I'm looking for an application I can deploy to end users that provides approved, situation-specific fixes. For example, if a VPN client stops working, a user could select the matching fix and have the necessary commands run in the background with elevated privileges when required. Ideally, the tool would avoid giving users administrator rights while still allowing them to resolve occasional issues without contacting IT. Does an existing product support this, or would it need to be custom-built? At the moment, using Intune with packaged scripts, PSADT, or application repair actions seems like the most practical approach.
4 Answers
If the issue is recurring, fixing the underlying cause is usually better than building a workaround tool. That said, hardware limitations or vendor issues can make a permanent fix impractical, so controlled self-service repairs are reasonable as a temporary solution.
If you use Intune, package each approved script as a Win32 application and publish it through Company Portal. The Intune agent can run the fix as SYSTEM, so the user does not need administrator access. PSADT can add prompts or a simple interface when the user needs to provide input.
Another option is to use an endpoint privilege-management product such as Admin By Request, though that may be more focused on approving elevation than presenting a library of ready-made fixes. For a true self-service workflow, the user would ideally select a specific repair rather than manually type commands.
Avoid creating a generic button that runs arbitrary commands as administrator, since that can become a privilege-escalation path. Instead, keep each repair narrowly scoped, signed or otherwise controlled, logged, versioned, and centrally revocable. Intune, Configuration Manager, or an RMM platform can run the actions as SYSTEM. Where possible, build detection and remediation pairs so recurring problems are fixed automatically; for issues that can only be identified when a user reports them, publish the approved repair as an on-demand application or repair action.
That makes sense. Some of these problems cannot be detected until the user actually tries the affected application, and different symptoms can require different repairs. The VPN example is just one case, so Intune may be the best fit for now.