63

On *nix systems, you can get a root shell like so:

$ su # or 'sudo -s'
#

The root shell is spawned in place within the same terminal.

I'm trying to find something that does a similar, in-place elevation on the Windows Command Prompt. In other words, it should not spawn a new window or display UAC prompts. So far I've been able to make a scheduled task that bypasses UAC, but the elevated Command Prompt window is not spawned in place.

Is there a similar command for Windows that does an in-place elevation without spawning a new window?

8
  • 33
    note that su/sudo -s actually also starts a new shell process. It's just the elevated processes are connected to the same terminal, so they appear as if it's elevated in-place.
    – Lie Ryan
    Apr 17, 2017 at 11:17
  • 1
    "it should not spawn a new window or display UAC prompts" Are you just saying it should not require graphical interaction? Or do you not want to be prompted at all? For example, sudo will prompt for a password sometimes, but it does so with a text interface. I'm kind of wondering how Nano servers (which I don't believe even offer a GUI for Remote Desktop by default) handle it.
    – jpmc26
    Apr 17, 2017 at 20:28
  • 3
    @jpmc26 Interaction on the text interface is okay.
    – test
    Apr 17, 2017 at 20:30
  • 2
    @user2064000 The UAC prompt is (at least by default for non-Windows binaries) launched on the Secure Desktop, not on the user's current desktop. Aside from being slightly annoying, this is designed to prevent other processes interfering with the UAC prompt. Also, if authentication is required, that will have to be on the Secure Desktop, and some admins may also require a Ctrl-Alt-Del sequence to prove that Windows is taking the password and not some other process impersonating a password prompt. So typing a password in the cmd window probably wouldn't fly from a Microsoft security perspective.
    – Calchas
    Apr 18, 2017 at 15:57
  • 1
    You can use the runas command. Run an application as administrator from prompt
    – Hybris95
    Apr 19, 2017 at 15:06

9 Answers 9

71

TL;DR - The only option is to spawn another process. (A new cmd.exe.) In the case of the Command Prompt, starting a new instance with an access token that has higher permissions will always result in a new window being created.


It's not possible to grant additional permissions to an already running process.

When a user with administrative rights logs into a Windows machine with User Account Control (UAC) enabled, two separate access tokens are created:

  1. One with full administrator access, and
  2. A second "filtered token" with standard user access

At the time a process (e.g. CMD.EXE) is created, it is assigned one of these two access tokens. If the process is run "elevated" as Administrator, the unfiltered access token is used. If the process is not granted admin rights, the filtered, standard user token is used.

Once a process has been created it is not possible to replace its access token.1 In this MSDN Application Security for Windows Desktop thread, a poster identifying himself as a member of the Windows Kernel Team states:

The NT kernel was never intended to allow token switching once a process started running. This is because handles, etc. may have been opened in an old security context, inflight operations may use inconsistent security contexts, etc. As such, it typically does not make sense to switch a process' token once it has begun execution. However, this was not enforced until Vista. [emphasis mine] (Source thanks to @Ben N)

Note: User Account Control was introduced with the release of Windows Vista.

This Super User answer cites two additional sources confirming the same:

Therefore it's simply not possible to elevate Command Prompt or any other process in-place. The only option is to spawn another process with a new access token (which can be another instance of the original process if desired). In the case of the Command Prompt, starting a new instance with an access token that has higher permissions will always result in a new window being created, and if UAC prompts are enabled on the system, they will be triggered as well.


1You can adjust the privileges in an existing access token with the AdjustTokenPrivileges function, but according to MSDN:

The AdjustTokenPrivileges function cannot add new privileges to the access token. It can only enable or disable the token's existing privileges.

2
  • 5
    Try 'gsudo' which allows to run elevated commands within the current console. It spawns an elevated process and streams its content to the non-elevated console. Jan 3, 2020 at 12:52
  • You should explain how the second part, about always creating a new window, happens for a different reason: The console subsystem. I think people would be less concerned with new processes spawning than windows popping up all the time.
    – Spencer
    Jun 6, 2022 at 12:39
18

While I am an enthusiastic user of TCC-LE, there is a solution which does not need any new programs:-

  • Start cmd as administrator.
  • This should start you in %SystemRoot%\system32\ - if not, cd there.
  • copy cmd.exe cmdadmin.exe (or any name you choose, such as su.exe).
  • Now run Explorer and find cmdadmin.exe.
  • Right-click and select Properties.
  • In the Compatibility tab select run as admin (or set it for all users).

