509

I always work on a non-administrator account on my Windows computer. Sometimes I need to install programs which requires administrator access. As I mostly use the Windows command prompt, is there a Windows command to escalate privileges, similar to the Linux terminal command sudo?

Paul
  • 4,794
  • 29
  • 41
ukanth
  • 10,700
  • 8
    I believe the term you are looking for is "elevated" access. Even though your credentials have admin permission, processes under your credentials don't have admin permissions until you "sudo" the command. In Windows, they call it "elevate". – surfasb Jan 25 '14 at 01:01
  • 8
    @IGRACH not on my powershell... – jiggunjer Jan 17 '16 at 15:27
  • 2
    I use this doskey sudo= runas /user:Administrator "cmd /k cd \"%cd%\" & $*" – William Sep 10 '18 at 15:35
  • 4
    gsudo works in cmd/powershell/windows terminal and has some nice features. – Gerardo Grignoli Feb 10 '20 at 01:53
  • This may be old news now but I run windows 10 with windows-subsystem-for-linux enabled. For my wsl terminal I use Ubuntu. I never thought I would go for something like this as a linux user but it's actually pretty handy, plays nice with VS code as well. – Jacksonkr Feb 27 '20 at 15:45
  • 1
    Microsoft just added "Sudo for Windows." See https://learn.microsoft.com/windows/sudo/ The run as command will continue to be supported and enables running programs as other users, including but not limited to as administrator, which Sudo for Windows does not yet support. – MWOJO Feb 08 '24 at 18:42

19 Answers19

297

The runas command.

runas [{/profile|/noprofile}] [/env] [/netonly] [/smartcard] [/showtrustlevels] [/trustlevel] /user:UserAccountName program

Just run:

runas /noprofile /user:Administrator cmd

to start a command shell as a administrator

patricktokeeffe
  • 293
Davy Landman
  • 4,542
  • 23
    You might find you want the profile loaded (e.g. including environment variables) for any extended use. In which case drop the /noprofile. – Richard Sep 17 '09 at 09:38
  • 3
    You also have to make sure that the Administrator account has a password. Otherwise you get an error 1327, "user account restriction. Possible reasons are blank passwords not allowed,..." – lilbyrdie Nov 06 '10 at 14:35
  • 6
    This is not working for me. After I typed my password the command prompt is closed. – Jonas Dec 09 '10 at 13:44
  • 1
    The "Account is disabled" checkbox on the user properties must be unchecked for this command to work. – Mike Glenn Dec 14 '10 at 05:05
  • 2
    @Jonas, you might have a renamed Admin account. I had the same issue – JP Hellemons Oct 11 '11 at 14:23
  • 64
    isn't this asking for the Administrator's password? sudo is asking for *your* password! – n611x007 Sep 18 '12 at 08:42
  • 20
    Unfortunately, this is seriously outdated. Runas merely runs commands under a different set of credentials. Even though your credentials have admin permissions, it doesn't mean all processes under your credentials run as admin. – surfasb Jan 25 '14 at 00:59
  • Can the script provide the password? – jcalfee314 Mar 17 '14 at 18:13
  • 3
    @naxa Yeah, it's not exactly sudo. But you can change /user:Administrator to /user:YourLoginName and do the same thing as sudo, of course. Don't quite understand @surfasb 's comment. When would this bite you? I've successfully used this trick to edit files that are only editable by an admin (eg runas /noprofile /user:myUserName "C:\path\to\Vim\vim73\gvim.exe C:\some\file.cfg") – ruffin Nov 05 '14 at 15:22
  • 1
    Doesn't work for me. It just asks for password (whether MyLoginName or the Administrator) and just runs the command normally. I've tested it by running taskmgr and even after entering password it says "740: The requested operation requires elevation.". Running calc works as it doesn't require elevation. – laggingreflex Jan 13 '15 at 04:31
  • @surfasb what if you launch whatever program you want from cmd, after doing runas /user:Administrator? – barlop Jan 17 '16 at 14:25
  • 19
    +1 for "outdated" since runas can't bypass UAC. Instead, press Windows button, type cmd, and press Ctrl+Shift+Enter. – mellow-yellow Jan 22 '16 at 12:06
  • 3
    @barlop: You should look up how UAC works. The Administrator account, by default, auto elevates process to Admin permissions. It's a coincidence that it works with the Administrator account. Use any other account in the Administators group with runas and your program won't get Admin permissions by default. – surfasb Jan 22 '16 at 16:46
  • 2
    https://chocolatey.org/packages/Sudo – El Hocko Jan 16 '18 at 22:51
  • This is elevation of a user account in Administrators; sudo is another thing. – Massimo Jan 13 '20 at 10:11
145

