Validate elevated installer policy and administrative-token context

Needs: AlwaysInstallElevated requires both effective machine/user policy values and permitted MSI execution; UAC routes require their own compatible administrator/token context

Windows commands

REM Baseline
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Both values must be 0x1

REM Both values must be 0x1
msiexec.exe /quiet /qn /i C:\Path\To\PAYLOAD.msi

REM Baseline
whoami /groups
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

Verify → Verify both relevant conditions and actual resulting token; keep UAC-context claims narrower than full privilege escalation.

If it fails → One policy value, blocked MSI execution or an incompatible protected token defeats the assumed route. More detail ↓

If → then

A new Windows session or claimed administrator/SYSTEM transition → Establish Windows token, host and process context
Needs: A functioning command channel and the actual effective token/process context
whoami /priv exposes a relevant token privilege → Select a privilege-backed impersonation or object-control route
Needs: The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context
An existing exploit/delivery primitive needs a binary or raw payload → Generate a payload matching OS, process, format and handler
Needs: Verified target/process architecture, delivery format, callback route, payload constraints and a matching staged/stageless listener

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Validate elevated installer policy and administrative-token context

USE WHEN: Installer policy values or an administrator account with a filtered token
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: A verified installer-policy execution route or a precise token-boundary assessment

Recognize the clue

Inspect both machine/user installer-policy values and the current token before inferring an elevated MSI or UAC-context route.

reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
whoami /all

SYNTHETIC EXAMPLE OUTPUT

HKLM AlwaysInstallElevated REG_DWORD 0x1
HKCU AlwaysInstallElevated: value not found

Means: One policy value is insufficient; the two-policy conjunction is the key recognition condition.

Confirm: For installer execution verify both applicable values and permitted MSI/runtime; assess UAC administrator/token prerequisites separately.

After validation: Both required policies and a compatible permitted installer consumer exist: validate that route's effect.
Ruled out in this context: The required user policy is absent/disabled: reject this elevated-installer method.
Still inconclusive: Policy visibility failure or unknown effective context requires another check.

Troubleshooting: One policy value, blocked MSI execution or an incompatible protected token defeats the assumed route.

Both values must be 0x1:

One key or a zero value disproves the route. This is an unsafe installer policy, not a universal UAC bypass.

A UAC bypass normally elevates an already-administrative filtered token. Build/policy-specific bypasses are not a baseline path for a standard user.

Why it works

Both installer policies must enable the feature. UAC elevation and standard-user-to-administrator escalation have different prerequisites; a token/consent mechanism is not a universal boundary bypass.

Worked example · hypothetical

Observation: only the machine installer value is enabled. Test: check the user policy and actual token. Illustrative output: user policy is absent. Interpretation: the elevated-installer route is not enabled; investigate another privileged consumer.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