Managing privilege delegation on a server device

A system comprising:

• a server device comprising:
• a processor circuit;
• a memory;
• an operating system;
• and
• a remote management (RM) server comprising:
• a command execution plug-in and cooperating with the operating system;
• an agent service cooperating with the operating system;
• and
• an agent plug-in cooperating with the agent service, wherein the agent plug-in is chained to the command execution plug-in;
• wherein the agent plug-in is arranged to:
• intercept a request, from a RM client, originating from a first user account of a logged-in user on a client device to execute a command, by the RM server, in a second user account on the server device, wherein the first user account and the second user account have different first privileges and second privileges assigned thereto respectively;
• and
• obtain information related to the request and to forward the information to the agent service cooperating with the operating system of the server device;
• wherein the agent service is arranged to:
• determine whether to execute the command in the second user account on the server device according to the second privileges and to associate the second privileges with the command, if it is determined to execute the command in the second user account on the server device according to the second privileges;
• and
• cause, via the agent plug-in chained to the command execution plug-in, the command to be executed according to the second privileges in the second user account by the operating system on the server device and wherein the agent plug-in is arranged to relay the command from the agent service, having the second privileges associated therewith, to the command execution plug-in provided by the operating system in the second user account on the server device;
• and
• a client device comprising:
• a RM client;
• and
• a first user account of a logged-in user, wherein the request is from a RM client, originating from the first user account of the logged-in user on the client device.

A method of managing privilege delegation to control execution of commands on a server device, the method being implemented by hardware of the server device including at least a processor and a memory, the method comprising:

• intercepting, by an agent plug-in provided on the server device, a request, from a remote management (RM) client, originating from a first user account of a logged-in user on a client device to execute a command, by a RM server, in a second user account on the server device, wherein the first user account and the second user account have different first privileges and second privileges assigned thereto respectively;
• obtaining, by the agent plug-in, information related to the request and forwarding the information to an agent service cooperating with an operating system of the server device;
• determining, by the agent service, whether to execute the command in the second user account on the server device according to the second privileges and associating the second privileges with the command, if it is determined to execute the command in the second user account on the server device according to the second privileges;
• and
• causing, by the agent service via the agent plug-in, the command to be executed according to the second privileges in the second user account by the operating system on the server device by relaying, by the agent plug-in, the command, having the second privileges associated therewith, to a command execution plug-in, chained to the agent plug-in, provided by the RM server in the second user account on the server device.

A tangible non-transitory computer-readable storage medium having recorded thereon instructions which, when implemented by hardware of a server device including at least a processor and a memory, control the server device to:

• intercept, by an agent plug-in provided on the server device, a request, from a remote management (RM) client, originating from a first user account of a logged-in user on a client device to execute a command, by a RM server, in a second user account on the server device, wherein the first user account and the second user account have different first privileges and second privileges assigned thereto respectively;
• obtain, by the agent plug-in, information related to the request and forwarding the information to an agent service cooperating with an operating system of the server device;
• determine, by the agent service, whether to execute the command in the second user account on the server device according to the second privileges and associating the second privileges with the command, if it is determined to execute the command in the second user account on the server device according to the second privileges;
• and
• cause, by the agent service via the agent plug-in chained to a command execution plug-in, the command to be executed according to the second privileges in the second user account by the operating system on the server device by relaying, by the agent plug-in, the command, having the second privileges associated therewith, to a command execution plug-in, chained to the agent plug-in, provided by the RM server in the second user account on the server device.