Elevate 1.8.1

Added

• Windows: the MSI can install for all users of a PC. Run it as before and it installs for the
  current user into %LOCALAPPDATA%\Programs\Elevate with no administrator rights. Run it with
  ALLUSERS=1 (msiexec /i Elevate-<version>-x64.msi ALLUSERS=1) and it installs into
  %ProgramFiles%\Elevate instead, with the Start Menu entry for everyone and the CLI on the
  system PATH; that needs an administrator, and is what an Intune deployment in the device
  context wants. Upgrade a per-machine install the same way, with ALLUSERS=1; without it the
  installer stops and says so, where it would otherwise put a second, per-user copy next to it.
  Installing for all users does not remove a copy a user installed for themselves; uninstall that
  one first.
  See docs/enterprise/windows-intune.md. (#205)

Fixed

• Windows: winget upgrade Reothor.Elevate no longer refuses the new version. It answered "A
  newer package version is available in a configured source, but it does not apply to your system
  or requirements": the winget manifest declared the installer as user scope, while Windows
  registers a per-user MSI where winget reads it as machine scope, so winget ruled every installer
  out. The manifest no longer declares a scope. This takes effect with the manifest of the next
  release; to get from 1.7.0 to 1.8.0, run the 1.8.0 MSI from the release page. (#205)

• macOS: expired activations no longer linger after the Mac wakes. When a background refresh
  could not renew a sign-in silently — a browser sign-in account after a long sleep, for example —
  the tenant kept its last-known rows, and activations that had ended meanwhile stayed in Active
  now with a Deactivate that could only fail. Elevate now drops an activation a minute after its
  end time, whether or not the tenant could be read. A tenant waiting for a sign-in to refresh is
  also marked with an orange warning on its header instead of the grey info glyph that plain
  limitations use; press Refresh to sign in.

• Windows: expired activations no longer linger after the PC wakes. As on macOS, a background
  refresh that could not renew a sign-in silently kept the tenant's last-known rows, including
  activations that had ended meanwhile. Elevate now drops an activation a minute after its end
  time, whether or not the tenant could be read. A tenant waiting for a sign-in to refresh is also
  marked with an orange warning on its header instead of the grey info glyph that plain
  limitations use; press Refresh to sign in.

• CLI: elevate watch no longer keeps listing activations that have ended. When a re-read
  failed — a sign-in it could not renew silently, a dropped network — the table kept the last rows
  it had, including activations whose end time had since passed. watch now drops a row as soon as
  its end has passed, whether or not the last read got through.

macOS

Signed with Developer ID and notarized.

Install with Homebrew (the fully qualified cask name is required: this tap is not a homebrew- named repository):

brew tap FrodeHus/elevate https://github.com/FrodeHus/elevate
brew trust frodehus/elevate
brew install --cask frodehus/elevate/elevate

The cask installs the pkg (Homebrew asks for your password), which also puts the elevate CLI on your PATH.

Or download Elevate-1.8.1.dmg below and drag Elevate to Applications. SHA-256: de24c9709374e2333aff862206b227562c1f48e2f6064505f300db8f8839e01a The DMG is the app alone.

Windows

Download the MSI for your architecture below and run it. It installs for the current user (no admin rights) into %LOCALAPPDATA%\Programs\Elevate and needs the .NET 10 runtime: winget install Microsoft.DotNet.Runtime.10.

Code-signed (Certum). SmartScreen can still show "Windows protected your PC" for a new release until the publisher has built reputation; choose More info, then Run anyway.

SHA-256:

• x64: ee11e86f8362e26d4223cf8a996b8ba02ab8371126c83099888ccf9b82f67335
• arm64: d37b45368a613dfd5f5c3f27af16d4c86eac9a9e6db26319786f9132a354d258

CLI (Linux, macOS, Windows)

One self-contained elevate binary per platform, no runtime to install.

macOS (Apple Silicon): the CLI is installed with the app by the Homebrew cask above or by Elevate-1.8.1.pkg, as /usr/local/bin/elevate. The elevate-cli formula is deprecated and will be removed in a later release; it still installs on Linux and Intel Macs:

brew install frodehus/elevate/elevate-cli

Windows: Elevate-1.8.1-x64.msi (or -arm64.msi) installs elevate.exe in a cli folder under the app and adds that folder to your PATH. Standalone: winget install Reothor.Elevate.CLI (the manifest goes to winget-pkgs with each release and is published once Microsoft's checks pass, usually within a day or two), or download elevate-cli-1.8.1-win-x64.zip (or -win-arm64.zip) below and put elevate.exe on your PATH.

Or download the archive for your platform below and unpack it anywhere on your PATH. Verify with sha256sum -c elevate-cli-1.8.1-checksums.txt. See cli/README.md.

elevate-audit

The read-only companion that lists standing privileged access to move to PIM is versioned and released on its own, under the audit-v tags: brew install frodehus/elevate/elevate-audit, winget install Reothor.Elevate.Audit, or the archives of the latest audit release. See docs/audit.md.

Enterprise

Elevate-1.8.1.pkg is a macOS installer package, and installs the elevate CLI (/usr/local/bin/elevate, Apple Silicon), signed with Developer ID Installer and notarized, for Jamf, Intune and sudo installer -pkg Elevate-1.8.1.pkg -target /. SHA-256: 3f826a0d0a4c4865a5655df7e01966909c4f0fff8384466a356a889790d79d7e

Elevate-enterprise-kit-1.8.1.zip holds the managed configuration templates: the Elevate.admx/Elevate.adml policy definitions and a .reg file for Windows, a mobileconfig, an Intune preference file and a Jamf manifest for macOS, a managed.json template for the CLI, the worked example and keys.md, the key reference. SHA-256: 323281041be5736dc15b1be373f73fd4e24aa7a514e70dce8c257ab6f5893d28

Deploying Elevate to a fleet starts at docs/enterprise/README.md.