One of the new features in Privileges 2.x is the unified ability to set and manage how long you want to grant admin rights, where running Privileges grants admin rights for a defined amount of time and then those admin rights are taken away. This ability had also existed in Privileges 1.x but it was exclusively tied to Privileges 1.x’s Toggle Privileges function, where in Privileges 2.x it is available no matter how Privileges is being run.

By default, Privileges 2.x will grant administrator rights for 20 minutes if not configured otherwise.

But what if you want to configure it otherwise? There are management options available for this. For more details, please see below the jump.

The relevant preference domain and key values are listed below:

• Preference domain: corp.sap.privileges
• Key: ExpirationInterval
• Value: Positive Integer

• Preference domain: corp.sap.privileges
• Key: ExpirationIntervalMax
• Value: Positive Integer

Note: In both cases, the positive integer values are defining time in minutes.

ExpirationInterval:

The ExpirationInterval key defines a set time in minutes after which administrator rights expire and the logged-in user reverts to using standard user rights. For example, setting ExpirationInterval to a value of 15 would set Privileges to allow admin rights for fifteen minutes. Once the fifteen minutes are up, the logged-in user reverts to using standard user rights.

In this example, the Administrator privileges expire setting in the Privileges settings would be set to the defined value and grayed out.

Note: Setting a value of 0 disables the timeout and allows the user to request administrator privileges which do not expire.

ExpirationIntervalMax:

The ExpirationIntervalMax key defines a set time in minutes after which administrator rights expire and the logged-in user reverts to using standard user rights. In general, this works like the ExpirationInterval key but it allows the logged-in user to choose a timeout value which is different as long it does not exceed the defined value.

For example, setting ExpirationIntervalMax to a value of 20 would set Privileges to allow admin rights for twenty minutes. However, the logged-in user can go into the Privileges settings and set a different time interval for the Administrator privileges expire setting as long as that time interval does not exceed the defined value of twenty minutes.

Note: In the event that both the ExpirationInterval and ExpirationIntervalMax settings are set, as of Privileges 2.0 the ExpirationInterval behavior will be applied. The Administrator privileges expire setting in the Privileges settings would be set to the defined value for ExpirationInterval and be grayed out.

The ExpirationInterval and ExpirationIntervalMax settings can be managed by configuration profiles. Please see below for example profiles.

ExpirationInterval:

ExpirationIntervalMax: