Windows Privilege Escalation: AlwaysInstallElevated

“When the ‘Always install with elevated privileges’ setting is enabled via Group Policy, it allows Windows Installer packages (.msi files) to deploy with administrative privileges by any user. This convenience feature can be effortlessly exploited to grant an attacker an NT Authority\SYSTEM shell.”

Somewhere in most large Windows estates is an admin who got tired of packaging every software update through proper deployment tooling and flipped AlwaysInstallElevated in Group Policy (gpedit.msc) to make the problem go away. It works. It also hands every unprivileged user on the domain a two-command path to SYSTEM. Windows Privilege Escalation: AlwaysInstallElevated is a tight tactical guide to exactly why that shortcut is a disaster.

Hunting for the Misconfiguration

The guide first shows how to hunt for the flaw the way you actually work on target—through a command shell, not a desktop. On a compromised host you rarely have a GUI, so a methodology that assumes one is useless.

Instead it queries the registry directly from a basic shell to confirm the setting. The catch worth knowing: the misconfiguration only bites when both keys are set, so checking one and stopping is how testers miss it:

• reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
• reg query HKLM\Software\Policies\Microsoft\Windows\Installer

It also shows the check folded into automated enumeration such as WinPEAS, so on a large assessment the finding surfaces on its own instead of depending on you remembering to run the two reg query commands by hand.

Weaponizing the Installer

Once both the HKLM and HKCU keys return 0x1, the guide moves to exploitation, and the exploitation is almost boring—which is the point.

Under this policy Windows runs any MSI as SYSTEM, so all an attacker needs is a malicious one:

• Payload Generation: msfvenom compiles a .msi that fires a reverse shell back to attacker infrastructure.
• Quiet Execution: msiexec /quiet /qn /i payload.msi installs it silently in the background—no pop-up, no prompt, no warning to the logged-in user before the SYSTEM shell lands.

Who Is This Book REALLY For?

• Red Team Operators: One of the fastest, most reliable routes to SYSTEM on a locked-down workstation—worth checking early on every Windows engagement.
• Active Directory Architects: The case for pushing software through a proper deployment engine like SCCM instead of globally weakening install policy to save packaging effort.
• Security Auditors: The exact registry paths to confirm AlwaysInstallElevated is disabled during a baseline review, so it never ships in the gold image.

The Bottom Line

Windows Privilege Escalation: AlwaysInstallElevated is a clean lesson in how a convenience setting becomes a critical vulnerability. One Group Policy switch, flipped to spare an admin some packaging work, throws out the entire local permissions model—and an attacker only needs two commands to prove it.