Is there a way to boot as System user?

Discussion in 'Windows 11' started by ibay770, Jun 22, 2023.

  1. ibay770

    ibay770 MDL Member

    Oct 9, 2015
    173
    45
    10
    I've noticed different WInPEs somehow do this and give you more permissions then admins. If someone know the secret sauce, that would be greatly appreciated.
     
  2. Dark Dinosaur

    Dark Dinosaur X Æ A-12

    Feb 2, 2011
    4,161
    5,975
    150
    > different WInPE
    which one ... name some
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. zbigniew59

    zbigniew59 MDL Senior Member

    May 14, 2016
    373
    171
    10
    What is this question about?
    After all, Win PE bootable from a pendrive - or otherwise - allows for almost all operations on other drives - including the system one?
    Or I don't understand what's going on?
     
  4. acer-5100

    acer-5100 MDL Guru

    Dec 8, 2018
    4,003
    2,923
    150
    I think the question is how to do the same in a windows installation.

    @ibay770

    Never played with that, but likely you have to play with secpol.msc and users right and/or the settings in

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
     
  5. richwood

    richwood MDL Novice

    Nov 16, 2013
    39
    29
    0
    Just use the AdvancedRun tool from Nirsoft and then run as a System user for each app you need System privileges for.

    upload_2023-6-26_17-27-5.png
     
  6. ibay770

    ibay770 MDL Member

    Oct 9, 2015
    173
    45
    10
  7. ibay770

    ibay770 MDL Member

    Oct 9, 2015
    173
    45
    10
    I don't want an app, I want the whole thing. When you boot in Audit mode, everything is running in system/ntauthority privileges. I'd like to do the same with a regular install.
     
  8. chillgates

    chillgates MDL Senior Member

    Dec 15, 2010
    391
    221
    10
    activate admin user and login to it and delete your previous user from there. from now you have only admin user in windows. don't know if it works on latest windows but i tried it long back on 10
     
  9. ibay770

    ibay770 MDL Member

    Oct 9, 2015
    173
    45
    10
    That is the administration user, I'm looking for system.
     
  10. pm67310

    pm67310 MDL Guru

    Sep 6, 2011
    3,350
    2,523
    120
    for why ?

    standard admin user are safe !

    for run as system you need powerrun or nsudo or others tools , login as system with full acces are XP era and not recommanded

    the best account are enable hidden super administrator ( but very bad idea )
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. verndog

    verndog MDL Member

    May 3, 2010
    220
    96
    10
    Funny how these comments go. OP is not asking for your opinion, he's looking for an answer.
    @acer gave an answer, apparently it doesn't work.
     
  12. EXO56

    EXO56 MDL Member

    Mar 22, 2013
    197
    286
    10
    By default, WinPE is always booting as SYSTEM, which actually has more privileges than ADMINISTRATOR account (the latter is commonly used only to run TeamViewer)

    With WinPE running as SYSTEM, you can perform any operation, except modifying some protected registry entries.
    And this is fair enough for most WinPE users.

    Some securable objects may grant access to SYSTEM only and not to ADMINISTRATOR.
    ADMINISTRATOR is an actual account (for example, it has a password, which is commonly "1") whereas SYSTEM is not.
    SYSTEM is a kind of "security principal" with more privileges.

    What you're talking about are the TRUSTEDINSTALLER privileges.

    As far as i know, only the Win10XPE project has the ability to generate WinPE with TRUSTEDINSTALLER privileges (which is also displayed as SYSTEM account).
    It can natively bypass any permissions restriction. (Not documented. Try your luck on theoven.org)

    For other "regular" PE's, you can achieve this only with 3rd-party programs (ex: Nsudo, PowerRun, AdvancedRun,...)
    This non-persistent solution is very acceptable for such "rare" need.

    You mentioned Sergei Strelec PE as an example.
    It never came to my mind to verify if it's booting as SYSTEM, or as TRUSTEDINSTALLER which is, again, showing itself as SYSTEM too!
    (He said once that he is occasionally using theoven.org projects, so maybe this is the case here)

    WinPE privileges summary:
    1/ TRUSTEDINSTALLER: No restrictions. (displayed as SYSTEM too)
    2/ SYSTEM: No restrictions. (except modifying some protected registry entries)
    3/ ADMINISTRATOR: Less privileges than SYSTEM but needed when admin password is required (ex: TeamViewer)