Windows Client - Install / Uninstall

Prerequisites

Admin By Request runs on the following hardware architectures:

• x86 32-bit and 64-bit

• ARM

Admin By Request supports all current Windows versions, including:

• Windows 11

• Windows 10

• Windows Server (with Desktop Experience only)

Administrator access:

• If installing individually on client endpoints, you will need administrator privileges on every workstation that executes the installation client.

• If installing via Intune, you need to be able to create Intune packages.

• You'll also need valid credentials to access your Admin By Request online portal at Admin By Request Portal.

There are additional prerequisites when working with the following:

• Admin By Request for Windows 8.4+ and Secure Remote Access - refer to Unattended Access Prerequisites and Remote Support Prerequisites.

• Break Glass accounts - refer to Break Glass Prerequisites.

Support for Windows 7 computers

Admin By Request version 7.4 is the last version to officially support Windows 7 (Pro and Enterprise only). If you need to use this version, login to the portal and visit our Download Archive.

While newer versions of Admin By Request might function on the Windows 7 operating system, they are not tested for compatibility, so we cannot guarantee stability.

See also the Windows FAQ.

Your Tenant License

The installer file downloaded from the portal is unique to your tenant. Depending on the target operating system, it can be an executable file, a package or a script and it is signed with a license that applies only  to installers downloaded from the tenant in which you are currently logged-in. The same license file is applied to each of the operating system client installers: Windows, macOS, Linux and Server.

This is true for free plans as well as paid plans.

When installed on an endpoint, once the endpoint connects successfully, you will see in real time the status of the endpoint in your Inventory, which is also unique to your tenant. You will not see any endpoints installed with files downloaded from other tenants - this is simply not possible.

Installing Admin By Request

1. Installing a single endpoint

   The following installation procedure is in two parts: the first outlines downloading and installing the Admin By Request installation file, and the second part describes how to test that installation was successful.

   1. Download and install the Admin By Request Windows client.

      1. If you haven't already, login to the Admin By Request portal.

      2. In the portal, click the Download menu link to download the Windows endpoint client and store the .msi file in a suitable location:
         

         

      3. Double-click the .msi file to start the installation and click Install when prompted.

         You might be prompted for administrator credentials, depending on the endpoint's UAC configuration.

      When the installation completes, the Admin By Request icon appears in the system tray in the bottom right corner of the screen. The icon is red if you are logged-on as an Administrator and green if you are logged-on as a Standard User. Refer to The Windows Client User Interface for a description of the differences.

      4. Click the icon to show details about the client or to start an Admin Session:

         

         Depending on installation preferences, Admin By Request shortcut icons may also be placed on the desktop:

         

      Installation is now complete.

   2. Test the installation

      Testing the installation involves a quick connection check:

      1. On an endpoint with Admin By Request installed, launch the application by selecting it from the system tray and clicking About Admin By Request:

         

      2. Select Connectivity and check that Operational Status and Cloud Connectivity are OK:

         

      As a further test, you might also want to check the inventory in the portal, to review the details that are now being logged for this endpoint:

      1. From the portal top menu, select Inventory.

      2. Locate the endpoint and click either the computer name link or the Details link:

         

   
   

2. Multiple endpoints - using msiexec

   To install unattended via a simple script, use standard msiexec.exe switches (/I and /QN):

   Copy

    msiexec.exe /I AdminByRequest.msi /QN

   As part of the overall installation process, pick several endpoints at random and test that installation was successful (see Test the installation).

   
   

3. Multiple endpoints - via Intune package

   This guide outlines the full process for deploying Admin By Request Workstation via Microsoft Intune using the Win32 app packaging method.

   Prerequisites

   • Devices must be Azure AD joined and Intune MDM-enrolled

   • Devices must be assigned to an AD group. The example below uses group ABR Installation Dep ("Dep" for deployment).

   • Users must be assigned an Intune-enabled license (e.g. EMS E3)

   • The Administrator must have permissions to create Win32 apps in Intune

   • The ABR MSI installer must be downloaded from the Admin By Request portal and must match your tenant

     Identify the exact version of this installer by right-clicking and selecting Properties, then selecting the Details tab. The version is given in the Comments field (e.g. 8.5.1.0).

   Procedure

   1. Download and Convert the ABR Installer

      1. If you haven't already, login to your ABR portal and download the latest ABR MSI installer file for Windows Workstation Endpoints.

