Overview

AutoElevate Just-in-Time (JIT) Admin Login lets a technician sign in to a Windows computer as an administrator by scanning a QR code with the AutoElevate Notify mobile app. No password is shared, and the technician receives administrator access only for the session.

When the agent creates the JIT account, or takes control of an existing account with the same username, access to that account is granted only through the agent.

JIT Admin Login is designed and supported for Windows 10 and Windows 11 workstations on x86, x64, and ARM64. The AutoElevate credential provider is included in the single agent installer for all three architectures, so no separate package is required.

Limitations

Windows Authentication Products

Some Windows authentication products prevent the AutoElevate credential provider from loading, which hides the JIT Admin Login tile on the Windows sign-in screen. This is known to occur with DUO and WatchGuard AuthPoint.

To allow AutoElevate with DUO, see Using DUO with AutoElevate.

ARM-Based Devices

JIT Admin Login is supported on ARM64 Windows devices. Starting with Windows agent 2.11.1432.0, the credential provider is included in the same agent installer used for x86 and x64 computers. No ARM-specific installer or additional configuration is required.

Quick Start

JIT Admin Login needs two settings: Configuration turns the feature on, and Authorizations controls who can log in and what access they receive.

1. In the Admin Portal, go to Settings → Just-in-Time (JIT) Log In.
2. Edit Just-in-Time (JIT) Log In - Configuration at the Global level (pencil icon), or use the + icon at the top of the grid to create a Company, Location, or Computer level setting.
3. Check Enabled, enter a Username, and select Save.
4. Edit Just-in-Time (JIT) Log In - Authorizations, select Add Authorization, and create at least one card that names who can log in (Roles or Users) and what they receive (Local Groups). For most workgroup computers, a card with your technician role and the Local Group Administrators is enough.
5. Select Save.

Configuration Settings

Go to Settings → Just-in-Time (JIT) Log In → Just-in-Time (JIT) Log In - Configuration. Edit the Global setting (pencil icon), or use the + icon at the top of the grid to create a Company, Location, or Computer level setting.

• Enabled: Turns on JIT Admin Login. The JIT tile appears on the Windows sign-in screen only when this box is checked.
• Username: The name of the local account the technician signs in as (1–20 characters). If an account with this name already exists on the computer, its password is overwritten. This can be useful for an existing admin account, but verify the username before saving so you do not overwrite the password of an account you did not intend to change.
• Credential Tile Label Override: Custom text for the JIT tile on the Windows sign-in screen.
• Delete User After Every Log Off: Deletes the JIT account each time the technician signs out, so the account exists only while it is in use.
• Domain Log In Enabled: Off by default. Turns on JIT Domain Log In for domain-joined computers. Turning this on also changes which authorization cards apply to those computers, including for local logins. Read Authorizations before enabling it, and see JIT Domain Log In.

Persistent Users

When Delete User After Every Log Off is not checked, the JIT account persists between sessions. A persistent account is a standard user at rest, not an administrator. It is not deleted when the agent is uninstalled or when JIT Admin Login is disabled.

If Delete User After Every Log Off is enabled and the agent is uninstalled before a JIT account has been removed, that account is left on the computer.

When the technician signs out, the account is removed from the Administrators group. Any other groups granted for the session are removed the next time the account is used for a JIT login.

Selecting a Username

Avoid the usernames Administrator and ~0000AEAdmin. These accounts cannot be deleted, which blocks JIT Admin Login when Delete User After Every Log Off is enabled.

Authorizations

The Just-in-Time (JIT) Log In - Authorizations setting controls who can use JIT Admin Login and what access they receive. It is required for every JIT configuration and is the only way to grant login access. The default is empty, and an empty setting means nobody can log in.

Go to Settings → Just-in-Time (JIT) Log In → Just-in-Time (JIT) Log In - Authorizations, then select Add Authorization to create a card. Each card has six lists, and each list has an All box:

Authorization Rules

1. A role or user alone is not enough. Each card must also grant at least one Local Group (or, for domain logins, a Domain Group or Organizational Unit), or have All checked for that list. A technician covered only by a card with a role and no groups sees "Unauthorized" in the mobile app.
2. Domain-joined computers with Domain Log In Enabled use only cards whose Domains include that computer's domain (or have All checked for Domains). This applies to local administrator logins on those computers too. A card with no Domains has no effect on them.
3. All other computers use only cards with no Domains. This includes workgroup computers and any computer where Domain Log In Enabled is off.
4. Grants add up within a level. A technician or role can appear on several cards, and the technician receives everything those cards grant. Cards at different levels do not combine (see the callout above).

Example

To let the Technician role sign in as a local administrator on workgroup computers and on domain-joined computers in CONTOSO.LOCAL:

• Card 1: Roles: Technician. Local Groups: Administrators. Domains: none.
• Card 2: Roles: Technician. Local Groups: Administrators. Domains: CONTOSO.LOCAL. Add Domain Groups or Organizational Units if technicians should also be able to request domain access.

