How can I auto-elevate my batch file so that it requests from UAC administrator rights if required

Question

I want my batch file to only run elevated  If not elevated  provide an option for the user to relaunch batch as elevated   I m writing a batch file to set a system variable  copy two files to a Program Files location  and start a driver installer  If a Windows nbsp 7 Windows nbsp Vista user  UAC enabled and even if they are a local admin  runs it without right-clicking and selecting  Run as Administrator   they will get  Access Denied  copying the two files and writing the system variable   I would like to use a command to automatically restart the batch as elevated if the user is in fact an administrator  Otherwise  if they are not an administrator  I want to tell them that they need administrator privileges to run the batch file  I m using xcopy to copy the files and REG ADD to write the system variable  I m using those commands to deal with possible Windows nbsp XP machines  I ve found similar questions on this topic  but nothing that deals with relaunching a batch file as elevated

User · Answer

Following solution is clean and works perfectly.

Download Elevate zip file from https://www.winability.com/download/Elevate.zip
Inside zip you should find two files: Elevate.exe and Elevate64.exe. (The latter is a native 64-bit compilation, if you require that, although the regular 32-bit version, Elevate.exe, should work fine with both the 32- and 64-bit versions of Windows)
Copy the file Elevate.exe into a folder where Windows can always find it (such as C:/Windows). Or you better you can copy in same folder where you are planning to keep your bat file.
To use it in a batch file, just prepend the command you want to execute as administrator with the elevate command, like this:

 elevate net start service ...

User · Answer

I use PowerShell to re-launch the script elevated if it s not  Put these lines at the very top of your script   net file 1 gt nul 2 gt nul  amp  amp  goto  run    powershell -ex unrestricted -Command  Start-Process -Verb RunAs -FilePath   comspec   -ArgumentList   c   fnx0      goto  eof  run    TODO  Put code here that needs elevation   I copied the  net name  method from  Matt s answer  His answer is much better documented and has error messages and the like  This one has the advantage that PowerShell is already installed and available on Windows nbsp 7 and up  No temporary VBScript    vbs  files  and you don t have to download tools   This method should work without any configuration or setup  as long as your PowerShell execution permissions aren t locked down

User · Answer

I wrote gsudo  a sudo for windows  that elevates in the current console  no context switching to a new window   with a credentials cache  reduced UAC popups   and also elevates PowerShell commands  It allows to elevate commands that require admin privileges  or the whole batch  if you want  Just prepend gsudo  before anything that needs to run elevated  Example batch file that elevates itself using gsudo  EDIT  New one liner version that works with any windows language and avoids whoami issues  net session  gt nul 2 gt nul  amp  net session  gt nul 2 gt nul    gsudo  quot   f0 quot   amp  amp  exit  b    exit  b    This will run as admin     Alternative  original version    echo off   rem Test if current context is already elevated    whoami  groups   findstr  b BUILTIN Administrators   findstr  c  quot Enabled group quot  1 gt  nul 2 gt nul  amp  amp  goto  isadministrator   echo You are not admin   yet       Use gsudo to launch this batch file elevated    gsudo  quot   f0 quot    goto end  isadministrator   echo You are admin    echo  Do admin stuff now    end  Install   via chocolatey  choco install gsudo or scoop  scoop install gsudo or grab it from github  https   github com gerardog gsudo  See gsudo in action

