Process Explorer course

Run Process Explorer as Administrator

Learn how to run Process Explorer with administrative elevation, understand UAC and RunAs, verify elevated access, and troubleshoot remaining access restrictions.

Process Explorer is a Windows process-inspection and troubleshooting utility. It can run under a standard user account, but starting it with an elevated administrative token usually provides more complete process information and more management capabilities.

Elevation means starting an application with an administrative access token. An Administrator account or security context has permissions beyond those normally granted to a standard user. Elevation improves access, but it does not bypass every Windows security boundary.

Why Process Explorer May Need Elevation

Windows isolates processes with security boundaries. A non-elevated Process Explorer instance may be unable to open another process with the access rights needed to read its properties, handles, modules, threads, security information, or performance data.

Processes owned by another user, services running under service accounts, processes in another logon session, and system-level components are especially likely to expose limited information. A logon session is a user's Windows session and its associated security context.

Running without elevation does not necessarily prevent Process Explorer from displaying a process. It may show the process in the list while withholding selected details or management operations. This is different from a process being absent altogether.

What Changes Without Administrator Rights?

In a non-elevated instance, some process metadata may be incomplete. Handles, loaded modules, security properties, command-line details, token information, or other process properties may be unavailable. Management actions such as changing certain properties, suspending a process, terminating it, or inspecting protected resources may also be restricted.

An unavailable value can appear blank, incomplete, or accompanied by an Access denied indication. Access denied is a permissions result stating that Process Explorer cannot read or operate on the requested resource.

Launch context — Visible process information — Access to other-user or service processes — Typical limitations — When to use it

Standard user, not elevated — Usually enough for the user's own processes and general process browsing — Often limited — Blank fields, unavailable handles or modules, restricted properties, and blocked management actions — Routine observation when protected details are not needed

Administrator, elevated — More complete metadata and diagnostic information — Improved access — Some operations and protected details can still be blocked — Administrative troubleshooting and system-wide inspection

Elevated but subject to protection — Depends on the operating system and security product — May remain restricted — Protected-process limitations, policy restrictions, or security software blocks — Use approved diagnostic procedures rather than forcing access

Run Process Explorer as Administrator on Modern Windows

  1. Close the currently open non-elevated Process Explorer instance if you need to replace it.
  2. Locate the correct Process Explorer executable or its shortcut. Use the executable appropriate for the Windows platform and the Process Explorer package you installed.
  3. Open the executable's or shortcut's context menu.
  4. Choose Run as administrator.
  5. Read the User Account Control (UAC) prompt. UAC is Windows' consent and credential mechanism for starting an application with elevated rights.
  6. Choose the approval option if you are authorized. If Windows requests credentials, enter the approved administrator account and password.
  7. Wait for the new Process Explorer window to open. The existing non-elevated window does not acquire new rights simply because another elevated copy was started.

If Process Explorer is pinned, stored in a shortcut, or launched from another management tool, verify that the shortcut points to the intended executable. Starting the wrong copy can make it appear that elevation did not work.

Using an Administrator Account from a Standard User Account

A standard user may need an administrator account to inspect a service-owned process, investigate another user's process, or perform a system-wide diagnostic task. Use the Windows elevation prompt and provide credentials only when authorized by the device owner or organization.

Administrator credentials grant broad control. Enter them only into the legitimate Windows credential prompt, confirm that you launched the expected executable, avoid sharing the credentials, and close the elevated utility when the task is complete. Organization-managed computers may restrict elevation, prohibit credential use by standard users, or require an approved support procedure.

Legacy Windows XP and Windows Server 2003

Windows XP and Windows Server 2003 do not use the later UAC Run as administrator workflow. To access most protected Process Explorer capabilities, launch the tool under an account with full local Administrator permissions.

The legacy RunAs command launches a program under different credentials. A generic command pattern is:

runas /user:COMPUTERNAME\Administrator "C:\Path\To\procexp.exe"

Replace the computer name, account name, and executable path with values appropriate to the system. The command prompts for the specified account's password. Local, domain, and managed account naming rules can vary, and RunAs behavior may be restricted by the environment.