Migrated Authorizations

Authorizations created with the retired Authorized Roles & Users setting have been migrated to a single card with the Local Groups Administrators and Users and no Domains.

• After migration, rule 2 still applies. Turning on Domain Log In Enabled stops migrated users from logging in to domain-joined computers until a card that includes the domain is added.
• Authorizations added manually after migration must follow the rules above.

Logo

Go to Settings → Just-in-Time (JIT) Log In → Just-in-Time (JIT) Log In - Logo (Square). Edit the Global setting (pencil icon), or use the + icon to create a Company or Location level setting. The logo cannot be set at the Computer level.

Upload an image to use as the JIT tile icon on the Windows sign-in screen, then select Save.

• The recommended size is 192 × 192 pixels. The image cannot be larger than 1 MB.
• .webp images are not supported.
• Transparency is not preserved. Transparent areas are replaced with a white background.
• If no image is set, the AutoElevate logo is used. Select RESET TO DEFAULT to return to it.

How It Works

The AutoElevate credential provider adds a JIT tile to the Windows sign-in screen. The technician selects the tile and authenticates with the AutoElevate Notify app instead of a password.

1. At the Windows sign-in screen, the technician selects the JIT tile and begins the JIT login. A QR code appears. The QR code expires after 10 minutes.
2. In the AutoElevate Notify app, the technician selects the scan icon and scans the QR code.
3. On the Choose Login Options screen, the technician selects at least one Local Group (on domain-joined computers with Domain Log In Enabled, a Domain Group or Organizational Unit can also be selected). Only groups granted by the technician's authorization cards are listed.
4. The technician taps Submit Just-in-Time Log In Request and completes device authentication (Face ID, Touch ID, fingerprint, or passcode) if prompted.
5. Windows signs in as the JIT account, and the session starts in Technician Mode.

These screenshots show a workgroup computer, so only Local Groups appears. On a domain-joined computer with Domain Log In Enabled, Domain Groups and Organizational Unit also appear.

Self-Recovery and Safe Mode

The credential provider includes a self-recovery feature. If the JIT tile fails to load more than three times, it turns itself off. It turns back on after the AutoElevate Agent service restarts or the next time a user signs in. To reset it, restart the AutoElevate Agent service or the computer.

If the AutoElevate Agent service is not running, the JIT tile displays "The AutoElevate Agent service is not running." The standard Windows password sign-in is always available.

JIT Admin Login does not work in Safe Mode, because the AutoElevate Agent service does not run there. To sign in to a computer in Safe Mode, use a local administrator or break-glass account.

Auditing

To review JIT logins for a computer, open the computer from the Computers grid (eye icon) and select the Just-in-Time (JIT) Log Ins tab. The tab lists each request with these columns:

• State: Whether the request was authenticated. A request that was started but never completed shows as Unauthenticated.
• Authenticated By: The technician who approved the login from the mobile app.
• Date Created: When the login was started.
• Date Updated: When the request last changed state.
• Date Expired: When the login request expires: 10 minutes after it was created, or 5 minutes for an offline request. It does not show when the JIT account was removed.

Select the CSV export button to download the list.

Troubleshooting

"Unauthorized" in the Mobile App

The app displays: "Unauthorized — You do not have Just-in-Time (JIT) Admin authorization for this computer. Contact your administrator to configure permissions."

• Confirm that a card in Just-in-Time (JIT) Log In - Authorizations names the technician (Users) or the technician's role (Roles).
• Confirm that the card grants at least one Local Group, or has All checked.
• For a domain-joined computer with Domain Log In Enabled, confirm that the card's Domains include the computer's domain. For any other computer, confirm that the card has no Domains.
• Check whether a more specific level (Company, Location, or Computer) has its own Authorizations setting. The most specific level replaces the others.
• If the authorizations were created with the retired Authorized Roles & Users setting, see Migrated Authorizations.

"Just-in-Time (JIT) Log In is not enabled for this computer."

Enabled is not checked in the Configuration setting that applies to this computer. Check the Global, Company, Location, and Computer level settings.

Lock Screen Message

"JIT Admin cannot currently be used from a lock screen. Please use the Log Out or Switch User functionality." Sign out of the current session, or select Switch User, and start the JIT login from the sign-in screen.

JIT Tile Missing

• Confirm that Enabled is checked for the computer.
• Confirm that the computer is at the Windows sign-in screen, not a lock screen.
• Confirm that no third-party authentication product (such as DUO or WatchGuard AuthPoint) is preventing the credential provider from loading.
• Restart the AutoElevate Agent service or the computer to reset the credential provider.

Related Articles

• JIT Domain Log In
• Offline Technician Mode and Just-in-Time Admin Login
• Technician Mode - 2FA Authentication & Command Tray
• Using DUO with AutoElevate