Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Windows Server 2016 / How to Run Windows File Explorer Elevated (as Administrator)?

April 16, 2021 Windows 10Windows Server 2016

How to Run Windows File Explorer Elevated (as Administrator)?

File Explorer always starts in Windows with least privileges. Even if you click on the executable file C:\Windows\explorer.exe and try to start it in the “Run as administrator” mode, the privilege elevation won’t occur. In this article we’ll look at a simple trick to run File Explorer with elevated permissions (as administrator).

Windows 10 explorer.exe run as administrator

You Don’t Have Permission to Access Folder, Click Continue to Permanently Get Access

When working with Windows File Explorer under an account that is added to the local administrators group (or even under the built-in Windows administrator), you often have to open system folders, user profiles or edit protected system files. When trying to open such directory/file in Windows Explorer in the current context, the UAC warning appears prompting to grant access and elevate privileges.

What it looks like: let’s try to open a system folder C:\Windows\System32\Config in File Explorer. User Account Control window appears to warn that you don’t currently have permission to access this folder:

You don’t currently have permission to access this folder.
Click Continue to permanently get access to this folder.

But you can get the access through the UAC privilege elevation by clicking Continue.

You don’t currently have permission to access this folder. Click Continue to permanently get access to this folder

When you click Continue, UAC temporarily elevates the privileges of your explorer.exe process and grants NTFS full control permissions to your account.

Known issues:

It’s ok, but if you do , your account will be explicitly added to the folder NTFS permissions. But all you want to do is to view the contents of the folder, and not to change its ACL! What if there are multiple administrators on the server? Then each of them will change the directory ACL when accessing the folder.

After the permissions have been changed, all programs running under your user account have Full Control rights on this folder (even if the program isn’t elevated) and even after your account is removed from the local Administrators group.

uac changed acl in ntfs folder permissions

This behavior of File Explorer creates problems when managing shared network folders on Windows Server. As a workaround, many Windows administrators prefer to manage shared folders over a UNC path (\\mun-fs01\docs\) instead of locally. In this case, you don’t need to elevate privileges when accessing the directory, and hence there are no changes to NTFS ACLs.

Naturally, when you often work with system files or user folders, this pop-up UAC notification becomes annoying. Since I don’t want to disable UAC, I had find the  way to start the Exploler.exe elevated.

How to Run File Explorer as Administrator on Windows 10 and Windows Server?

The Windows Explorer process starts when a user logs on with the standard user access token. You cannot elevate the Explorer.exe process in the standard way. Also you won’t be able to start the second explorer process in the “Run as admin” mode (this is blocked by the CreateExplorerShellUnelevatedTask task). Windows File Explorer doesn’t support running multiple instances of the explorer.exe process in different security contexts in an interactive user session. Therefore, you first need to end the current explorer.exe process in your user session.

You can kill the explorer.exe process from Task Manager or with the following command in the PowerShell console (be sure to run powershell.exe as an administrator):

taskkill /f /FI "USERNAME eq $env:UserName"/im explorer.exe

SUCCESS: The process "explorer.exe" with PID 3208 has been terminated.

In order to run the explorer.exe process as administrator, use the command:

c:\windows\explorer.exe /nouaccheck

explorer.exe /nouaccheck - run elevated

(NO|UAC|CHECK)

These commands will terminate the explorer.exe process for the current user and start a new one, which will inherit the elevated access token that powershell.exe is run with.

Or you can start a new privileged explorer process from Task Manager -> File -> Run New Task -> explorer.exe /nouaccheck (be sure to check the option “Create this task with administrative privileges”).

run explorer with administrative privileges nouaccheck

You can make sure that Windows Explorer is now running elevated in the Task Manager. Open the Task Manager and go to the Details tab. Right-click any column, click Select columns and enable Elevated column to be displayed.

add the elevated column in task manager

As you can see, explorer.exe is now having attribute Elevated=Yes.

elevated explorer.exe process

After that Explorer will be able to open any system folder without a UAC warning, and all child processes run from Windows Explorer will run elevated.

For example, it is convenient when you need to edit hosts file (c:\windows\system32\drivers\etc): you can open it right from Explorer using Notepad, with no need to start a separate notepad.exe process as administrator or different user.

If you often need to run explorer.exe in the elevated mode, you can create a *.bat or *.ps1 file with above commands on your desktop.

When you’re done, be sure to restart the explorer.exe in non-elevated mode:

taskkill /f /FI "USERNAME eq $env:UserName"/im explorer.exe
explorer.exe

As you can see, now the Elevated value for the explorer.exe process has changed to No.

not-elevated explorer process

This Windows Explorer elevation trick works on both Windows Server 2016/2019 and all Windows 10 builds.

On Windows Server 2012/R2 and Windows 8, in order to run the Explorer process elevated, you need to open cmd.exe as administrator and run the command:
tskill explorer & explorer

 tskill explorer & explorer

10 comments
7
Facebook Twitter Google + Pinterest
previous post
Using Malicious Software Removal Tool (MRT.exe) on Windows
next post
Shrinking VMDK Virtual Disk Size on VMWare ESXi

Related Reading

Configuring Event Viewer Log Size on Windows

May 24, 2023

How to Detect Who Changed the File/Folder NTFS...

May 24, 2023

Enable Single Sign-On (SSO) Authentication on RDS Windows...

May 23, 2023

Allow Non-admin Users RDP Access to Windows Server

May 22, 2023

How to Create, Change, and Remove Local Users...

May 17, 2023

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Configuring Event Viewer Log Size on Windows

    May 24, 2023
  • How to Detect Who Changed the File/Folder NTFS Permissions on Windows?

    May 24, 2023
  • Enable Single Sign-On (SSO) Authentication on RDS Windows Server

    May 23, 2023
  • Allow Non-admin Users RDP Access to Windows Server

    May 22, 2023
  • How to Create, Change, and Remove Local Users or Groups with PowerShell?

    May 17, 2023
  • Fix: BSOD Error 0x0000007B (INACCESSABLE_BOOT_DEVICE) on Windows

    May 16, 2023
  • View Success and Failed Local Logon Attempts on Windows

    May 2, 2023
  • Fix: “Something Went Wrong” Error When Installing Teams

    May 2, 2023
  • Querying Windows Event Logs with PowerShell

    May 2, 2023
  • Configure Windows LAPS (Local Administrator Passwords Solution) in AD

    April 25, 2023

Follow us

  • Facebook
  • Twitter
  • RSS
Popular Posts
  • How to Allow Multiple RDP Sessions in Windows 10 and 11?
  • How to Repair EFI/GPT Bootloader on Windows 10 or 11?
  • How to Restore Deleted EFI System Partition in Windows?
  • Network Computers are not Showing Up in Windows 10/11
  • Updating List of Trusted Root Certificates in Windows
  • How to Create a Wi-Fi Hotspot on your Windows PC?
  • How to Sign an Unsigned Device Driver in Windows?
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top