Elevate - "executes a command with UAC privilege elevation. This is useful for working inside command prompts or with batch files." It's not the same as sudo, it changes the executing user to Administrator, but its syntax is a lot more straightforward to use than runas, and it can keep the current directory, enabling the use of relative paths.

Synopsis:
  elevate [(-c | -k) [-n] [-u]] [-w] command

Options:
  -c  Launches a terminating command processor; equivalent to "cmd /c command".
  -k  Launches a persistent command processor; equivalent to "cmd /k command".
  -n  When using -c or -k, do not pushd the current directory before execution.
  -u  When using -c or -k, use Unicode; equivalent to "cmd /u".
  -w  Waits for termination; equivalent to "start /wait command".

Elevate's purpose isn't to work around or bypass UAC (User Account Control), but to work with it. As long as UAC is enabled there has to be some kind of prompt at some point in the process. If you need to get rid of prompting altogether you have to disable UAC.

The pain point Elevate alleviates is escalating a particular process from a non-privileged shell and then carrying on as normal. Without this you need to start a privileged command prompt with right-click > "Run as Administrator" before attempting the privileged command, which can't be easily scripted.

This works well with "Elevate without prompting" in secpol.msc. Together, they do the same as %wheel ALL=(ALL) NOPASSWD: ALL in sudo

A known limitation is that it does not return the error code from the program it is elevating.

If your muscle memory is stuck on sudo, create an alias using Doskey:
doskey sudo=elevate -w

or batchfile in PATH:
@elevate -w %*

Elevate is 3rd party tool written by Johannes Passing. It's an 11kb download and portable (no install needed): http://code.kliu.org/misc/elevate/