User · Answer

Matt has a great answer  but it strips away any arguments passed to the script  Here is my modification that keeps arguments  I also incorporated Stephen s fix for the working directory problem in Windows 8   ECHO OFF setlocal EnableDelayedExpansion    net file to test privileges  1 gt NUL redirects output  2 gt NUL redirects errors NET FILE 1 gt NUL 2 gt NUL if   errorlevel       0    goto START   else   goto getPrivileges      getPrivileges if   1    ELEV    goto START    set  quot batchPath   f0 quot  set  quot batchArgs ELEV quot     Add quotes to the batch path  if needed set  quot script  0 quot  set script  script  quot    IF   0     script     GOTO PathQuotesDone       set  quot batchPath  quot  quot  batchPath  quot  quot  quot   PathQuotesDone    Add quotes to the arguments  if needed   ArgLoop IF   1        GOTO EndArgLoop   else   GOTO AddArg        AddArg     set  quot arg  1 quot      set arg  arg  quot        IF   1     arg     GOTO NoQuotes           set  quot batchArgs  batchArgs   quot  1 quot  quot          GOTO QuotesDone          NoQuotes         set  quot batchArgs  batchArgs   1 quot       QuotesDone     shift     GOTO ArgLoop  EndArgLoop    Create and run the vb script to elevate the batch file ECHO Set UAC   CreateObject   quot Shell Application quot     gt   quot  temp  OEgetPrivileges vbs quot  ECHO UAC ShellExecute  quot cmd quot    quot  c  quot  quot  batchPath   batchArgs  quot  quot  quot    quot  quot    quot runas quot   1  gt  gt   quot  temp  OEgetPrivileges vbs quot   quot  temp  OEgetPrivileges vbs quot   exit  B   START   Remove the elevation tag and set the correct working directory IF   1    ELEV    shift  1   cd  d   dp0    Do your adminy thing here

User · Answer

I pasted this in the beginning of the script      BatchGotAdmin  ------------------------------------- REM  -- gt  Check for permissions  gt nul 2 gt  amp 1   SYSTEMROOT  system32 icacls exe    SYSTEMROOT  system32 config system   REM -- gt  If error flag set  we do not have admin  if   errorlevel   NEQ  0        echo Requesting administrative privileges        goto UACPrompt   else   goto gotAdmin     UACPrompt     echo Set UAC   CreateObject   Shell Application     gt    temp  getadmin vbs      echo args       gt  gt    temp  getadmin vbs      echo For Each strArg in WScript Arguments  gt  gt    temp  getadmin vbs      echo args   args   amp  strArg   amp        gt  gt    temp  getadmin vbs      echo Next  gt  gt    temp  getadmin vbs      echo UAC ShellExecute    s0   args       runas   1  gt  gt    temp  getadmin vbs         temp  getadmin vbs         exit  B   gotAdmin     if exist   temp  getadmin vbs    del   temp  getadmin vbs        pushd   CD       CD  D    dp0   --------------------------------------

User · Answer

Using  powershell   If the cmd file is long I use a first one to require elevation and then call the one doing the actual work   If the script is a simple command everything may fit on one cmd file  Do not forget to include the path on the script files   Template    echo off powershell -Command  Start-Process  cmd  -Verb RunAs -ArgumentList   c   comands or another script cmd go here       Example 1    echo off powershell -Command  Start-Process  cmd  -Verb RunAs -ArgumentList   c  powershell exe -NoProfile -ExecutionPolicy Bypass -File C  BIN x ps1      Example 2    echo off powershell -Command  Start-Process  cmd  -Verb RunAs -ArgumentList   c  c  bin myScript cmd

User · Answer

I am using Matt s excellent answer  but I am seeing a difference between my Windows nbsp 7 and Windows nbsp 8 systems when running elevated scripts   Once the script is elevated on Windows nbsp 8  the current directory is set to C  Windows system32  Fortunately  there is an easy workaround by changing the current directory to the path of the current script   cd  d   dp0   Note  Use cd  d to make sure drive letter is also changed   To test this  you can copy the following to a script  Run normally on either version to see the same result  Run as Admin and see the difference in Windows nbsp 8    echo off echo Current path is  cd  echo Changing directory to the path of the current script cd   dp0 echo Current path is  cd  pause

User · Answer

Although not directly applicable to this question  because it wants some information for the user  google brought me here when I wanted to run my  bat file elevated from task scheduler   The simplest approach was to create a shortcut to the  bat file  because for a shortcut you can set Run as administrator directly from the advanced properties   Running the shortcut from task scheduler  runs the  bat file elevated

User · Answer

You can have the script call itself with psexec s -h option to run elevated   I m not sure how you would detect if it s already running as elevated or not    maybe re-try with elevated perms only if there s an Access Denied error   Or  you could simply have the commands for the xcopy and reg exe always be run with psexec -h  but it would be annoying for the end-user if they need to input their password each time  or insecure if you included the password in the script

User · Answer

There is an easy way without the need to use an external tool - it runs fine with Windows nbsp 7  8  8 1 and 10 and is backwards-compatible too  Windows nbsp XP doesn t have any UAC  thus elevation is not needed - in that case the script just proceeds    Check out this code  I was inspired by the code by NIronwolf posted in the thread Batch File -  Access Denied  On Windows 7    but I ve improved it - in my version there isn t any directory created and removed to check for administrator privileges                                                      Elevate cmd - Version 4    Automatically check  amp  get admin rights    see  https   stackoverflow com a 12264592 1016343  for description                                                echo off  CLS  ECHO   ECHO                                ECHO Running Admin shell  ECHO                                 init  setlocal DisableDelayedExpansion  set cmdInvoke 1  set winSysFolder System32  set  batchPath   0   for   k in   0  do set batchName    nk  set  vbsGetPrivileges  temp  OEgetPriv  batchName  vbs   setlocal EnableDelayedExpansion   checkPrivileges   NET FILE 1 gt NUL 2 gt NUL   if   errorlevel       0    goto gotPrivileges   else   goto getPrivileges     getPrivileges   if   1    ELEV   echo ELEV  amp  shift  1  amp  goto gotPrivileges    ECHO    ECHO                                          ECHO Invoking UAC for Privilege Escalation   ECHO                                           ECHO Set UAC   CreateObject   Shell Application     gt    vbsGetPrivileges     ECHO args    ELEV    gt  gt    vbsGetPrivileges     ECHO For Each strArg in WScript Arguments  gt  gt    vbsGetPrivileges     ECHO args   args   amp  strArg   amp        gt  gt    vbsGetPrivileges     ECHO Next  gt  gt    vbsGetPrivileges      if   cmdInvoke     1  goto InvokeCmd     ECHO UAC ShellExecute   batchPath    args       runas   1  gt  gt    vbsGetPrivileges     goto ExecElevation   InvokeCmd   ECHO args     c         batchPath             args  gt  gt    vbsGetPrivileges     ECHO UAC ShellExecute   SystemRoot   winSysFolder  cmd exe   args       runas   1  gt  gt    vbsGetPrivileges     ExecElevation    SystemRoot   winSysFolder  WScript exe    vbsGetPrivileges       exit  B   gotPrivileges  setlocal  amp  cd  d   dp0  if   1    ELEV   del   vbsGetPrivileges   1 gt nul 2 gt nul   amp   shift  1                                    START                                REM Run shell as admin  example  - put here code as you like  ECHO  batchName  Arguments  P1  1 P2  2 P3  3 P4  4 P5  5 P6  6 P7  7 P8  8 P9  9  cmd  k   The script takes advantage of the fact that NET FILE requires administrator privilege and returns errorlevel 1 if you don t have it  The elevation is achieved by creating a script which re-launches the batch file to obtain privileges  This causes Windows to present the UAC dialog and asks you for the administrator account and password   I have tested it with Windows nbsp 7  8  8 1  10 and with Windows nbsp XP - it works fine for all  The advantage is  after the start point you can place anything that requires system administrator privileges  for example  if you intend to re-install and re-run a Windows service for debugging purposes  assumed that mypackage msi is a service installer package    msiexec  passive  x mypackage msi msiexec  passive  i mypackage msi net start myservice   Without this privilege elevating script  UAC would ask you three times for your administrator user and password - now you re asked only once at the beginning  and only if required     If your script just needs to show an error message and exit if there aren t any administrator privileges instead of auto-elevating  this is even simpler  You can achieve this by adding the following at the beginning of your script    ECHO OFF  amp  CLS  amp  ECHO  NET FILE 1 gt NUL 2 gt NUL  amp  IF ERRORLEVEL 1  ECHO You must right-click and select  amp    ECHO  RUN AS ADMINISTRATOR   to run this batch  Exiting     amp  ECHO   amp    PAUSE  amp  EXIT  D  REM     proceed here with admin rights       This way  the user has to right-click and select  Run as administrator   The script will proceed after the REM statement if it detects administrator rights  otherwise exit with an error  If you don t require the PAUSE  just remove it  Important  NET FILE       EXIT  D  must be on the same line  It is displayed here in multiple lines for better readability     On some machines  I ve encountered issues  which are solved in the new version above already  One was due to different double quote handling  and the other issue was due to the fact that UAC was disabled  set to lowest level  on a Windows nbsp 7 machine  hence the script calls itself again and again   I have fixed this now by stripping the quotes in the path and re-adding them later  and I ve added an extra parameter which is added when the script re-launches with elevated rights   The double quotes are removed by the following  details are here    setlocal DisableDelayedExpansion set  batchPath   0  setlocal EnableDelayedExpansion   You can then access the path by using  batchPath   It doesn t contain any double quotes  so it is safe to say   batchPath   later in the script   The line  if   1    ELEV   shift  amp  goto gotPrivileges    checks if the script has already been called by the VBScript script to elevate rights  hence avoiding endless recursions  It removes the parameter using shift     Update     To avoid having to register the  vbs extension in Windows 10  I have replaced the line   temp  OEgetPrivileges vbs  by   SystemRoot  System32 WScript exe    temp  OEgetPrivileges vbs  in the script above  also added cd  d   dp0 as suggested by Stephen  separate answer  and by Tom     Zato  comment  to set script directory as default  Now the script honors command line parameters being passed to it  Thanks to jxmallet  TanisDLJ and Peter Mortensen for observations and inspirations  According to Artjom B  s hint  I analyzed it and have replaced SHIFT by SHIFT  1  which preserves the file name for the  0 parameter Added del   temp  OEgetPrivileges  batchName  vbs  to the  gotPrivileges section to clean up  as mlt suggested   Added  batchName  to avoid impact if you run different batches in parallel  Note that you need to use for to be able to take advantage of the advanced string functions  such as    nk  which extracts just the filename  Optimized script structure  improvements  added variable vbsGetPrivileges which is now referenced everywhere allowing to change the path or name of the file easily  only delete  vbs file if batch needed to be elevated  In some cases  a different calling syntax was required for elevation  If the script does not work  check the following parameters    set cmdInvoke 0    set winSysFolder System32   Either change the 1st parameter to set cmdInvoke 1 and check if that already fixes the issue  It will add cmd exe to the script performing the elevation   Or try to change the 2nd parameter to winSysFolder Sysnative  this might help  but is in most cases not required  on 64 bit systems   ADBailey has reported this    Sysnative  is only required for launching 64-bit applications from a 32-bit script host  e g  a Visual Studio build process  or script invocation from another 32-bit application   To make it more clear how the parameters are interpreted  I am displaying it now like P1 value1 P2 value2     P9 value9  This is especially useful if you need to enclose parameters like paths in double quotes  e g   C  Program Files   If you want to debug the VBS script  you can add the   X parameter to WScript exe as first parameter  as suggested here  it is described for CScript exe  but works for WScript exe too      Useful links    Meaning of special characters in batch file Quotes      Bang      Caret      Ampersand   amp    Other special characters

User · Answer

As jcoder and Matt mentioned  PowerShell made it easy  and it could even be embedded in the batch script without creating a new script   I modified Matt s script      Check privileges  net file 1 gt NUL 2 gt NUL if not   errorlevel       0        powershell Start-Process -FilePath   0  -ArgumentList   cd   -verb runas  gt NUL 2 gt  amp 1     exit  b       Change directory with passed argument  Processes started with     runas  start with forced C  Windows System32 workdir cd  d  1     Actual work

User · Answer

Try this    echo off CLS  init setlocal DisableDelayedExpansion set cmdInvoke 1 set winSysFolder System32 set  batchPath   0  for   k in   0  do set batchName    nk set  vbsGetPrivileges  temp  OEgetPriv  batchName  vbs  setlocal EnableDelayedExpansion  checkPrivileges NET FILE 1 gt NUL 2 gt NUL if   errorlevel       0    goto gotPrivileges   else   goto getPrivileges    getPrivileges if   1    ELEV   echo ELEV  amp  shift  1  amp  goto gotPrivileges  ECHO  ECHO Set UAC   CreateObject   Shell Application     gt    vbsGetPrivileges   ECHO args    ELEV    gt  gt    vbsGetPrivileges   ECHO For Each strArg in WScript Arguments  gt  gt    vbsGetPrivileges   ECHO args   args   amp  strArg   amp        gt  gt    vbsGetPrivileges   ECHO Next  gt  gt    vbsGetPrivileges   if   cmdInvoke     1  goto InvokeCmd  ECHO UAC ShellExecute   batchPath    args       runas   1  gt  gt    vbsGetPrivileges   goto ExecElevation  InvokeCmd ECHO args     c         batchPath             args  gt  gt    vbsGetPrivileges   ECHO UAC ShellExecute   SystemRoot   winSysFolder  cmd exe   args       runas   1  gt  gt    vbsGetPrivileges    ExecElevation   SystemRoot   winSysFolder  WScript exe    vbsGetPrivileges      exit  B  gotPrivileges setlocal  amp  cd  d   dp0 if   1    ELEV   del   vbsGetPrivileges   1 gt nul 2 gt nul   amp   shift  1  REM Run shell as admin  example  - put here code as you like ECHO  batchName  Arguments  P1  1 P2  2 P3  3 P4  4 P5  5 P6  6 P7  7 P8  8 P9  9 cmd  k   If you need information on that batch file  run the HTML JS CSS Snippet    x000D   x000D  document getElementsByTagName  data   0  innerHTML  ElevateBatch  version 4  release lt br gt Required Commands  lt ul gt  lt li gt CLS lt  li gt  lt li gt SETLOCAL lt  li gt  lt li gt SET lt  li gt  lt li gt FOR lt  li gt  lt li gt NET lt  li gt  lt li gt IF lt  li gt  lt li gt ECHO lt  li gt  lt li gt GOTO lt  li gt  lt li gt EXIT lt  li gt  lt li gt DEL lt  li gt  lt  ul gt It auto-elevates the system and if the user presses No  it just doesn t do anything  lt br gt This CANNOT be used to create an Elevated Explorer    x000D  data font-family arial text-decoration none  x000D   lt data gt  lt  data gt  x000D   x000D   x000D

User · Answer

If you don   t need to pass arguments through then here   s a compact UAC prompting script that   s a single line long  This does a similar thing as the elevation script in the top voted answer but doesn   t pass arguments through since there   s no foolproof way to do that that handles every possible combination of poison characters  net sess gt nul 2 gt  amp 1   echo CreateObject  quot Shell Application quot    ShellExecute quot   0 quot     quot RunAs quot  1 CreateObject  quot Scripting FileSystemObject quot    DeleteFile wsh ScriptFullName   gt  quot  temp    nx0 vbs quot  amp start wscript exe  quot  temp    nx0 vbs quot  amp exit   Place this just below the  echo off line in your batch script  Explanation The net sess gt nul 2 gt  amp 1 part is what checks for elevation  net sess is just shorthand for net session which is a command that returns an error code when the script doesn   t have elevated rights  I got this idea from this SO answer  Most of the answers here use net file instead though which works the same  The error level is then checked with the    operator  If the check succeeds then it creates and executes a WScript which re-runs the original batch file but with elevated rights before deleting itself   The WScript file is the best approach being fast and reliable  although it uses a temporary file  Here are some other variations and their dis advantages  PowerShell net sess gt nul 2 gt  amp 1   powershell saps   0 -Verb RunAs amp exit   Pros   Very short  No temporary files   Cons   Slow  PowerShell can be very slow to start up  Spews red text when the user declines the UAC prompt  The PowerShell command could be wrapped in a try  catch to prevent this though   Mshta WSH script net sess gt nul 2 gt  amp 1   start mshta exe vbscript code close Execute  quot CreateObject  quot  quot Shell Application quot  quot   ShellExecute quot  quot   0 quot  quot     quot  quot RunAs quot  quot  1 quot        amp exit   Pros   Fast  No temporary files   Cons   Not reliable  Some Windows 10 machines will block the script from running as Windows Defender intercepts it as a potential trojan

User · Answer

For some programs setting the super secret   COMPAT LAYER environment variable to RunAsInvoker will work Check this    set    COMPAT LAYER RunAsInvoker  start regedit exe   Though like this there will be no UAC prompting the user will continue without admin permissions

User · Answer

I recently needed a user-friendly approach and I came up with this  based on valuable insights from contributors here and elsewhere  Simply put this line at the top of your  bat script  Feedback welcome   pushd   dp0  amp  fltmc   find  quot   quot   amp  amp   powershell start    f0        -verb runas 2 gt nul  amp  amp  exit  b   Intrepretation    pushd   dp0 ensures a consistant working directory relative to this batch file  supports UNC paths fltmc a native windows command that outputs an error if run unelevated   find  quot   quot  makes the error prettier  and causes nothing to output when elevated  amp  amp    if we successfully got an error because we re not elevated  do this    powershell start invoke PowerShell and call the Start-Process cmdlet  start is an alias     f0  pass in the full path and name of this  bat file  Single quotes allow spaces in the path file name       pass in any and all arguments to this  bat file  Funky quoting and escape sequences probably won t work  but simple quoted strings should  The leading space is needed to prevent breaking things if no arguments are present -verb runas don t just start this process   RunAs Administrator  2 gt nul discard PowerShell s unsightly error output if the UAC prompt is canceled ignored   amp  amp  if we successfully invoked ourself with PowerShell  then     NOTE  in the event we don t obtain elevation  user cancels UAC   then  amp  amp  allows the  bat to continue running without elevation  such that any commands that require it will fail but others will work just fine  If you want the script to simply exit instead of running unelevated  make this a single ampersand   amp    exit  b  exits the initial  bat processing  because we don t need it anymore  we have a new elevated process currently running out  bat  Adding  b allows cmd exe to remain open if the  bat was started from the command line   it has no effect if the  bat was double-clicked

User · Answer

I do it this way   NET SESSION IF  ERRORLEVEL  NEQ 0 GOTO ELEVATE GOTO ADMINTASKS   ELEVATE CD  d   dp0 MSHTA  javascript  var shell   new ActiveXObject  shell application    shell ShellExecute    nx0            runas   1  close     EXIT   ADMINTASKS  Do whatever you need to do here  EXIT   This way it s simple and use only windows default commands  It s great if you need to redistribute you batch file   CD  d   dp0 Sets the current directory to the file s current directory  if it is not already  regardless of the drive the file is in  thanks to the  d option      nx0 Returns the current filename with extension  If you don t include the extension and there is an exe with the same name on the folder  it will call the exe    There are so many replies on this post I don t even know if my reply will be seen   Anyway  I find this way simpler than the other solutions proposed on the other answers  I hope it helps someone

[windows] How can I auto-elevate my batch file, so that it requests from UAC administrator rights if required?

Examples related to windows

Examples related to batch-file

Examples related to windows-10

Examples related to uac

Examples related to elevated-privileges