14

I get the following error when running as a non-admin:

WireGuard is running, but the UI is only accessible from desktops of the Builtin Administrators

How do I enable wireguard for win10 to work with just a regular user?

Improve this question
2
  • 2
    If you place the user in the Administrator user group, do you receive this message, I suspect the UI is only designed to be accessible by Administrators. Since the software is open source this behavior can of course be changed. The message itself is poorly worded, the built-in Administrator only has a single desktop, so I suspect the message is actually indicating the UI can only be access by Administrator and is inaccessible by normal users. Please edit your question with the appropriate amount of information required to properly answer your question.
    – Ramhound
    Oct 3, 2019 at 17:06
  • If you don't have to modify Wireguard settings on a regular basis, simply log into an account that has administrator access, start Wireguard UI, adjust settings, then sign out (or better restart the computer just to be sure), sign in under a regular user account and check whether Wireguard settings are still in effect, e.g. by checking network connection that was created with Wireguard.
    – izogfif
    Nov 26, 2020 at 8:59

7 Answers 7

Reset to default
4

At present what you ask is not possible, on Windows.

Unlike other VPN tools and technologies, the Wireguard client creates a tunnel interface (showing up as a network adapter) for each connection you have configured when you try to connect, aka "on the fly". When you terminate the connection the client deletes the tunnel interface entirely. It does this outside the official VPN plumbing of Windows. That design has the severe limitation that you need to be an administrator of the machine so the software can create the interface.

I use Wireguard on Windows, Mac, and Linux. Windows is the only platform I have this issue with. Additionally, I only use the official client (version 0.38 at the time of this writing) from Wireguard. I do not know if there are others.

Improve this answer
9

As previous solutions and comments have pointed out, activating a wireguard (WG) tunnel is not possible - the action requires privilege elevation of some kind.

The solutions mentioned so far have some downsides, at least in my use case. For completeness I'll list all solutions mentioned and add mine.

  1. Normal WG installation, switch to administrator user to activate Wireguard, then switch back.

    • Pro: admin user has access to all features of WG GUI
    • Con: it takes time & clicks to switch users

  2. Normal WG installation, add HKLM\Software\WireGuard\LimitedOperatorUI registry key and add user to Network Configuration Operators group

    see WG registry keys documentation

    • Pro: WG GUI accessible
    • Con: messing with registry, GUI functionality severely limited, messes with privilege elevation prompt

    The last point needs clarification: when working as a regular unprivileged user, Windows asks for privilege elevation for many reasons, and one needs to type the/an admin password regularly. This is pretty straightforward, because an admin account is selected by default and one can enter the password quickly. Being part of the NCO group, however, makes the user a kind of admin in the eyes of the OS, so each elevation prompt will offer the current NCO user by default - now in order to enter the password of a real admin, it's necessary to first select another user. This quickly becomes annoying after the first few times one need privilege elevation.

  3. Enterprise WG install without launching admin GUI, starting / stopping WG tunnel from shortcut run as administrator

    • Pro: no GUI, no WG background service, user really stays regular
    • Con: no GUI

    See Enterprise Usage documentation.

    In brief:

    1. download WG MSI installer (instead of .exe)
    2. in admin command prompt, run msiexec /i <installer filename>.msi DO_NOT_LAUNCH=1
    3. create Desktop shortcuts for WG:
      • start with command wireguard /installtunnelservice <path to conf>.conf
      • stop with command `wireguard /uninstalltunnelservice
      • tick run as Administrator for both shortcuts

    Tunnel status can be checked with wg.exe

Improve this answer
7

Wireguard 3.1+ now supports non-admins running wireguard, but you'll need to do some minor modifications:

https://lore.kernel.org/wireguard/[email protected]/T/#u

  • Install wireguard 3.1+
  • Add your user to the "Network Configuration Operators". Open up explorer as admin right click "My Computer" > "Manage" > "Users/Groups" > Network Configuration Operators
  • Add an entry to the registry. Windows Key + R > regedit > create the key HKLM\SOFTWARE\WireGuard, then create a DWORD at HKLM\SOFTWARE\WireGuard\LimitedOperatorUI and set it to 1
  • Logout and log back in.
  • Run wireguard

enter image description here

Improve this answer
2
  • 1
    I tried this, have WG running in an Admin account, but don't see the path HKLM in Regedit. I do see HKEY_LOCAL_MACHINE.
    – SPRBRN
    Mar 26, 2021 at 16:59
  • 3
    @SPRBRN HKLM is shorthand for HKEY_LOCAL_MACHINE. HKCU is HKEY_CURRENT_USER, etc.
    – Kruug
    Aug 13, 2021 at 14:43
1

