Launch New Processes with Process Explorer

Learn how to launch programs from Process Explorer normally, as an administrator, or as a limited user, then verify each process security context.

Why launch a process from Process Explorer?

Process Explorer is a Microsoft Sysinternals utility for viewing, inspecting, and managing Windows processes. A process is a running instance of an executable program. Although Process Explorer is commonly used to inspect processes that are already running, it can also create a new process.

Launching an application from Process Explorer is useful when you want to:

Test whether an application works under the current account permissions.
Open a diagnostic or troubleshooting utility.
Choose deliberately between normal, elevated, and reduced-rights execution.
Check whether software follows the least-privilege principle: granting only the permissions needed for a task.

The launch mode affects the new program's security context. This context includes the user identity, permissions, integrity level, and other security attributes used when the process runs.

Prerequisites and terminology

You should understand basic Windows desktop navigation, executable programs, standard-user and administrator permissions, and User Account Control (UAC) prompts.

Elevation means running a process with administrative privileges through Windows User Account Control.
User Account Control (UAC) is Windows protection that requests consent or credentials before granting elevated administrative rights.
An administrator is an account or elevated token that can perform protected system-wide actions.
A limited user execution context gives a program reduced rights so that it cannot freely make protected changes.
Access denied means that the current process lacks permission to access a resource or perform an action.

Find the process-launch controls

Open Process Explorer under the account and general privilege level you want to test. The process-launch actions are in the File menu:

File menu > Run, Run as Administrator, or Run as Limited User

The general workflow is the same for each option:

Open the File menu.
Choose the required launch mode.
Select an executable or enter the path to the program you want to start.
Supply any requested arguments, if applicable.
Confirm the launch.

Menu names and shortcut availability can vary slightly between Process Explorer versions. The File menu is the reliable way to find the actions.

Launch with the current Process Explorer context

Choose File > Run to start an executable using the same user context under which Process Explorer is currently running. This is the normal launch option; it does not independently request administrator elevation.

If Process Explorer was opened normally, the new program normally runs with the corresponding standard context. If Process Explorer was opened elevated, the launched program can inherit that elevated context. Therefore, “normal” describes the relationship to Process Explorer, not a guarantee that the new program is non-administrative.

Example: launch a routine diagnostic tool

Open Process Explorer under the intended user account.
Select File > Run.
Start a non-administrative tool such as Notepad.
Find the new process in the Process Explorer process tree.
Inspect its properties and security details to confirm the expected user context.

The learning point is that a normal launch inherits the relevant context of Process Explorer.

Launch as Administrator

Choose File > Run as Administrator when the target task legitimately requires administrative privileges. This option attempts to start the target process with an elevated administrator token.

If Process Explorer is not already elevated, Windows may display a UAC consent prompt. Depending on the current account and Windows policy, an authorized administrator may need to approve the prompt, or Windows may request administrator credentials. If approval is refused, the target process is not elevated.

Use elevation only when necessary. An elevated program can change protected system settings, access more sensitive resources, and affect other users. Running an ordinary application as administrator increases the impact of a mistake or security vulnerability.

Example: launch an administrative management tool

Open the File menu and choose Run as Administrator.
Respond to the UAC prompt with consent or authorized administrator credentials when required.
Start a management or diagnostic tool that genuinely needs administrative access.
Locate the new process and inspect its security information.
Confirm that its elevated status matches the task requirement.

Launch as a Limited User

Choose File > Run as Limited User to start the target program with reduced privileges. This is useful for safely opening untrusted content, checking how software behaves without administrative access, and validating least-privilege operation.

A limited process may be unable to modify protected system locations, change system-wide settings, install services, or access resources that require higher rights. These restrictions are expected results of the test, not automatically evidence that the application is defective.

Reduced rights do not guarantee complete isolation or provide the same protection as a dedicated sandbox or virtual machine. Continue to treat untrusted files and applications cautiously.

Example: test an application with reduced rights

Choose File > Run as Limited User.
Start a test application or browser.
Attempt a harmless action that normally requires access to a protected location or setting.
Observe whether Windows reports Access denied or otherwise blocks the action.
Use Process Explorer to inspect the resulting process and record the behavior.