Now cmdadmin is your su or sudo: you can start it without parameters to give you a shell with administrative privileges, or you can run it with /c to execute a single command in this mode. Depending on your policies, you may or may not be prompted for confirmation.

Note that this will always open a new window (as does the TCC solution start /elevated ...): for a GUI application this is expected, but for a command-line program, you may want to use /k instead of /c, to give you a chance to see the output; or you could run via a batch file (sudo.cmd perhaps?) which concatenates & pause to the end of your run string.

In either case it's not quite the same as su or sudo, but it's the closest you'll get. By setting the windows layout manually, the new window can be created directly below and abutting the original.

10
  • This is probably the closest the OP can get to the behavior of sudo, with the caveat of still having to deal with a new window/process being spawned. While probably not the best idea from a security standpoint, disabling all UAC prompts would eliminate having to respond to the UAC prompt when the elevated process is started. Apr 16, 2017 at 22:33
  • @Twisty - Thanks for the comment. I was aware of the security implications, but they are not any worse than the original premise that the account allows Run as administrator. It is up to anyone who implements it to decide if he or she wants constant reminders whenever it's invoked.
    – AFH
    Apr 17, 2017 at 0:19
  • 2
    I wasn't mentioning the security implications for your benefit, but rather for other readers. However I will disagree that disabling UAC prompts is no worse than running as an admin. UAC prompts can prevent a user logged in as Admin from granting unwanted administrative rights to a process. Without the prompts the user forfeits this opportunity. Apr 17, 2017 at 0:20
  • @Twisty - Just so. My response came from similar motives. Thanks again.
    – AFH
    Apr 17, 2017 at 0:22
  • 1
    instead of copying the cmd.exe, create a symlink to it. This way, if windows updates it and patches security bugs, you don't run a old version mklink cmdadmin.exe cmd.exe
    – Josef
    Apr 19, 2017 at 13:52
15

Is there a command which can elevate the Command Prompt in place?

There is a rather inconvenient way:

powershell -Command "Start-Process 'cmd.exe' -Verb runAs"

There were better ways but Microsoft closed them. Of course, you can always roll up your sleeves and write your own script equivalent of sudo with the source code I just gave you.

In other words, it should not spawn a new window or display UAC prompts.

Blasphemy! Burn him in the stake! ;) Joke aside, no. There isn't. That would be a bug and a security vulnerability. Microsoft made an explicit effort to ensure that the elevated and the standard process have as little in common as possible.

Smart kids who are thinking about two back-ends (one standard and one elevated) and one graphical front-end for both, should read about Session 0 Isolation.

1
9

It shouldn't be possible to elevate skipping the UAC, otherwise it violates a windows security principle.

But there are tools that allows this. Like gsudo, a sudo for windows that allows to elevate the command prompt in place. I am the author.

It shows a UAC window for the first elevation. If you gsudo again before the elevated gsudo timeouts, it wont ask for UAC again.

Features

  • Elevated commands are shown in the user-level console, as *nix sudo does, instead of opening the command in a new window.
  • Credentials cache: If gsudo is invoked several times within minutes it only shows the UAC pop-up once.
  • Suport for CMD commands: gsudo md folder (no need to use the longer form gsudo cmd.exe /c md folder
  • Suport for PowerShell commands if invoked from a PS shell.
  • Scripting:
    • gsudo can be used on scripts that requires to elevate one or more commands. (the UAC popup will appear once).
    • Outputs and exit codes of the elevated commands can be interpreted: E.g. StdOutbound can be piped or captured (gsudo dir | findstr /c:"bytes free" > FreeSpace.txt) and exit codes too ('%errorlevel%)).
    • If gsudo is invoked (with params) from an already elevated console it will just run the commands. So if you invoke a script that uses gsudo from an already elevated console, it will also work. The UAC popup would not appear.

Installation

  • Install via Scoop: scoop install gsudo
  • Install via Chocolatey: choco install gsudo
  • Or:
PowerShell -Command "Set-ExecutionPolicy RemoteSigned -scope Process; iwr -useb https://raw.githubusercontent.com/gerardog/gsudo/master/installgsudo.ps1 | iex"

See it in action: gsudo demo

Github Project https://github.com/gerardog/gsudo

2

Is there a similar command for Windows that does an in-place elevation without spawning a new window?

There is not such a command built in. Although I haven't proven that, I do believe that because I have seen multiple ways to use extra software/code to work around this issue.

