I get the following error when running as a non-admin:
WireGuard is running, but the UI is only accessible from desktops of the Builtin Administrators
How do I enable wireguard for win10 to work with just a regular user?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
At present what you ask is not possible, on Windows.
Unlike other VPN tools and technologies, the Wireguard client creates a tunnel interface (showing up as a network adapter) for each connection you have configured when you try to connect, aka "on the fly". When you terminate the connection the client deletes the tunnel interface entirely. It does this outside the official VPN plumbing of Windows. That design has the severe limitation that you need to be an administrator of the machine so the software can create the interface.
I use Wireguard on Windows, Mac, and Linux. Windows is the only platform I have this issue with. Additionally, I only use the official client (version 0.38 at the time of this writing) from Wireguard. I do not know if there are others.
As previous solutions and comments have pointed out, activating a wireguard (WG) tunnel is not possible - the action requires privilege elevation of some kind.
The solutions mentioned so far have some downsides, at least in my use case. For completeness I'll list all solutions mentioned and add mine.
Normal WG installation, switch to administrator user to activate Wireguard, then switch back.
Normal WG installation, add
HKLM\Software\WireGuard\LimitedOperatorUI registry key and add user to
Network Configuration Operators group
see WG registry keys documentation
The last point needs clarification: when working as a regular unprivileged user, Windows asks for privilege elevation for many reasons, and one needs to type the/an admin password regularly. This is pretty straightforward, because an admin account is selected by default and one can enter the password quickly. Being part of the NCO group, however, makes the user a kind of admin in the eyes of the OS, so each elevation prompt will offer the current NCO user by default - now in order to enter the password of a real admin, it's necessary to first select another user. This quickly becomes annoying after the first few times one need privilege elevation.
Enterprise WG install without launching admin GUI, starting / stopping WG tunnel from shortcut run as administrator
See Enterprise Usage documentation.
msiexec /i <installer filename>.msi DO_NOT_LAUNCH=1
wireguard /installtunnelservice <path to conf>.conf
run as Administratorfor both shortcuts
Tunnel status can be checked with wg.exe
Wireguard 3.1+ now supports non-admins running wireguard, but you'll need to do some minor modifications:
You can't open the UI as a regular user. However, there is a way to enable Wireguard to work with a regular user in Windows 10, giving the user the ability to freely start and stop the Wireguard tunnel.
Since Wireguard runs as a service in Windows, you can change the permissions for that service, without having to give the user more privilege than it needs to have.
Configure the Wireguard tunnel on the machine using an admin account and the GUI then start the tunnel
Open a command prompt and change the permissions for the service
sc.exe sdset WireGuardTunnel$NameOfTheTunnel "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;WD)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
You can then start and stop the tunnel using those commands. Don't use the GUI to start/stop at this point
sc stop WireGuardTunnel$NameOfTheTunnel
sc start WireGuardTunnel$NameOfTheTunnel
Create a batch file, one for each command, like WireguardON.bat and WiregaurdOFF.bat and put them somewhere the client could access (on its desktop or something)
Logout and log back in with the user account. It should be able to start and stop the service, even after a reboot.
I know this Thread is old, but if other's looking for an answer. Found this site via Google and searched for a solution. But in the end, I found my own solution.
All other solutions to this problem are not ideal. The methods I've seen are:
Just running as an admin
Adding the user account to the Network Configuration Operators
Running the WireGuard tunnel as a windows service (as suggested in this answer)
Using Task Scheduler as in this answer (didn't work for me at all).
Install the latest MSI: https://download.wireguard.com/windows-client/
Then run this command in elevated console with your .conf file:
wireguard /installtunnelservice C:\path\to\some\myconfname.conf
This creates a service called
WireGuardTunnel$myconfname, which can be controlled using standard Windows service management utilites, such as services.msc or sc. — source
Control the service with "ServiceTray": https://www.coretechnologies.com/products/ServiceTray/
(This give you a nice icon on the system tray that shows the up status of the WireGuard tunnel service. Green = connected, red = not connected, and you can start and stop it by right clicking. See image below)
Note: When creating the service controller, save the shortcut to desktop not startup (doesn't seem to work and you can copy to startup later)
(optional) Change the service's startup type to manual if you don't want to be connected to the tunnel on startup.
An example of what this looks like on Win 10. Hovering the icon shows the name of the tunnel.