How to Confirm the Privilege Level

Compare the same process before and after relaunching Process Explorer. If elevation resolved the issue, details that were blank or marked access denied may become available. Service-owned processes, processes belonging to another user, and system-wide process information are useful comparison targets.

Depending on the installed Process Explorer version, you may also inspect Process Explorer's own process information. Select its process and open its process properties, then look for security or integrity information. An elevated instance commonly reports a higher integrity level or an administrative token. If the version exposes token details, those details can help confirm the security context.

For related security information, see Process Properties, Security Tab, and View Integrity Levels.

Elevation Methods by Windows Generation

Windows environment — Recommended method — Credential behavior — Notes and limitations

Modern Windows — Context menu, then Run as administrator — UAC requests consent or administrator credentials — Elevation improves access but does not defeat protected-process or policy restrictions

Windows XP or Windows Server 2003 — Launch under an Administrator account, commonly with RunAs — RunAs prompts for the specified account password — These systems do not provide the later UAC workflow

Managed organization device — Follow the organization's approved elevation process — Credentials or consent may be controlled by policy — Local administrators may still be restricted by security tools or administrative policy

Scope and Limitations of Elevation

Administrator rights improve access; they do not guarantee unrestricted access to every process. Modern Windows protections, endpoint security software, organizational policy, and protected-process mechanisms can still block inspection or control.

A protected process is subject to additional operating-system or security-product restrictions. Even an elevated administrator may be unable to read selected memory, open certain handles, view all modules, or terminate the process. Treat persistent access-denied results as evidence of a remaining security boundary rather than proof that elevation failed.

Elevation also does not mean that every system component may be altered safely. Use the least privilege needed for the task and avoid changing process state unless you understand the consequences.

Safety and Operational Guidance

  • Review the target process name, path, owner, and parent process before taking action.
  • Be especially cautious with system processes, security software, service processes, and processes running under another account.
  • Remember that an elevated utility can perform impactful actions, including process termination and other management operations.
  • Use elevation only for tasks that require it.
  • Close the elevated Process Explorer window when troubleshooting is complete.

For process termination and other state-changing operations, review Process Actions and Kill a Process before acting.

Using Elevation in Later Process Explorer Tasks

Elevation is often a prerequisite for viewing processes across logon sessions, inspecting process properties, and reading protected information. It can also improve process-tree analysis when parent and child processes belong to different users or services.

Column customization may expose fields whose values remain unavailable when permissions are insufficient. Adding a column does not grant permission to read its value; the result may still be blank or access denied. See Display Options for display customization and Default Procexp Tree View for process-tree workflows.

For deeper inspection after elevation, continue with Process Properties, Dll View, or Threads Tab.

Troubleshooting Elevation Problems

Fields Are Blank or Show Access Denied

Close Process Explorer, relaunch it as administrator, and check the same fields again. The target may belong to another user, a service account, or another logon session. If access remains denied, the target may be protected or restricted by policy or security software.

The Run as Administrator Option Is Unavailable or Rejected

Possible causes include a lack of authorization, an organization-managed elevation policy, or launching the executable from a restricted location or context. Verify that you are using the intended executable and follow the local IT procedure. Do not attempt to bypass a policy by using unapproved credentials or tools.

Access Is Still Denied After Elevation

Confirm the process identity and review applicable endpoint-security or organizational restrictions. Protected-process mechanisms can continue to block inspection or control. Do not repeatedly force actions against the process; use an approved administrative diagnostic method instead.

An Existing Window Did Not Become Elevated

Privilege level is not retroactively added to a running standard-token instance. Exit the existing copy and start a new one through the appropriate elevation method.

Summary

  • Process Explorer works without elevation, but visibility and process-management capabilities may be reduced.
  • Use Run as administrator on modern Windows and approve the UAC prompt or provide authorized administrator credentials.
  • Use an Administrator account and the legacy RunAs command pattern on Windows XP and Windows Server 2003.
  • Verify the new instance by checking previously restricted details or inspecting its security and integrity information when available.
  • Elevation improves access but does not override protected processes, endpoint security, or organizational policy.

For the wider learning path, see the Process Explorer Course.