Unable to run admin privileged CMD.EXE even from User belonging to localgroup "Administrators"

Question

Unable to run admin privileged CMD.EXE even from User belonging to localgroup "Administrators".

Steps to reproduce:

1. Open cmd.exe as admin.
2. Add user admin with password admin like so: net user admin admin /add.
3. Next add the user to Administrators localgroup: net localgroup Administrators admin /add.
4. Now the user is added to the Administrators. I try to run the cmd.exe with this user: runas /user:admin cmd.exe. Promts for the password, I enter.
5. The new cmd.exe is started, it is, in fact started from the admin user.
6. Try to mkdir C:\Windows\system32\TESTPRIVILEGE, returns Access denied.

What I've tried:

• Removing the user from the Users localgroup, leaving them only with Administrators.

Why is it not starting as administrator, since the user is clearly a member of Administrators localgroup? How can I start a cmd.exe with this user as administrator without GUI or minimal interaction with it?

Answer 1

The runas command starts a CMD instance under the account of admin. However, Windows runs commands as non-elevated, even for administrators.

For starting any command as elevated from the command-line, see the post How to open an elevated cmd using command line for Windows?

The highest-voted answer in the post was to use the command:

powershell -Command "Start-Process cmd -Verb RunAs"