      2. Create a local folder (e.g. C:\ABRInstall) and copy or move the downloaded MSI file there.

      3. Download the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) and place it in the same folder.

      4. From the folder, open PowerShell as Administrator and run the following (assuming folder is C:\ABRInstall and downloaded MSI file is Admin By Request 8.5 Workstation.msi):

         Copy

         .\IntuneWinAppUtil.exe -c "C:\ABRInstall" -s "Admin By Request 8.5 Workstation.msi" -o "C:\ABRInstall"

         If successful, this generates a file named Admin By Request 8.5 Workstation.intunewin in the same folder.

         Common issues:

         • Make sure you are running PowerShell as Administrator.

         • Make sure the command is entered as one line in PowerShell.

         • If you get an error message "The folder you specified cannot be accessed", make sure the -c parameter in the command points to the folder and not the MSI file.

   2. Add the App in Intune

      1. Login to your Intune Admin Center and go to Apps > Windows and click Add.

      2. Select Windows app (Win32) and upload your new .intunewin file (in this example, Admin By Request 8.5 Workstation.intunewin).

      3. Add the details required in the following tabs:

         
         
         • App Information
         • Program
         • Requirements
         • Detection rules
         • Dependencies
         • Supercedence
         • Assignments
         • Review
         
         
         
         
         

         

         • Name: Admin By Request Workstation

         • Description: Admin By Request Workstation

         • Publisher: Admin By Request

         • App Version: 8.5.1.0 (must match version identified from Prerequisites)

         Leave other fields as is.

         
         
         
         

         

         • Install command: msiexec /i "Admin By Request 8.5 Workstation.msi" /qn

         • Uninstall command: msiexec /x "{ProductCode}" /qn

         • Install behavior: System

         • Restart command: App install may force restart

         To get the ProductCode and other properties for your MSI installation file, start a PowerShell session and run the following script:

         Copy

         1
         2
         3
         4
         5
         6
         7
         8
         9
         10
         11
         12
         13
         14
         15
         16
         $msiPath = "[Path_To_File]\Admin By Request 8.5 Workstation.msi"
         
         $properties = @("ProductCode", "ProductName", "ProductVersion", "Manufacturer", "UpgradeCode")
         $installer = New-Object -ComObject WindowsInstaller.Installer
         $database = $installer.GetType().InvokeMember("OpenDatabase", "InvokeMethod", $null, $installer, @($msiPath, 0))
         
         foreach ($prop in $properties) {
             $view = $database.OpenView("SELECT Value FROM Property WHERE Property = '$prop'")
             $view.Execute()
             $record = $view.Fetch()
             if ($record) {
                 "{0} = {1}" -f $prop, $record.StringData(1)
             } else {
                 "{0} = (not found)" -f $prop
             }
         }

         If Admin By Request is already installed on the endpoint, you can run a simpler command (where ProductCode is returned in MSIProductId):

         Copy

         Get-ItemProperty -Path 'HKLM:\SOFTWARE\FastTrack Software\Admin By Request' -Name MSIProductId

         
         
         
         

         

         • Operating System Architecture: x64

         • Minimum OS: Windows 10 1607

         
         
         
         

         

         • Rules format: Manually configure detection rules

         • Rule type: MSI

         • MSI Product Code: {ProductCode}

         
         
         
         

         

         Leave empty. Information is required only if ABR depends on another Win32 app.

         
         
         
         

         

         Leave empty.

         
         
         
         

         

         In the Required section, click + Add group to assign the app to the appropriate device group.

         In this example, the app is assigned to group ABR Installation Dep.

         You can also add the group under section Available for enrolled devices if manual install via Company Portal is preferred.

         
         
         
         

         

         Review all selections and choices, then click Create.

         
         
         
         
   3. Monitor Deployment

      1. In the Microsoft Intune Admin Center, go to Devices > [Device Name] > Managed Apps.

      2. Check the Status of devices (should indicate Installed):

         

      3. On an installed endpoint, confirm the following:

         • Folder C:\Program Files (x86)\FastTrack Software\Admin By Request exists

         • In Task Manager, AdminByRequest.exe is running

         • Logs in Event Viewer > Application (MSI Installer) show expected entries for successful installation

         The Intune Client Apps Overview may not instantly reflect install status - use device-level status for reliable results.

   Outcome

   Admin By Request is successfully deployed across all targeted devices silently via Microsoft Intune. No end-user interaction is required.

Upgrading Admin By Request

As the installer is a standard MSI file, upgrading is automatically detected.

If you deploy a newer version of the Admin By Request Windows client, msiexec.exe will automatically perform an uninstall of the old version and an install of the new version.

Deploying new releases

Admin By Request software updates are deployed using our Auto-Update process. However, when we release a new version we do not deploy it right away to all customers via auto-update. This is simply to mitigate any unforeseen issues.

Our rule-of-thumb for a new release is to activate auto-update within 4 - 8 weeks of release, but this is subject to change, depending on feedback and any potential issues that might arise.

