How to Open a Command Prompt Under the Context of the Local System Account
I often find myself needing to run an application, particularly the command prompt, under the context of the local system account. By default, under Windows Vista, when you launch cmd.exe, the command prompt is opened under the context of your current user account. If you right click cmd.exe and select the option to Run as administrator, the command prompt will still be opened under your current account, but with full administrative rights. However, there are certain actions that you cannot complete from a command prompt, even when executed as an administrator. For example, there are registry keys and files that are only accessible to the local system account.
It is possible to work around this limitation by launching a command prompt using psexec.exe. This is a powerful application written by Mark Russinovich, and provided by Microsoft as part of the System Internals suite of command line tools. It can be used to execute commands on remote systems, but it can also be used to launch a process under the context of another user.
After downloading psexec.exe, copy it C:\Windows\system32. Now open a command prompt as an administrator and run the following command:
psexec.exe -i -s cmd.exe
The -i parameter tells psexec.exe to open an interactive session, and the -s parameter requests that the session be opened as the local system account. The final parameter, in this case cmd.exe, is the program to be launched. You can replace cmd.exe with any other program of your choosing. For example, using iexplore.exe will cause Internet Explorer to be launched under the local system account.
You can confirm that the command prompt is indeed opened as the local system account by typing:
ECHO %USERNAME%
Instead of your own username, as returned under a normal command prompt, if you see the name of your computer with a suffix of $, you can be confident that you are running with the privileges of the system account. And any application you launch from the command prompt with also run with these elevated privileges.