In other words, it should not spawn a new window or display UAC prompts.

Forget it. Absolutely forget it. That goes against the design of UAC. If you could manage that, you're breaking a fundamental security process. Expect your solution to break by a patch after Microsoft learns of, and fixes, whatever process you might do to work around this.

The solution to avoid UAC prompts is to have high elevation to start with. UAC shouldn't bother you if you're sufficiently authorized. If you start with lower elevation (which is often recommended for security benefits) and then try to do something requiring higher elevation, then expect UAC interaction.

4
  • UAC prompts can be already bypassed with a scheduled task; I'm looking for something that does the in-place elevation instead of spawning a new command prompt window.
    – test
    Apr 16, 2017 at 18:49
  • If you do that, can you really set up the Scheduled Task without satisfying UAC's requirements? As for spawning, I'm saying that I don't expect so because I have noticed all of the elevating solutions I've seen so far have involved starting a new process. I think technically elevating without starting a new process could be done, as installation programs may ask for UAC after they are started, but I don't recall having seen any readily available solutions, easily importable into a batch file, yet.
    – TOOGAM
    Apr 16, 2017 at 18:54
  • 1
    Indeed; Scheduled Tasks completely defeat UAC. Once elevated, you can elevate to SYSTEM via services, and then use replace token on the original cmd.exe process.
    – Joshua
    Apr 17, 2017 at 17:13
  • There's a somewhat official PowerToy script that does the basic job; you can type elevate cmd to open a new command prompt window with a UAC prompt (the site also has context menu commands!). Or, of course, you can just Ctrl+Shift+Click the taskbar icon of any existing command prompt window to do the same -- that's what I tend to do the most often. (Which I know is not what the OP asked for, but what the OP asked for is blocked by design.)
    – Miral
    Apr 19, 2017 at 9:08
2

What you want is impossible in Windows, because does not support this concept. You need to start a new process with higher permissions.

I use nircmd to elevate processes from commandline. Your command would be nircmdc elevate cmd

2

I saw this question and came up with a simple solution. This is a tiny utility called rsudo, which runs escalated commands from a regular CMD window.

Note: A UAC prompt will come up. Hiding this is not possible, that's just the way that UAC has been designed.

Usage:
  rsudo.exe "[command]"

Download [Download not working, will update soon]

Note: The commands are run in a new window. If you want to view the output, run rsudo.exe "pause && [command]"

4
  • Mustn't it be rsudo.exe "[command] && pause"?
    – user477799
    Apr 18, 2017 at 9:17
  • @fleet No, a bug causes pause to be run first then
    – undo
    Apr 18, 2017 at 9:44
  • Rahul, thanks! Any chance of source code? ;) (Or maybe I was just looking in the wrong place on your site.)
    – cxw
    Apr 18, 2017 at 20:30
  • @cwz sure! I'll edit it in when I reach home and add a blog post :D
    – undo
    Apr 19, 2017 at 14:19
0

This one is weird.

You could try doing an ssh into your own computer which would use the same existing terminal, but would actually be an entirely different one.

It'll work, but it's probably not what you want.

Others may find it useful though.

0
-1

Try the JPSOFT Take Command command prompt TCC/LE. It comes in 32- and 64-bit versions and is free unless you want more functionality.

Go to https://jpsoft.com/ and click on Downloads and select what you want.

TCC/LE has a START /ELEVATED, which starts the program elevated with full admin privileges. (Windows Vista or later only.)

5
  • 1
    How is this related to the question?
    – test
    Apr 16, 2017 at 17:14
  • @DavidGrainger it turns out that the /elevated switch still doesn't allow me to bypass UAC and do the in-place elevation (see the question for details). Am I missing something?
    – test
    Apr 16, 2017 at 18:10
  • 1
    This is a replacement for the Windows Command Prompt. Plus, starting it elevated is no different than starting the built-in Command Prompt elevated. Apr 16, 2017 at 18:18
  • The only way maybe to change the UAC settings to "Never notify" When the UAC notification pops up, click on the "Show more details" link, then select the, "Show when this notification should appear" link. Select the setting that works. You may want to change it back when you are done, so unwanted actions are caught by it. this can be accomplished in Windows settings. Apr 16, 2017 at 18:33
  • TCC/LE does a lot of other stuff too. I tried it with the UAC set to never and then used, "Start /Elevated/PGM "C:\Program Files\IrfanView\i_view64.exe" /thumbs" to open a program Elevated. Apr 16, 2017 at 18:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .