Running a CMD prompt as System (XP and Vista)
Posted by Jarvis on December 5, 2007
From time to time I have had a need to run a program in the context of the Local System account instead of my user account. Typically this is in troubleshooting a program…a program that runs as Local System. It doesn’t do me much good to troubleshoot that program if the program is running under my user account’s security context. I need it to run as System…which has more rights…most of the time. I have had to use this a few times while working with SMS 2003 and SCCM 2007. Both of them run as the local system account.
So…how do we do that? In XP, 2000, Server 2003…you can do this very simply. You will need to be logged in with an account that has administrator privileges. Open a command prompt (Start, Run, CMD). At the command prompt type the following line. Replace 01:23 with the current time in 24 hour format + one minute. i.e. if it is 3:42 in the afternoon, enter it as 15:43.
at 01:23 /interactive cmd.exe
This schedules a task to run cmd.exe at the time you specify. When the CMD prompt pops up, it will be running as Local System. Be very careful. Note: you will only see this if you are at the console of the computer…so if you are connected to a server via Remote Desktop, you will not see the prompt come up unless you are connected to the console. I’ve been bit by that more than once…today as a matter of fact.
Now…what about Vista? I was bummed to see that this did not work in Vista. Good for security…bummer for me. So tonight I set out to find a way to do this. Cool thing is that the answer was actually pretty easy…and can be found on Microsoft’s site. Download PSTools from SysInternals. Microsoft bought SysInternals in 2006. Extract the files. You will use the file named PSexec.exe.
You still need a CMD prompt, but there’s an extra step… You will need to find the shortcut to the CMD prompt (Start, type CMD in the search box and wait for it to locate it…should be pretty fast). Once it locates it, right click it and choose to “Run as administrator”. (Do this even if your user account is an admin.) Once this opens, change directory til you get to the folder that contains PSexec (unless psexec is in a folder in your PATH already). This is where the magic happens…type the following line. (-i is for interactive, -s is to run as system)
psexec -i -s cmd.exe
The command prompt will look like:
Once you hit enter, another command prompt will open that will be running as the system account (NT Authority\System).
NOTE: you can use these instructions to run any program as System. If you had a dire need to run Calculator or Solitaire as Local System…you could do that…just replace cmd.exe with the executable file for the program you want to run. I will also say again…be careful. Don’t do this unless you really need to…and unless you are prepared to take responsibility for anything you might mess up by doing so!
Have fun! Actually…who am I kidding? This isn’t meant to be fun…it’s meant to be useful. Now…go get some work done. ;-)
March 13, 2008 at 5:36 am
Hi Jarvis, good post and thanks for publishing the howto. I used this interactive cmd.exe before and know how it works but forgot the syntex. Still it does not work, maybe something with the sms server. Thanks for the psexec also ;-)
I like your site and will put it on my blogroles/links. Cheers Ivan
March 30, 2008 at 9:55 am
Very useful article - a must try for school :)
March 30, 2008 at 1:20 pm
Callum -
I saw that you are 14 years old. If you try it at school…I strongly encourage you not to do anything that would get you in trouble!
May 21, 2008 at 9:57 am
jarvis, stfu, ok?
May 21, 2008 at 10:14 am
Well…that was a mature and helpful comment [sarcasm].
June 24, 2008 at 9:42 am
THANK YOU!!!
I’ve found an article about using service to gain SYSTEM rights, but it was too difficult to prepare and run.
“psexec -i -s exe” is really better and noble way how to do it. ;)
June 24, 2008 at 3:22 pm
Glad it was helpful to you. I had seen the way to do it by installing a service and had the same impression you did…way to difficult for a simple process. Took me more time to get the service installed and to later uninstall it than it did for me to actually do the small thing I needed to do as SYSTEM.