Launch elevated processes from the command line

Every now and then you need to run an elevated command from the command line. If the application always requires elevation (i.e. the binary has been marked as requireAdministrator), the UAC prompt shows up — but in the case the application supports both non-elevated and elevated usage and you explicitly want it to run elevated, there is little support for you.

I would have expected start.com to have been augmented by something like a /elevate-switch, but unfortunately, this is not the case and you are left with having to open a new elevated command prompt to continue.

Fortunately, a tool to fill in this gap is straightforward and indeed J. Robbins has already created one. However, the tool is written in C# — it might be old-fashioned, but I still prefer those little tools to be unmanaged and free of the .Net-overhead. I thus created elevate.exe, which provides the same features as John’s tool but is written in C. In fact, it accepts exactly the same command line parameters, which are:

Execute a process on the command line with elevated rights on Vista

Usage: Elevate [-?|-wait|-k] prog [args]
-?    - Shows this help
-wait - Waits until prog terminates
-k    - Starts the the %COMSPEC% environment variable value and
                executes prog in it (CMD.EXE, 4NT.EXE, etc.)
prog  - The program to execute
args  - Optional command line arguments to prog

Examples:

elevate ipconfig -registerdns
elevate -wait procexp
elevate -k dir

Having this tool at hand, it is now easy to also extend the shell context menu for directories by an 'Open Elevated Console here' entry by adding the following registry entries:

[HKEY_CLASSES_ROOT\Directory\shell\Open Elevated Console here]
@="Open Ele&vated Console here"

[HKEY_CLASSES_ROOT\Directory\shell\
           Open Elevated Console here\command]
@="c:\\path\\to\\elevate.exe 
          /K \"title %1 && color 1a && cd /D %1\""

Download source code, x86 and x64 binary.

Update: You may use the source code under the terms of the MIT License.

About these ads

32 Responses to “Launch elevated processes from the command line”


  1. 1 Idetrorce December 16, 2007 at 1:08 am

    very interesting, but I don’t agree with you
    Idetrorce

  2. 2 Martin March 12, 2009 at 7:47 am

    Any chance to combine this with RunAs?

    Here’s what I have in mind:
    I have two accounts, one for normal office work, another one for domain admin work.
    I log on to my workstation with the non-priviledged account and want be able to open admin tools with the other account.
    But these tools (AD Users and Computers etc.) require elevation.

    Up to now I found no way to combine Elevate and RunAs so that I have to provide credentials only one time.

  3. 3 jpassing March 12, 2009 at 8:31 am

    What does the command you are using look like? Assuming that the domain account you are using for admin work uses UAC in admin approval mode, I’d expect runas /u:domain\account “elevate xyz.msc” to work fine…

  4. 4 Martin March 12, 2009 at 8:51 am

    I tried
    runas /u:domain\account “elevate dsa.msc”
    or
    runas /u:domain\account “elevate /k \”title something\””
    but I always have to enter the credentials two times:
    first for the runas (ok, only the password), then another time for the elevate cmd.
    Somehow I expected after doing the runas it should be clear that elevate runs under the other account. Then Vista should only ask for approval.

  5. 5 jpassing March 12, 2009 at 9:33 am

    Is it really the same account that you are using for both, runas and the UAC OTS dialog?

    If you perform a regular logon (i.e. no runas but logoff and logon again) on your machine using your admin-domain account and then launch MMC — do you get a UAC consent dialog or an OTS prompt? If the latter is the case (i.e. you have to enter credentials), then the account probably has no local admin rights and the behavior regarding runas/elevate would make sense.

  6. 6 Eduardo Beeche June 11, 2009 at 11:15 pm

    Thank you very much for such a useful utility. Thanks also for releasing the source code.

  7. 7 Jörg Heßdörfer September 24, 2010 at 3:53 pm

    While this utility looks like exactly the thing I need, I cannot download it, because our firewall blocks the ZIP file because there seems to be a virus SPR/Tool.SIB in it. Can you re-check this and upload it again? (Or mail it to me so I can check it again). Thanks!

    • 8 Jörg Heßdörfer September 24, 2010 at 4:13 pm

      Oh well, never mind. I asked our sysadmin, and he got it for me and checked it. Seems like a false alert from our firewall.
      Anyways, would it be okay to re-distribute the tool bundled with a hardware product?

  8. 9 hexaae October 13, 2010 at 10:53 am

    Exactly what I need.
    I love it’s a compact EXE written in C instead of vbs, cmd, .NET stuff.
    Thank you!

  9. 10 snafu January 11, 2011 at 7:21 am

    This is great. Two questions: How is it licensed and is it possible to suppress the new command prompt when Elevate is used from within an existing command prompt?

  10. 11 jpassing January 12, 2011 at 10:00 am

    Consider it licensed under the MIT license — feel free to change the source or to redistribute the binary.

    Concerning your other question — this is the default behaviour of ShellExecute when the runas verb is used. I am not aware of any way to override this behavior.

  11. 12 Marc January 22, 2011 at 4:11 am

    great tool
    I used it with runasspc from robotronic.de to call explorer.exe or cmd.exe under another user account with elevated rights
    But since some time symantec detect
    elevate.exe as Trojan.Gen

  12. 13 Jack February 3, 2011 at 1:13 pm

    Awesome! Going to use it for starting Tomcat in that freaking program files folder. I had a solution involving VBS (which seems to work on most modern Windows OS) but this is a lot cleaner. Thanks!

