CODEWITHSUNDEEP
batch-filecmduac
Rishabh Bhargav
Rishabh Bhargav

Reputation: 45

To bypass the UAC in cmd.exe

My query is basically to bypass the "Admin Command Prompt" UAC.

What i am trying to do is to open a "Admin Command Prompt" but every time when i open it pop up UAC, which i want to ignore, i want when i run the "Admin Command Prompt" it will automatically open as Admin without any UAC Pop-up

Is there any way i can do that?

I am thinking to create a batch file which runs and open cmd.exe and pass the UAC pop-up, but i am not sure how to create the same

Tag: "Admin Command Prompt" : It is basically when we right click on cmd.exe and use "Run As Administrator"

Upvotes: 1

Views: 6746

Answers (2)

Mike Nakis
Mike Nakis

Reputation: 62130

Of course you can bypass the UAC.

Even if Windows was a secure operating system, there are legitimate ways to create a command which will run with elevated privileges if you can gain elevated privileges just once, to create that command.

There is another question on Stack Overflow which is not asking how to bypass UAC, it is simply asking how to open an elevated command prompt from the command line, taking it for granted that Windows will open a UAC prompt to allow that. Most answers to that question answer exactly that, but a couple of answers go the extra mile and offer solutions that can achieve this without even a UAC prompt.

Here is one answer

by user john v kumpf

Short answer: you can while elevated create a scheduled task with elevated privileges which you can then invoke later while not elevated.

Middle-length answer: while elevated create task with (but I prefer task scheduler GUI):

schtasks /create /sc once /tn cmd_elev /tr cmd /rl highest /st 00:00

Then later, no elevation needed, invoke with

schtasks /run /tn cmd_elev

Long answer: There's a lot of fidgety details; see my blog entry "Start program WITHOUT UAC, useful at system start and in batch files (use task scheduler)"

Here is another answer

by user Stefan Gadecki

Make the batch file save the credentials of the actual administrator account by using the /savecred switch. This will prompt for credentials the first time and then store the encrypted password in credential manager. Then for all subsequent times the batch runs it will run as the full admin but not prompt for credentials because they are stored encrypted in credential manager and the end user is unable to get the password. The following should open an elevated CMD with full administrator privileges and will only prompt for password the first time:

START c:\Windows\System32\runas.exe /user:Administrator /savecred cmd.exe

It goes without saying that if you have a batch file in your system that can run with elevated privileges by any user without a UAC prompt, this is a major security hole in your system. Use carefully.

Upvotes: 0

Ian Boyd
Ian Boyd

Reputation: 257029

You can't bypass. If the user is a standard user, you have no way to arbitrarily decide to just become an administrator.

Windows is a secure operating system, and has the notion of standard users and administrators. The fact that you're a standard user is your own choice.

You're perfectly free to ask the computer administrator to make you an administrator - but it's a really, really, terrible idea.

Upvotes: 1

Related Questions