The environment variables shown by the SET command can be notably different depending on the privilege level of the command prompt session. Moreover, it seems that any program run with administrative credentials by the same user can create environment variables that will persist long after that process ends, and will be set in any subsequent elevated process launched by that user (and ONLY in those elevated processes). I have not been able to find those variables in the Environment tab shown by Process Explorer for any process associated with the user login session. My Question is: where are those values stored, and why is Process Explorer unable to access them (of course, since Process Explorer runs elevated by default those variables appear in its own Environment tab)? Or did I just overlook them?
I think the output of
If you are already a member of the administrator group, then the output of SET is the same in both cases for me.
Therefore, if my hypothesis is true, the elevated privilege variables are defined as User Variables for Administrator.
Like all processes, it gets its environment from the process that spawned the command-prompt instance.
When a process spawns another process, the child process inherits the parent’s environment. If the parent was privileged, then it probably has more/different variables than if it isn’t. When it spawns a child process, the child gets the same set to start with.
Because when Explorer doesn’t actually spawn privileged processes, the CSRSS does. When you run a program “as admin”, you get a UAC prompt which dims the screen. This is because the CSRSS is a system process which handles UAC prompts and process-elevation. So while Explorer and its child processes have one environment, an elevated command-prompt (which is spawned by the high-privilege system process at the behest of Explorer) gets a slightly different set with some extra/different variables.
Because any changes you make with
The session variables are stored in that specific command-prompt’s environment. Process Explorer can see them for that specific instance of
If you use a program like
Be aware that if you manually modify the environment through the registry, only new processes will pick up the changes. To get existing process to see the changes, you have to either restart them or broadcast a