matt wilkie
  • 5,143
  • 6
    This goes perfect with "Elevate without prompting" in secpol.msc. Together, they do the same as %wheel ALL=(ALL) NOPASSWD: ALL in sudo. – sayap Feb 20 '12 at 09:40
  • 2
    @sayap, just to be clear, do you mean this: http://ss64.com/nt/syntax-uac.html? – matt wilkie Feb 20 '12 at 18:45
  • Yes, that's the one. From my limited testing, it works straight away without having to restart Windows. – sayap Feb 21 '12 at 00:19
  • there's a similar program with the same name here: http://wintellect.com/cs/blogs/jrobbins/archive/2007/03/27/elevate-a-process-at-the-command-line-in-vista.aspx – Janus Troelsen Feb 06 '13 at 01:21
  • 8
    The only trouble I find with elevate (v1.3.0) is that it does not return the error code from the program it is elevating. – Ken Aug 14 '13 at 18:41
  • 4
    Sudo.bat : @elevate %* => profit! – Joe DF Mar 12 '14 at 05:06
  • -1 this requires elaboration. I just tried C:\>elevate dir and it caused a popup prompting me if I want to elevate. That isn't very useful in a script. – barlop Mar 15 '14 at 12:30
  • 3
    @barlop: elevate's purpose isn't to work around or bypass UAC (User Account Control), but to work with it. As long as UAC is enabled there has to be some kind of prompt at some point in the process. If you need to get rid of prompting altogether you have to disable UAC (see 2nd comment). The problem elevate solves is escalating a particular process from a non-privileged shell, and then carrying on as normal. Without this you need to start a privileged command prompt with right-click "Run as Administrator", which can't be scripted, before attempting the privileged command. – matt wilkie Mar 19 '14 at 22:40
  • @barlop, ok. I see I don't understand the nature of your complaint, and don't know how else to attempt to address it. – matt wilkie Mar 20 '14 at 18:31
  • alias sudo='elevate -w' – Jürgen Paul Sep 29 '14 at 08:00
  • Open explorer.exe as another credentials user and as administrator? – Kiquenet Feb 10 '15 at 14:47
  • 1
    @Kiquenet that's the same approach as runas in other answers, with similar results and differences to elevate, isn't it? – matt wilkie Feb 10 '15 at 17:38
  • 17
    Would be nice to mention that it's an external utility, missing OOTB. – Hi-Angel Dec 27 '16 at 16:18
  • This is elevation of a user account in Administrators; sudo is another thing. – Massimo Jan 13 '20 at 10:11
  • Bowing to the wisdom of the crowd: post edited to declare it's a download (and credit the maker by name); Also incorporated other comment info. – matt wilkie Jan 14 '20 at 22:44
  • @massimo: see 2nd sentence ;-) – matt wilkie Jan 14 '20 at 22:45
  • 'elevate' is not recognized as an internal or external command, operable program or batch file. Trying on Win10 – Adam Bajger Aug 25 '22 at 09:37
  • 1
    @AdamBajger you need to download it first, see last sentence in answer. If you've done that it needs to be put in [tag:path] – matt wilkie Aug 30 '22 at 05:36
69

You can use the runas command which is kind of similar, or you can check out the sudo for Windows project over at SourceForge which adds a sudo command.

The difference is subtle:

Let's say you have two users. Bob is a normal user and James is an administrator.

If you log in as Bob and use "runas james acommand" the command is run as if it was run by James, so it accesses James' user settings and any user changes go into James My Documents & settings folders, etc. So if you are installing an application, say, it will be installed as James, not as Bob.

If on the other hand Bob does "sudo acommand" the command is still run as Bob, but with elevated permissions - just like the Linux sudo command. To prevent any user from being able to sudo you have to define a sudoers user group that contains the list of the normal users that have permission to elevate using sudo. The users still have to provide credentials before elevation.

Sometimes the difference isn't important, sometimes it is, and I find that both commands can be useful.

Peter Mortensen
  • 12,190
Simon P Stevens
  • 5,203
  • 2
    Are you sure? When I run sudo in ubuntu, if my current theme is in ~/.themes then the sudo-ed application will not be able to access that theme, because it's not in /home/root/.themes, and will use the default ugly gtk theme. – hasen Nov 19 '09 at 22:28
  • 5
    @hasen j - your issue is just because ~/.themes evaluates before the command is run (and thus before it switches over to root). – Jared Dec 15 '11 at 18:52
  • 2
    Another solution, except hosted on GitHub, is windosu: https://github.com/tehsenaus/windosu I just found it, and it seems to work great. Favorite thing is it's super easy to install. Just "npm install -g windosu". – Venryx Jun 06 '17 at 07:52
  • This is elevation of a user account in Administrators; sudo is another thing. – Massimo Jan 13 '20 at 10:12
  • @Massimo, can you explain the difference. – Simon P Stevens Jan 13 '20 at 14:50
42

You can also use the Script Elevation PowerToys.

