitely given a serious cautionary note with it."

By this time I had already used another tool to read the ".bin" files in the library and I was able to find the error (the library had an updated bin file while the library required a previous version) and I no longer needed the tool.

I'm a little perplex at the response I got from IT. My question is how can the use of this tool be a concern to IT?

2
  • 3
    Why not ask IT?
    – Teun Vink
    Nov 18 '20 at 19:38
  • I'm having trouble formulating a request that would not be taken in an adversarial manner. After being given permission to use it with supervision, I asked them which of the tools in \live.sysinternals.com\tools I would be able to use under admin/IT supervision and it got me the quote I posted. I do think that there is a little tension in our relationship. My previous jobs were contracts and start ups where I had admin privileges and I've been hitting many soft issues asking for non standard applications t be installed. I'm sure I'm very unique for this at the company. Nov 18 '20 at 20:21
3

Process Monitor needs to run with Administrator rights. In fact, it installs a driver to peek on the actions performed on the filesystem, registry, network, etc.

As it obtains data system-wide, the concern of IT might be that you might get access to data you shouldn't, either for the system/setup or -if this was a shared machine- of other users. ProcessMonitor only shows metadata but even that might be too much information (e.g. suppose someone was working on file Z:\Departments\Human resources\Dec 2020 massive layoff\Schedule.docx!).

However, I think the concern will be more basic. Process Monitor need to run as administrator, and it is likely it would be possible to escalate privileges from it. I think their decision of letting you use the program needed, but with someone from IT supervising you is a good solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.