Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Always install with elevated privileges

This policy directs Windows Installer to install Windows Installer packages with elevated system privileges.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
  • HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated

This policy directs Windows Installer to install Windows Installer packages with elevated system privileges. It consequently allows non-administrative users to install packages that need to modify protected directories or registry keys.

The setting consists of two REG_DWORD values. It takes effect only when AlwaysInstallElevated is set to 1 under both HKLM and the applicable user’s HKCU hive. If either value is missing or has another value, Windows Installer elevates managed applications only; unmanaged applications are installed with the current user’s privileges.

Notes

Security

Enabling both values creates a significant system security risk. A user can arrange for a specially prepared Windows Installer package to run in the privileged installation context and modify protected files, folders, or registry entries. This can be used to obtain persistent elevated access.

The enabled computer value is security-sensitive even before the corresponding user value exists. Microsoft notes that, after the per-machine policy is enabled, any user can set the policy value in their own user profile. The computer value alone does not activate elevated installation, but it enables a user to satisfy the remaining condition through HKCU.

The policy elevates the Windows Installer installation context. It does not directly elevate every process in the user’s session or independently grant unrestricted access to all files.

Notes

The setting applies to Windows Installer and its packages. Its behavior should not be assumed to cover installers that use other technologies.

The policy is exposed in both Computer Configuration and User Configuration. The corresponding registry values in both scopes must be enabled for the policy to take effect for a user.

Microsoft documentation

Microsoft Learn: AlwaysInstallElevated

Microsoft Learn: Policy CSP – ApplicationManagement

See also