Contact us if you wish to receive the latest version right now. You can also raise a support ticket requesting the latest update.

Visit the Download Archive for previous versions of Admin By Request.

For more information

Refer to Synchronizing Clients with the Portal for a description of how endpoint clients communicate with the portal inventory.

Refer to Release Notes (Windows) for details on what is covered in each new release.

Uninstalling Admin By Request

There are several uninstallation methods described in this section, for both single endpoints (i.e. attended, one at a time) and multiple endpoints (unattended, scripted). These methods are not sequential - pick one or more, depending on requirements.

Single endpoint uninstall

1. Using a PIN Code

   The first few steps in this procedure require access to the portal.

   1. In the Admin By Request portal, navigate to the Inventory  page and identify the device on which to perform the uninstall.

   2. Locate the device in the inventory list - in the PIN column, click PIN for that device (columns can be switched around - the PIN column in your portal might not be the right-most column):

      

   3. Click tab UNINSTALL PIN and then click button Generate PIN:

      

      Note that clicking UNINSTALL PIN also displays a list of previous uninstall events on this computer (below the Uninstall Pin Code  window):

   4. Copy the PIN.

   5. Back on the device on which you want to uninstall Admin By Request, go to the About  panel (i.e. select the Admin By Request icon from the system tray and click About Admin By Request).

   6. Select System, enter the Uninstall PIN generated above into the PIN Code  field and click Uninstall:

      

2. Via the msi installation file

   The client installer is a standard msi file. Simply right-click the msi file, select Uninstall and all components will be removed:

   1. Log in as an Administrator.

   2. Right-click the msi installation file and select Uninstall:

      

   NOTE

   At the time of writing, the confirmation windows that pop-up refer to installing Admin By Request rather than uninstalling it. Provided Uninstall was selected at step 2, the program will indeed be uninstalled.

Multiple endpoints uninstall

Any one of the following commands when used in a script might work more reliably than the others, depending on device management software, endpoint configuration and other installed applications. Generally, the third method (using PowerShell) is the most reliable and should work if the others do not.

1. Using msiexec

   To remove unattended, use standard msiexec.exe switches (/X and /QN):

   Copy

    msiexec.exe /X AdminByRequest.msi /QN

2. Using PsExec

   • Uninstall via Path:

     Copy

     psexec -s -e -h -u DOMAIN\user -p password \\REMOTECOMPUTERNAME msiexec /x "\\path\to\ABR\MSI\Admin By Request x.x.x (xxxxx) Workstation.msi (file://path/to/ABR/MSI/Admin%20By%20Request%20x.x.x%20(xxxxx)%20Workstation.msi)" /qn

   • Uninstall via MSI-code:

     Copy

     psexec -s -e -h -u DOMAIN\user -p password \\REMOTECOMPUTERNAME msiexec /x {MSI-PRODUCT-CODE} /passive

   • Uninstall via Endpoint Name:

     Copy

     psexec -s -e -h -u DOMAIN\user -p password \\REMOTECOMPUTERNAME wmic product where "name like 'admin by request%%'" call uninstall

3. Using PowerShell

   Copy

   powershell.exe -command "Get-Package -Name 'Admin By Request Workstation' | Uninstall-Package -AllVersions -Force"

   NOTE

   • Microsoft has deprecated wmic, which is the PowerShell interface command to WMI. Although wmic still works (at the time of writing), we recommend the PowerShell command for uninstalling Admin By Request.

   • If you have ABR installed on servers, replace Workstation with Server.

4. Using Intune

   To remove unattended, use standard msiexec.exe switches (/X and /QN):

   Copy

    msiexec.exe /X AdminByRequest.msi /QN

User rights after installation

When a user logs on, the account is downgraded from Administrator to Standard User unless:

• You have turned off Revoke Admins Rights in the portal settings (EPM > Settings > Windows Settings > Lockdown > ADMIN RIGHTS).

• Also under Revoke Admins Rights, the user is in the list of Excluded accounts.

• The computer is domain-joined and the user is a domain administrator.

Tamper Prevention

When a user initiates an administrator session, the user’s role is not actually changed from user to admin. The user is granted all administrator rights, except the right to add, modify or delete user accounts. Therefore, there is no case where the user can create a new account or change their own role and become a permanent administrator.

The user also cannot uninstall Admin By Request, as the only program, to keep the administrator session open forever. Furthermore, all settings, configuration and program files are monitored during administrator sessions. If the user tries to remove or change any of the Admin By Request files, these are restored straight away and the attempted activity is logged.

Performance after Installation

When users are not using Admin By Request, it does not consume resources, except for a brief daily inventory and settings check.