{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/", "slug": "dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial", "url": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/" }, "title": "Check EPM parent rules before relying on a child-process denial", "summary": "Can an EPM child-process allowance bypass a separate deny rule for the child?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:02+00:00", "modified_at": "2026-09-10T00:52:38+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 232, "potentially_affected": "Use this review when an approved EPM application can start another executable. Identify the actual parent rule and launch chain, not just the rule attached to the child file.", "dse_recommendation": "Review parent elevation and child restrictions together before accepting a deny rule as effective.", "primary_source": { "name": "Creating elevation rules with Endpoint Privilege Management - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/epm/create-elevation-rules", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

In Endpoint Privilege Management, allowing child processes to run elevated skips their rule evaluation, including explicit deny rules. A child can therefore receive elevated access even when a deny rule identifies that file. Microsoft cautions against broad elevation rules for programs that launch other processes. It also warns that changing child-process behavior can affect applications that expect normal Windows inheritance. Microsoft Learn.

\n

Applicability

\n

Use this review when an approved EPM application can start another executable. Identify the actual parent rule and launch chain, not just the rule attached to the child file.

\n

DSE recommendation

\n

Review parent elevation and child restrictions together before accepting a deny rule as effective. Have the application owner enumerate the subprocesses required for the approved task. Ask the policy owner to explain any unrestricted child-elevation setting and reduce it where compatible with that task. Keep exceptions tied to the specific parent and business operation; do not approve a general command shell merely to make one installer work.

\n

Verification

\n

In an isolated test, launch the same harmless child directly and through the approved parent, and inspect its effective privilege and policy result. Include a child intended to be denied. Resolve discrepancies before rollout, then repeat the business task to check compatibility. Preserve the parent rule, child identity, launch path, and observed outcome as one evidence set.

\n

Official references

\n

Microsoft Learn: Creating elevation rules with Endpoint Privilege Management.

", "content_text": "Source facts\nIn Endpoint Privilege Management, allowing child processes to run elevated skips their rule evaluation, including explicit deny rules. A child can therefore receive elevated access even when a deny rule identifies that file. Microsoft cautions against broad elevation rules for programs that launch other processes. It also warns that changing child-process behavior can affect applications that expect normal Windows inheritance. Microsoft Learn.\nApplicability\nUse this review when an approved EPM application can start another executable. Identify the actual parent rule and launch chain, not just the rule attached to the child file.\nDSE recommendation\nReview parent elevation and child restrictions together before accepting a deny rule as effective. Have the application owner enumerate the subprocesses required for the approved task. Ask the policy owner to explain any unrestricted child-elevation setting and reduce it where compatible with that task. Keep exceptions tied to the specific parent and business operation; do not approve a general command shell merely to make one installer work.\nVerification\nIn an isolated test, launch the same harmless child directly and through the approved parent, and inspect its effective privilege and policy result. Include a child intended to be denied. Resolve discrepancies before rollout, then repeat the business task to check compatibility. Preserve the parent rule, child identity, launch path, and observed outcome as one evidence set.\nOfficial references\nMicrosoft Learn: Creating elevation rules with Endpoint Privilege Management.", "content_markdown": "## Source facts\n\nIn Endpoint Privilege Management, allowing child processes to run elevated skips their rule evaluation, including explicit deny rules. A child can therefore receive elevated access even when a deny rule identifies that file. Microsoft cautions against broad elevation rules for programs that launch other processes. It also warns that changing child-process behavior can affect applications that expect normal Windows inheritance. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/epm/create-elevation-rules).\n\n## Applicability\n\nUse this review when an approved EPM application can start another executable. Identify the actual parent rule and launch chain, not just the rule attached to the child file.\n\n## DSE recommendation\n\nReview parent elevation and child restrictions together before accepting a deny rule as effective. Have the application owner enumerate the subprocesses required for the approved task. Ask the policy owner to explain any unrestricted child-elevation setting and reduce it where compatible with that task. Keep exceptions tied to the specific parent and business operation; do not approve a general command shell merely to make one installer work.\n\n## Verification\n\nIn an isolated test, launch the same harmless child directly and through the approved parent, and inspect its effective privilege and policy result. Include a child intended to be denied. Resolve discrepancies before rollout, then repeat the business task to check compatibility. Preserve the parent rule, child identity, launch path, and observed outcome as one evidence set.\n\n## Official references\n\n[Microsoft Learn: Creating elevation rules with Endpoint Privilege Management](https://learn.microsoft.com/en-us/intune/epm/create-elevation-rules)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/", "url": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check EPM parent rules before relying on a child-process denial", "item": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/", "url": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/", "headline": "Check EPM parent rules before relying on a child-process denial", "description": "Can an EPM child-process allowance bypass a separate deny rule for the child?", "abstract": "Can an EPM child-process allowance bypass a separate deny rule for the child?", "articleBody": "Source facts\nIn Endpoint Privilege Management, allowing child processes to run elevated skips their rule evaluation, including explicit deny rules. A child can therefore receive elevated access even when a deny rule identifies that file. Microsoft cautions against broad elevation rules for programs that launch other processes. It also warns that changing child-process behavior can affect applications that expect normal Windows inheritance. Microsoft Learn.\nApplicability\nUse this review when an approved EPM application can start another executable. Identify the actual parent rule and launch chain, not just the rule attached to the child file.\nDSE recommendation\nReview parent elevation and child restrictions together before accepting a deny rule as effective. Have the application owner enumerate the subprocesses required for the approved task. Ask the policy owner to explain any unrestricted child-elevation setting and reduce it where compatible with that task. Keep exceptions tied to the specific parent and business operation; do not approve a general command shell merely to make one installer work.\nVerification\nIn an isolated test, launch the same harmless child directly and through the approved parent, and inspect its effective privilege and policy result. Include a child intended to be denied. Resolve discrepancies before rollout, then repeat the business task to check compatibility. Preserve the parent rule, child identity, launch path, and observed outcome as one evidence set.\nOfficial references\nMicrosoft Learn: Creating elevation rules with Endpoint Privilege Management.", "datePublished": "2026-09-10T00:30:02+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-114-check-epm-parent-rules-before-relying-on-a-child-process-denial/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check EPM parent rules before relying on a child-process denial" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 232, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Creating elevation rules with Endpoint Privilege Management - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/epm/create-elevation-rules" } } ] } }