This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 37%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN1%3C/text%3E%3C/svg%3E)
As part of a new company policy, we need to disable Admin rights on all users/laptops in order to obtain the Cyber Essentials Plus certification. However, the development team need access to the Visual Studio Debugger
Visual Studio Debugger needs Admin rights.
How can we get this to work together? Is there a way to have Cyber Essentials Plus (and therefor no admin rights) as well as have Debugger work accurately/correctly.
A family of Microsoft suites of integrated development tools for building applications for Windows, the web, mobile devices and many other platforms. Miscellaneous topics that do not fit into specific categories.
The VS debugger would only need to run as Administrator when debugging processes that are running in a security context other than that of the logged-on user. So any VS user should be able to debug their own work as long as they are not attempting privileged operations.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 82%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMC%3C/text%3E%3C/svg%3E)
Or just turn off Firewall on window os, it will not ask anymore.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 78%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETS%3C/text%3E%3C/svg%3E)
Hello @newtmimsy-1498,
Welcome to Microsoft Q&A forum.
Whether the admin rights are needed depends on what you are going to debug and how you debug. In following situations, if you don't assign corresponding rights to VS debugger, it won't work.
See this document: User permissions and Visual Studio
You need administrator permissions to complete the following tasks:
Kind Regards,
Tianyu
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Thank you. We do use the debugger for Browser applications and Web Applications. This is where we would need the Administrator elevated permission set. But if we go through the Cyber Essentials Plus certification correctly, we need to remove Administrator permissions from the user.
I am trying to work out the best way to be able to get the certification, required for a project we have with a client, but I can't stop or hider what our development team need to do their job. Such a conundrum.
@newtmimsy-1498 Are you certain that the prohibition is absolute? Wouldn't the access control requirements be met if Administrative rights were granted to only those users that require them, removed when no longer needed and Administrative actions were logged and audited using Windows built-in security mechanisms?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 32%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
The VS debugger does not need admin rights and hasn't for a very long time. There used to be a "Debugging" group that you could put users into. That group isn't created anymore but at least based upon the docs here it seems like it still works. But maybe just put your devs into the Power Users group and that is likely sufficient.
Note that it depends on the type of apps you're building but some things may require admin privileges and therefore such a restrictive policy may be an issue. For example, registering an assembly in the GAC so it can be called by SSIS requires admin privileges. Debugging a windows driver would also likely need admin privileges. If you are building a web app and using IIS Express then you would need to change it's permissions to not require running as admin. There are other cases as well. If you are using full IIS then you must run as admin.
The company policy should ideally allow elevation (aka UAC) when these situations occur.
Thank you. We do use the debugger for Browser applications and Web Applications with ISS. This is where we would need the Administrator elevated permission set. Are you saying that by putting them into this 'power users group' it would be enough?
Will it still enable us to pass the Cyber Essentials Plus certification correctly? I am trying to work out the best way to be able to get the certification (required for a project we have with a client) but I can't stop or hider what our development team need to do their job.
IIS requires you to have admin privileges. After all it is a service and you wouldn't want just anyone being able to change it. That would be a larger security hole then preventing admin privileges.
Is there any reason why you must have your devs debug against IIS? IIS Express has almost all the same features and is designed to allow development against "IIS" without running IIS. It doesn't require admin privileges either which is the whole point. I would recommend you have your dev team just use IISX instead. It is just a change to the debug options they use and is the default for web development anyway.