Files installed by Admin By Request

Overview

Admin By Request (ABR) installs a set of core application and support files across several system folders during deployment. These files perform critical functions related to privilege elevation, system monitoring, support sessions, remote access and update management.

To maintain the integrity of its operations and prevent tampering, ABR deliberately assigns non-obvious or neutral filenames to some of its binaries. This is a deliberate anti-tamper strategy and is not indicative of malicious behavior.

Purpose

This document outlines the files installed by ABR on endpoints running different operating systems. It is intended to assist IT administrators, security teams, and support personnel in understanding the program footprint, as well as ensuring compatibility with other programs and applications, such as antivirus, endpoint detection and response (EDR), and application control systems.

Certain folder and file names in the table that follows are intentionally ambiguous and may vary by architecture or version.

Windows File Locations and Installed Components

Versions 8.4 and 8.5

Version 8.6

C:\Program Files (x86)\FastTrack Software\Admin By Request

This is the primary installation folder. It includes the core binaries:

  • AdminByRequest.exe

  • MessageBus.exe

  • Shell.exe

  • ShellHandler32.exe

  • ShellHandler64.exe

  • Switchback.exe

  • ProcMon.sys

C:\Program Files (x86)\FastTrack Software\Admin By Request

This is the primary installation folder. It includes the core binaries:

  • AdminByRequest.exe

  • BrowserExtension.exe

  • MessageBus.exe

  • Shell.exe

  • ShellHandler32.exe

  • ShellHandler64.exe

  • Switchback.exe

  • ProcMon.sys

C:\Program Files (x86)\Common Files\VAudio

This folder contains supporting binaries:

  • Audckq32.exe

  • Interop.exe

  • Loader.exe

  • Wafbsr32.exe

  • VAudio.sys

C:\Program Files (x86)\Common Files\VAudio

This folder contains supporting binaries:

  • Audckq32.exe

  • Interop.exe

  • Wafbsr32.exe

  • VAudio.sys

C:\ProgramData\FastTrack Software\Admin By Request

  • SwitchBack.exe

C:\ProgramData\FastTrack Software\Admin By Request

  • SwitchBack.exe

C:\ProgramData\FastTrack Software\Admin By Request\Auto Updater

  • AutoUpdater.exe

  • AutoUpdaterTask.exe

C:\ProgramData\FastTrack Software\Admin By Request\Auto Updater

  • AutoUpdater.exe

  • AutoUpdaterTask.exe

Mac File Locations and Installed Components

Version 5.1

/Applications

This is the primary installation folder and includes the core binary:

  • Admin By Request.app

/Library/adminbyrequest

This folder contains supporting binaries:

  • abrnotifier

  • abrremote

  • adminbyrequest

  • cloudupdate

  • uninstall

/Library/Application Support/Admin By Request

  • adminbyrequest.policy

/Library/LaunchDaemons

  • AbrAuth.bundle

/Library/PrivilegedHelperTools

Part of the System Extension to interact with Add Helper:

  • statmon

/Library/Security/SecurityAgentPlugins

  • com.fasttracksoftware.admbyreq.plist

  • com.fasttracksoftware.adminbyrequest.notifier.plist

  • com.fasttracksoftware.updater.plist

/Library/SystemExtensions/[folder identifier]

Where [folder identifier] is a 32 character alphanumeric sequence:

  • com.fasttracksoftware.adminbyrequest.extension.systemextension

/var/adminbyrequest

  • all files and sub-folders

/var/log

  • adminbyrequest_sext.log

  • adminbyrequest.log

/var/db

A contribution is made to auth.db:

  • auth.db

Whitelisting Recommendation

To ensure Admin By Request functions correctly in environments protected by antivirus, endpoint protection platforms, or application whitelisting solutions, all of the files listed above should be explicitly whitelisted.

Failure to allow these files may result in:

  • Broken elevation workflows

  • Failed update cycles

  • Incomplete support assist sessions

  • Logging or monitoring issues

If your organization uses an EDR or Application Control tool (e.g., Microsoft Defender Application Control, CrowdStrike, SentinelOne, etc.), ensure rules or policies permit execution of all ABR-related binaries and drivers.

Additional Notes

The installed filenames and folder/directory structure may be updated in future versions.

If you use custom deployment scripts or software inventory tools, you may include checks for the above files to verify installation success.

For assistance in configuring endpoint protection tools or validating integrity, please contact ABR Support.