Vinayak
  • 10,745
DDM
  • 549
  • Awesome - exactly what I was looking for. I didn't want to run as a command has a different user, only to run it with elevated privileges. – orip Mar 14 '10 at 12:55
  • Exactly the right solution for this problem! Who wants Runas with its messy syntax? – Stabledog Mar 29 '10 at 14:14
  • 1
    I've often wished the elevate command were built into windows. It's a fantastic tool. – nhinkle Nov 11 '10 at 23:43
  • there's now an Elevation PowerToys collection by the same author from which Creating a Self-Elevating Script is particularly relevant. – matt wilkie Sep 07 '11 at 23:22
  • @nhinkle can you do elevate command such that it suppresses the popup asking if you want to elevate it? – barlop Mar 15 '14 at 12:31
  • 1
    @barlop of course not. That would defeat the purpose of UAC. – nhinkle Mar 15 '14 at 17:07
  • @nhinkle limiting the techie user in efficiency / demanding his attention for the meanial task of confirmation to run elevated, isn't exactly its goal(its goal is to prevent malicious attack, not elongate the process for legit things), but obviously it's something that it could be argued it must unfortunately do. Now though, if any program could run elevated in an automated way(no permission required), would you want it destroyed, for it hath defeated "the purpose of UAC"? – barlop Mar 15 '14 at 18:31
  • @barlop the whole point of UAC is that you can't run elevated without getting the user's permission. If you could just type elevate whatever.exe and have it run elevated, then it would be trivial for an attacker to run elevate nasty-virus.exe. It's an inherent requirement of UAC that confirmation occur somehow. It can't ask for confirmation in the command window, because the confirmation must run on an isolated secure desktop to prevent other software from injecting keystrokes. – nhinkle Mar 15 '14 at 18:51
  • @nhinkle i'm aware of that and am not disputing that. you didn't quite answer the question I asked you at the end of my comment but it doesn't matter, not important! ;-) – barlop Mar 15 '14 at 19:32
  • It seems @barlop does not understand UAC. If you want your script to stop prompting you need to switch UAC off temporarily--which requires at least one prompt at the start of the script. Though I think in newer Windows versions even that became harder. Or maybe run every process from an elevated cmd. – jiggunjer Jan 17 '16 at 13:34
  • To only ask once, the script must have a separate component that would then do the administrative actions. – Paul Stelian Mar 01 '18 at 17:46
  • @nhinkle "because the confirmation must run on an isolated secure desktop to prevent other software from injecting keystrokes"? What??? how is every other OS on the planet able to do this securely? – gman Jun 11 '20 at 06:22
32

If you are ready to switch to alternative consoles, there is ConEmu (I'm the author). One of its features - the ability to run both elevated and non-elevated tabs in the one ConEmu window. Tabs may be started with different credentials too.

For user comfort, there is batch-file csudo.cmd (which may be easily adopted to bash). Read full description in project's wiki. In brief, when you run some command from existing non-elevated tab, for example

csudo dism /online /enable-feature /featurename:NetFX3 /All /Source:D:\sources\sxs /LimitAccess

ConEmu will starts dism in the new elevated console/tab (with preceding UAC prompt in Vista or Login box in XP).

By default csudo starts new console in a split (may be changes via editing of csudo.cmd contents).

And of course you may rename it to sudo.cmd if you like "classic" sudo word.

sudo in ConEmu/Windows

Maximus
  • 20,745
  • 1
    csudo long ago was included in the ConEmu distribution. No link is needed at all. – Maximus Mar 12 '14 at 08:16
  • problem here is the new console tab becomes unusable after the sudo'd command. So you can't continue working in the elevated tab, just get a press enter or esc to exit message. – jiggunjer Jan 17 '16 at 15:25
  • 1
    Of course you cant. Even on Unix you are back to non-elevated terminal after sudo command is done its work! You are going wrong way. – Maximus Jan 17 '16 at 17:45
  • 1
  • if you're gonna open a new window or tab you might as well keep it, let the user choose if they want to continue. 2) On my ubuntu I don't have to sudo every time, elevation lasts a few minutes I think. 3) this application has a million options, yet nothing for this? Maybe I'm spoiled.
    • – jiggunjer Jan 18 '16 at 02:31