The company I work at uses a program on their Windows workstations that runs as the logged-in user but some tasks require elevated privileges. The user must be able to run these without having admin permissions himself.
The current approach is that at the installation of said program a Windows Service is installed with the user
autostart enabled. The elevated privilege tasks are implemented in the service and whenever the program needs one it just calls the service.
For me this seems kind of fishy because with the current setup any program could at any time call the service and run the implemented tasks with elevated privileges.
Since I'm not an expert in IT security my questions are:
Is this issue really as bad as it seems to me and what would be the right approach to handle the given problem?