Altiward checks what happens after admin is granted. It compares recorded grants with the Mac's admin group, removes rights it finds past expiry, and gives your team a fleet view, console revocation and SIEM findings. SAP Privileges continues to handle elevation.
Request early access, or see the console and example events.
We make Altiward. This page shows the enforcement, visibility and evidence Altiward adds to the existing elevation workflow.
What Altiward adds
| Capability | SAP Privileges alone | SAP Privileges + Altiward |
|---|---|---|
| Requesting admin | Grants admin with managed duration, authentication and reason settings | The same Privileges workflow, with Altiward checking the resulting admin rights |
| Expiry enforcement | Revocation timer, configurable revocation rules and optional tamper protection; SAP documents limits to guaranteed removal | Adds a separate agent check against the admin group and removes rights found past their recorded expiry |
| Unexpected admins | Version 2.6.0 can record admin-group changes locally, including the process responsible, with its system extension on macOS 14+ | Checks membership against recorded grants and your permanent-admin list, and sends findings to the console and SIEM |
| Fleet visibility | Local history and configurable remote grant and revocation events | Adds a console showing reported admin rights across enrolled Macs and requests to revoke them |
| Coverage gaps | Grant and revocation events do not by themselves confirm that an agent is still reporting | The Altiward server flags missing agent check-ins so your team can see where checks have stopped |
| SIEM evidence | Can forward grant and revocation events by syslog or webhook | Adds session records and findings for unexpected admins, detected admin-account creation, expiry enforcement and missing check-ins |
| Infrastructure | Privileges and its configuration on each Mac; a receiver if remote logging is enabled | Adds the Altiward agent and a server, database and console on your infrastructure |
Check the rights, not just the timer
A timer and a grant event describe the intended admin window. Altiward's agent also reads the Mac's admin group. If it finds rights still present after the recorded grant expires, it removes them and records enforcement as the reason the session ended.
Privileges has its own revocation settings and optional tamper protection. Keep those configured: Altiward adds another check rather than making the original controls unnecessary. Our expiry guide explains the documented limits and settings.
Bring unexpected admins into view
Altiward checks for admin membership without a recorded grant and outside your list of permanent admins. It also flags an admin account detected during an approved session. Your team can review the finding, request revocation from the console and correlate the session with other security events.
These findings identify something to investigate. An account without a recorded grant is not, by itself, proof of malicious activity.
Keep control of the evidence
Your MDM deploys the Altiward agent and configuration alongside Privileges. You run the Altiward server and console on your infrastructure and choose where to send its session records and findings. See the example session, console and SIEM event.
Sources for Privileges' native behaviour
- SAP, Managing Privileges: managed settings, remote logging and system extension
- SAP, Frequently Asked Questions: revocation limits and local-admin capabilities
- SAP, Privileges 2.6.0 release notes: local history and admin-group change records