The Chalkboard

Robert Hawdon's Knowledge Base

Run applications as the SYSTEM user interactively

Last Updated: [2023-04-06 Thu 05:44]

This page has been adapted from some internal notes which has had company senstive information stripped.

Introduction

This guide is for when you might need/desire to run something on Windows as the SYSTEM user. For example, you might be running something as a service (e.g. Consul, Puppet, etc.) and want to see how it behaves by looking at verbose output. Unlike Linux where services are generally run as the root user, on Windows, services usually run as the SYSTEM user and may behave differently as Administrator due to the fact the Administrator account is separate from SYSTEM - adding another variable to the mix when diagnosing an issue.

Unfortunately, Windows has no easy way to do this out of the box, however, our friend (and CTO of Microsoft), Mark Russinovich, has a great tool to elevate yourself to the SYSTEM user. That application is psexec which is part of the PsTools suite available here: https://docs.microsoft.com/en-gb/sysinternals/downloads/pstools

Getting PsTools

Start by going to https://docs.microsoft.com/en-gb/sysinternals/downloads/pstools and downloading PsTools ZIP file. I'd suggest saving it locally and copying it via RDP as and when needed.
Extract the ZIP file to an easy to access location

Using psexec to elevate to the SYSTEM user

Launch CMD (Command Prompt) as Administrator
Navigate to where you extracted PsTools (e.g. cd \Users\Username\Documents\PSTools)
Run psexec -i -s cmd
If this is the first time running psexec, click "Accept" on the EULA

At this point, a new Command Prompt window will open. Anything you run here will be done as the SYSTEM user. The new window will still show "Administrator", this is normal.

DISCLAIMER: The information provided on this website is generated from my own notes and is provided "as is" and without warranties. Robert Ian Hawdon can not be held responsible for damages caused by following a guide published on this site. This website contains links to other third-party websites. Such links are provided as convienice of the reader. I do not endorce the contents of these third party sites.