The learning point is that reduced-rights execution helps test least-privilege behavior and limits the program's ability to make protected changes.

Process Explorer launch options compared

File menu option	Resulting privilege context	UAC or credential behavior	Best use cases	Common limitations or risks
Run	Uses the context of the currently running Process Explorer instance.	Does not independently request elevation.	Routine tools, account-permission testing, and ordinary user work.	May be elevated if Process Explorer itself is elevated.
Run as Administrator	Requests an elevated administrator context.	UAC consent or administrator credentials may be required.	Protected management, repair, and diagnostic tasks.	Greater impact from mistakes; unnecessary elevation increases risk.
Run as Limited User	Starts the target with reduced privileges.	Usually intended to avoid granting higher rights.	Untrusted-content testing and least-privilege validation.	Protected settings, folders, and resources may return Access denied.

Choose the appropriate launch mode

Use the lowest privilege level that supports the task. The following outcomes are typical, although application-specific behavior and Windows policy can change the result.

Example task	Normal launch	Administrator launch	Limited-user launch	Reason
Open a user document	Usually succeeds.	Usually succeeds, with unnecessary extra rights.	Usually succeeds if the file is accessible.	User documents generally do not require administrative access.
Modify a protected system setting	May be blocked.	Usually permitted if policy allows it.	Expected to be blocked.	Protected settings require an appropriate elevated token.
Write to a protected system location	Usually blocked.	May succeed when the operation is authorized.	Expected to be blocked.	The location applies access controls that exclude reduced-rights processes.
Test whether an application works without elevated rights	Useful if Process Explorer is running normally.	Not suitable because it can hide permission problems.	Best match for an explicit reduced-rights test.	The launch context determines whether the test reflects least-privilege operation.

Verify the launched process

After confirming the launch, look for the new executable in the Process Explorer process tree. It may appear as a child of the launching application or under another expected parent. Some programs start a short-lived launcher and then create a separate child process.

Refresh the view if necessary and locate the executable by name.
Check the process tree position and executable path.
Open the process properties and review the security-related information, including the user and integrity details where available.
Compare the observed context with the option you selected.
When the test is complete, close the application normally. If it does not close and it is safe to do so, terminate it using an appropriate process-management action.

For related inspection steps, see Process Properties, the Security tab, and viewing integrity levels.

Keyboard shortcut

In versions that provide it, Ctrl+R opens the new-process action corresponding to File > Run. Shortcut availability or behavior can differ by Process Explorer version and configuration, and the shortcut does not replace choosing a specific elevated or limited launch mode. Use the File menu when the shortcut is unavailable or when you need to select the exact security context.

For a broader shortcut reference, see Process Explorer keyboard shortcuts.

Troubleshooting

The administrator option prompts for approval or credentials

Process Explorer is not currently elevated, or UAC policy requires consent or alternate administrator credentials. Approve the prompt using an authorized account, or choose the normal launch option when administrative rights are unnecessary.

The limited-user application cannot change a system setting or write to a protected folder

The restricted context intentionally lacks the required permission. Treat this as an expected least-privilege result. Use a higher privilege mode only when the task legitimately requires it.

The application has different rights than expected

You may have selected a different launch mode, or Process Explorer may already be running elevated. Check how Process Explorer was started, repeat the launch using the intended File menu action, and inspect the new process's properties and security details.

The process cannot be found after launching

The application may have exited immediately, created a child process, or been blocked by an error. Refresh or inspect the process tree, review the executable path and arguments, and try a known working program such as Notepad.

Saved preferences interfere with the procedure

Customized Process Explorer settings may change the interface or make a menu difficult to follow. Use the application's built-in default-reset or restore-defaults capability, if available in your version, and then reopen the relevant File menu actions. This resets Process Explorer application preferences; it does not change Windows accounts, permissions, or UAC settings.

Key points

Process Explorer can create a new process as well as inspect existing ones.
Run uses the context of the current Process Explorer instance.
Run as Administrator requests elevation and may trigger UAC consent or credential entry.
Run as Limited User intentionally reduces the target program's rights.
Verify the result in the process tree and process properties rather than relying only on the menu choice.
Prefer the lowest privilege level that completes the task.