  13. 14 xtrqt March 31, 2011 at 3:53 pm

    It look like it have a problem with running scripts (these from %PATHEXT%). Like python ones. Otherwise it could be perfect windows gksudo replacement. Considering it is MIT licence I will try to implement that.

  14. 15 Stian Soiland-Reyes April 26, 2011 at 7:38 pm

    Brilliant tool!

    I just have one question.. I’m trying to use this with Console2 to be able to open an elevated Powershell, but ‘elevate powershell’ pops up in a separate window instead appearing inside Console2 (as when I run simply ‘powershell’.

  15. 16 Roy Ganor May 20, 2011 at 7:54 pm

    And to make this tool even more user friendly you can use this script which helps to dispatch the right executor:

    @echo off
    if "%PROCESSOR_ARCHITECTURE%" == "x86" (
    	@start x86-elevate.exe %*
    ) else (
        if "%PROCESSOR_ARCHITECTURE%" == "AMD64" (
    		@start x64-elevate.exe %*
        ) else (
            echo Unsupported platform.
            @pause
        )
    )
    
    • 17 Roy Ganor May 27, 2011 at 9:31 pm

      ok, maybe this version is better for other usages:

      @echo off
      if "%PROCESSOR_ARCHITECTURE%" == "x86" (
        %~d0%~p0..\lib\x86\elevate.exe -wait -k "CD %CD% & %* > out & exit" & type out
      ) else (
        if "%PROCESSOR_ARCHITECTURE%" == "AMD64" (
          %~d0%~p0..\lib\x86_64\elevate.exe -wait -k "CD %CD% & %* > out & exit" & type out
        ) else (
          echo Unsupported platform.
          @pause
        )
      )
      
  16. 18 Dirk Schoeters July 25, 2011 at 6:36 am

    It seems that the file can ‘t be downloaded anymore. Is there someone who can send it to me?

  17. 19 jpassing July 25, 2011 at 7:41 am

    The download should work again, thanks for telling.

  18. 20 Alex August 7, 2011 at 12:52 pm

    Hi, thank you for a usefull utility.
    I am trying to add some CMD to start up to run at log in and restart the Explorer elevated (taskkill + elevate), but it doest works every time. Is there a way to elevate explorer at log in?

  19. 21 herpderp October 20, 2011 at 9:55 am

    Thanks a lot for the tool; please note though that this application (by design) does not work on XP and earlier, which is really an unnecessary restriction. I had to change the code to just fallback to “open” instead of “runas” in XP. Works beautifully and we don’t have to abandon XP support.

  20. 22 bogdan October 25, 2011 at 9:22 pm

    Useful tool, thanks.

  21. 23 John L. Galt December 8, 2011 at 2:46 am

    Awesome tool – thanks again for writing this in C.

  22. 24 Sam December 15, 2011 at 10:21 am

    I’m trying to launch assoc .vlan=”file type description” with your x64 elevate command, however, when I execute

    elevate assoc .vlan=”file type description”, I get the following message,

    assoc .vlan=”file type description” could not be launched!

    Please tell me why this is happening please!

  23. 25 Johny January 17, 2012 at 11:52 am

    Hi Johannes,

    Thank you for such a nice utility. I am using your program to launch jar files under admin access, something like:
    <<>> it works fine, however there is one thing that i would like to know. Is there any possibility to know if the user rejected the UAC prompt. Like if users said no, the file will not execute, but is there something that is returned by Elevate.exe that can inform if access was approved or denied?

  24. 26 Johny January 17, 2012 at 11:54 am

    Ah sorry, i got it, it returns: cmd could not be launched: 1223
    thank you this is perfect

  25. 27 Jimi April 16, 2012 at 1:52 pm

    I am trying to use this with certutil.exe (builtin windows command) to import certificates on the computer account.
    But it seems to work but it dont add any certificates.
    If I use the through windows elevated command line prompt, it works but not with the elevated command.
    Tried both 32 and 64 bits.

    What could be the issue?

  26. 29 d@n June 23, 2012 at 1:41 am

    Hi,
    I like your tool, but I have questions:
    * What is the ‘Elevate.pdb’ file?
    * is it safe delete it?
    * what happens if I execute the application in a previous version of Windows Vista?

    Thanks!

  27. 30 Johny August 17, 2012 at 5:19 pm

    @Jimi add your certutil command in a batch file, and load the batch file using this Elevate.exe, it will work


  1. 1 UAC в Windows 7 « Блог Дениса Колисниченко Trackback on July 6, 2012 at 6:40 am
  2. 2 Building WebKit with VS2012 » the Void Trackback on September 4, 2012 at 1:50 pm
Comments are currently closed.



Categories

Try Visual Assert, the unit testing add-in for Visual Studio (R)


NTrace: Function Boundary Tracing for Windows on IA-32

About me

Johannes Passing, M.Sc., living in Berlin, Germany.

Besides his consulting work, Johannes mainly focusses on Win32, COM, and NT kernel mode development, along with Java and .Net. He also is the author of cfix, a C/C++ unit testing framework for Win32 and NT kernel mode, Visual Assert, a Visual Studio Unit Testing-AddIn, and NTrace, a dynamic function boundary tracing toolkit for Windows NT/x86 kernel/user mode code.

Contact Johannes: jpassing (at) acm org

Johannes' GPG fingerprint is BBB1 1769 B82D CD07 D90A 57E8 9FE1 D441 F7A0 1BB1.

LinkedIn LinkedIn Profile
Xing Xing Profile
Twitter Follow me on Twitter (new)

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: