UAC Auto-Elevation

Maintained on October 16, 2026

Have you ever run into an “Access is denied” error when trying to perform an operation that requires administrator privileges, such as changing system settings or controlling services, from a batch file? Normally you have to right-click the batch file and choose “Run as administrator.” However, asking users to do this every time is a hassle.

This article explains how to have a batch file automatically check whether it is running with administrator privileges and, if it is not, display the UAC (User Account Control) dialog and elevate itself.

Checking Whether You Are Running as Administrator

To implement auto-elevation, you first need to determine whether the current process is running with administrator privileges. The common way to do this is with the net session command.

net session is a command that is denied access without administrator privileges. Run it while discarding its output, and judge the result by ERRORLEVEL.

net session >nul 2>&1

Situation	ERRORLEVEL
Has administrator privileges	`0`
No administrator privileges	Non-zero (usually `2`)

net session >nul 2>&1
if %errorlevel% equ 0 (
    echo Running with administrator privileges.
) else (
    echo No administrator privileges.
)

About net session

net session is a command that displays network session information, but it cannot be run without administrator privileges, and that property is used here for the privilege check. It is a simple and widely used technique.

When net session cannot be used

net session depends on the Server service (LanmanServer). If this service is stopped, the command fails even with administrator privileges, and you are incorrectly judged to have no privileges. In that case, you can use fltmc >nul 2>&1 instead. fltmc also fails without administrator privileges and does not depend on the Server service.

UAC Auto-Elevation with PowerShell

If it is determined that you do not have administrator privileges, use the PowerShell Start-Process cmdlet to restart the batch file itself with administrator privileges.

Basic Pattern

@echo off
net session >nul 2>&1
if %errorlevel% neq 0 (
    powershell -Command "Start-Process '%~f0' -Verb RunAs"
    exit /b
)

rem Processing from here runs with administrator privileges
cd /d "%~dp0"
echo Running with administrator privileges.
pause

Here is the role of each part.

Code	Description
`net session >nul 2>&1`	Checks whether you have administrator privileges
`if %errorlevel% neq 0`	Runs the elevation process if you lack privileges
`Start-Process '%~f0'`	Launches this batch file itself by its full path
`-Verb RunAs`	Runs as administrator (displays the UAC dialog)
`exit /b`	Ends the original (unprivileged) process
`cd /d "%~dp0"`	Returns the current directory to the batch file’s location

What is %~f0

%~f0 is a special variable that means “the full path of this batch file itself.” If the batch file is placed at C:\tools\setup.cmd, it expands to C:\tools\setup.cmd. This lets the file restart itself correctly wherever it is placed.

Here is a summary of the flow.

Check for administrator privileges with net session
If you lack privileges, launch the file itself as administrator via PowerShell
The UAC dialog appears, and when the user clicks “Yes,” a new window opens
The original window is closed with exit /b
The new window has administrator privileges, so the remaining processing runs

Watch the current directory after elevation

The elevated process generally starts with C:\Windows\System32 as its current directory, not the original location. If you reference files in the same folder as the batch file by relative path, move there after elevation with cd /d "%~dp0" (%~dp0 is the folder containing the batch file).

Preserving Arguments When Elevating

If you use a batch file with arguments, they are lost when you elevate as is. Use the -ArgumentList option to carry over the original arguments.

@echo off
net session >nul 2>&1
if %errorlevel% neq 0 (
    powershell -Command "Start-Process '%~f0' -ArgumentList '%*' -Verb RunAs"
    exit /b
)

rem Processing that uses the arguments
cd /d "%~dp0"
echo Running with administrator privileges.
echo Arguments: %*
pause

%* expands to all arguments passed to the batch file. For example, if you run setup.cmd install verbose, %* becomes install verbose.

When arguments contain special characters

-ArgumentList '%*' passes the arguments as a single string exactly as entered. Therefore, if an argument contains a single quote ('), the PowerShell syntax breaks. If it contains a double quote (") or &, |, ^, the outer powershell -Command "..." breaks at the cmd stage. The same applies if the path in %~f0 contains these characters. Also, running without arguments makes -ArgumentList an empty string, which can make Start-Process fail. If you need to handle such input, consider moving to a PowerShell script.

Practical Example: Changing a Service’s Startup Type

Changing Windows service settings requires administrator privileges. Here is a practical example combined with the auto-elevation mechanism.

@echo off
setlocal

rem UAC auto-elevation check
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo Administrator privileges are required. Displaying the UAC dialog...
    timeout /t 2 >nul
    powershell -Command "Start-Process '%~f0' -ArgumentList '%*' -Verb RunAs"
    exit /b
)

rem Processing from here runs with administrator privileges
cd /d "%~dp0"
set SERVICE_NAME=%1
if "%SERVICE_NAME%"=="" set SERVICE_NAME=wuauserv

echo ================================
echo  Service Management Tool (Admin)
echo ================================
echo Target service: %SERVICE_NAME%
echo.

sc query %SERVICE_NAME% | findstr /i "STATE"
echo.

echo Changing the service to manual start...
sc config %SERVICE_NAME% start= demand
if %errorlevel% equ 0 (
    echo Settings changed.
) else (
    echo An error occurred. Check the service name.
)

echo.
pause
endlocal

－ □ ×

Administrator: Administrator: Command Prompt

Microsoft Windows [Version xx.x.xxxxx.xxx]

C:\users\user>service-manager.cmd wuauserv

Show a message before elevating

Inserting timeout /t 2 >nul before elevation gives the user time to read the “Administrator privileges are required” message. A UAC dialog that appears suddenly can be startling, so it is considerate to add a short note.

Notes

The UAC dialog always requires user confirmation

The UAC elevation dialog always requires confirmation from the user (clicking the “Yes” button). A script cannot skip the dialog automatically. If the user clicks “No,” elevation does not occur and the process ends.

Notes for enterprise environments

In environments where UAC is disabled or elevation behavior is controlled by Group Policy, this script may not work as intended. Also, in environments where UAC is disabled, users in the Administrators group always run in an already-elevated state, so no elevation dialog is displayed (and net session also succeeds).

Be aware of the power of administrator privileges

A batch file that runs with administrator privileges can change important system settings and files. If a batch file obtained from an untrusted source has an auto-elevation mechanism built in, review its contents thoroughly before running it.

Summary

Item	Details
Checking for administrator privileges	`net session >nul 2>&1`
Deciding whether to elevate	`if %errorlevel% neq 0`
Running UAC elevation	`powershell -Command "Start-Process '%~f0' -Verb RunAs"`
Carrying over arguments	Add `-ArgumentList '%*'`
Ending the original process	Close the original window after elevation with `exit /b`