You can't open the UI as a regular user. However, there is a way to enable Wireguard to work with a regular user in Windows 10, giving the user the ability to freely start and stop the Wireguard tunnel.

Since Wireguard runs as a service in Windows, you can change the permissions for that service, without having to give the user more privilege than it needs to have.

  1. Configure the Wireguard tunnel on the machine using an admin account and the GUI then start the tunnel

  2. Open a command prompt and change the permissions for the service

    sc.exe sdset WireGuardTunnel$NameOfTheTunnel "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;WD)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

  3. You can then start and stop the tunnel using those commands. Don't use the GUI to start/stop at this point

    sc stop WireGuardTunnel$NameOfTheTunnel

    sc start WireGuardTunnel$NameOfTheTunnel

  4. Create a batch file, one for each command, like WireguardON.bat and WiregaurdOFF.bat and put them somewhere the client could access (on its desktop or something)

  5. Logout and log back in with the user account. It should be able to start and stop the service, even after a reboot.

Improve this answer
1
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jun 23, 2022 at 18:15
0

If you add it to the Network Operators Group, the User will be able to change IP address, change adapter and modify network settings which might end up compromising on the network. If there is any other possibility, please post.

Improve this answer
2
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Nov 14, 2021 at 11:53
  • 1
    I believe this was a caution. Wireguard and the required group can change things (e.g. NICs, default gateway, DNS, etc) end users should not. This entire thread exists because the author of Wireguard never intended it to be used by anyone other than admins. The restriction was by design. While this comment did not directly answer the question, it is a worthy caution. Research what the Network Configuration Operators group is capable of.
    – patrick fogarty
    Mar 25, 2022 at 19:29
0

I know this Thread is old, but if other's looking for an answer. Found this site via Google and searched for a solution. But in the end, I found my own solution.

  1. Install Wireguard as admin and import the conf.
  2. Create a new task via task scheduler
  3. In General -> security options execute independently of the user login and with highest privileges
  4. In Trigger, start task, choose on login
  5. in Actions, start program (path to wireguard.exe)
Improve this answer
0

All other solutions to this problem are not ideal. The methods I've seen are:

  1. Just running as an admin

  2. Adding the user account to the Network Configuration Operators

    • Pros: Wireguard gui, works smoothly
    • Cons: Your regular user gets added to an admin group and will appear in UAC prompts. This is very annoying and probably bad security.

  3. Running the WireGuard tunnel as a windows service (as suggested in this answer)

    • Pros: Works perfectly
    • Cons: No gui, needs an elevated console.

  4. Using Task Scheduler as in this answer (didn't work for me at all).

Solution:

  1. Install the latest MSI: https://download.wireguard.com/windows-client/

  2. Then run this command in elevated console with your .conf file:

    wireguard /installtunnelservice C:\path\to\some\myconfname.conf

This creates a service called WireGuardTunnel$myconfname, which can be controlled using standard Windows service management utilites, such as services.msc or sc. — source

  1. Control the service with "ServiceTray": https://www.coretechnologies.com/products/ServiceTray/

    (This give you a nice icon on the system tray that shows the up status of the WireGuard tunnel service. Green = connected, red = not connected, and you can start and stop it by right clicking. See image below)

    Note: When creating the service controller, save the shortcut to desktop not startup (doesn't seem to work and you can copy to startup later)

  2. (optional) Change the service's startup type to manual if you don't want to be connected to the tunnel on startup.

An example of what this looks like on Win 10. Hovering the icon shows the name of the tunnel.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .