Enable AlwaysInstallElevated in Windows via Regedit

This guide explains how to configure the Windows Installer service to run with elevated privileges using the Windows Registry Editor (regedit). Enabling the AlwaysInstallElevated policy allows standard users to install applications with system-level permissions, which can be useful in specific controlled enterprise environments but introduces significant security risks if not managed carefully.

Understanding the AlwaysInstallElevated Policy

The AlwaysInstallElevated policy instructs the Windows Installer service to execute installations with elevated (NT AUTHORITY\SYSTEM) privileges. To function, this policy must be enabled in both the machine-level and user-level registry hives.

Security Warning: Microsoft strongly advises against enabling this setting in production or multi-user environments. When active, any standard user can execute .msi packages with full administrative rights, potentially creating a significant privilege escalation vulnerability.

Step-by-Step Configuration Using Regedit

To enable elevated installations via the Registry Editor, follow these steps:

Step 1: Open the Registry Editor

  1. Press Win + R to open the Run dialog.
  2. Type regedit and press Enter (or click OK).
  3. If prompted by User Account Control (UAC), click Yes to grant administrative access.

Step 2: Configure the Machine Policy (HKLM)

  1. Navigate to the following path:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer

    Note: If the Installer key does not exist under Windows, right-click Windows, select New > Key, and name it Installer.

  2. In the right pane, right-click an empty area and select New > DWORD (32-bit) Value.

  3. Name the new value:

    AlwaysInstallElevated

  4. Double-click AlwaysInstallElevated, set the Value data to 1, and ensure the base is set to Hexadecimal.

  5. Click OK.

Step 3: Configure the User Policy (HKCU)

  1. Navigate to the user-specific path:

    HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Installer

    Note: If the Installer key does not exist under Windows, right-click Windows, select New > Key, and name it Installer.

  2. In the right pane, right-click an empty area and select New > DWORD (32-bit) Value.

  3. Name the value:

    AlwaysInstallElevated

  4. Double-click AlwaysInstallElevated, set the Value data to 1, and click OK.

Disabling the Policy

To revert the changes and restore default security behavior: 1. Navigate to both registry paths listed above. 2. Either change the Value data of AlwaysInstallElevated from 1 to 0, or right-click the AlwaysInstallElevated value and select Delete.