VMware ESXi and vSphere Cluster Management

Run Process Explorer as Administrator

Learn why Process Explorer needs elevation, how to launch it as administrator on modern and legacy Windows, and how to troubleshoot access limitations.

Why run Process Explorer as administrator?

Process Explorer is a Windows process-inspection utility for viewing running processes, process details, ownership, and related system activity. It can start without elevation, but the security context of the account determines what it can read or change.

Elevation means launching a program with administrator-level permissions. An Administrator account or security context has additional rights for system-wide tasks, although User Account Control (UAC) may require explicit approval before those rights are used.

When Process Explorer is elevated, it can usually retrieve more information and expose more privileged features. Elevation is particularly important when inspecting processes owned by another user or running in a different logon session. A logon session is a user-specific Windows session that affects which processes and resources another user can inspect.

What happens without administrative privileges?

Process Explorer attempts to display whatever information the current account is allowed to access. For processes in your own session, much of the information may be available. For processes belonging to other users, services, or protected system components, access may be partial.

These limits are normal consequences of Windows permissions. Elevating Process Explorer improves access, but it does not override every security boundary.

Launch Process Explorer on Windows Vista and later

1. Locate the Process Explorer executable in File Explorer.
2. Right-click the executable.
3. Select Run as administrator.
4. Respond to the User Account Control (UAC) prompt. UAC is the Windows approval and credential system used for elevated actions on newer Windows versions.
5. If requested, provide credentials for an authorized administrator account. If you approve the prompt or valid credentials are accepted, the new Process Explorer instance runs with administrator permissions.

The graphical launch method starts an elevated instance for that launch. It does not by itself permanently change the executable or require a permanent shortcut configuration.

Choosing the account

A local administrator account belongs to the computer's Administrators group and may be allowed to perform system-wide tasks. A standard user account normally lacks those rights. On a managed computer, an administrator may need to enter credentials for you, or organizational policy may prevent elevation entirely.

Do not assume that an account named Administrator is the only valid choice. Use the authorized administrator account supplied by your organization or support procedure.

Launch Process Explorer on Windows XP and Windows Server 2003

Windows XP and Windows Server 2003 do not use the later Windows Vista-and-newer context-menu elevation workflow in the same way. To access most privileged Process Explorer functions, start it under an account with full administrator rights.

One option is the Windows RunAs mechanism. RunAs starts a program using another user account's credentials.

runas /user:Administrator "C:\Path\To\procexp.exe"

1. Replace Administrator with an actual authorized administrator account if that is not the correct account name.
2. Replace the example path with the real location of the Process Explorer executable.
3. Keep the quotation marks when the path contains spaces.
4. Enter the requested password when RunAs prompts for it.

The command does not grant rights to a standard account. The selected account must actually have full administrator privileges, and the executable path and credentials must be valid.

Windows version and recommended elevation method

Verify that the instance is elevated

1. Close or leave aside the non-elevated Process Explorer window.
2. Start a new instance using the appropriate administrator method for your Windows version.
3. Revisit a process that previously had blank properties, incomplete details, or an access-denied result.
4. Compare the process information and available actions.

If additional details now appear, the original limitation was probably caused by the earlier security context. Some restrictions may remain even after elevation. A protected process has additional Windows protections, so an administrator may still be unable to read or modify certain information.

Troubleshoot common access problems

Properties are blank or incomplete

Likely cause: Process Explorer was launched without rights to read information from that process or logon session.

Resolution: Restart Process Explorer with administrator privileges and check whether the missing data becomes available.

An access-denied message appears

Access denied means that the current Process Explorer security context cannot retrieve or modify the requested information. Use an authorized administrator account and try again. If the restriction remains, the process may be protected or specially secured by Windows.

The administrative launch option requests credentials

The signed-in user may be a standard user, or local and organizational policies may prevent the current account from elevating. Request credentials from an authorized administrator or follow the approved support procedure. Do not bypass the policy or share administrator passwords informally.

RunAs does not provide expected access on XP or Server 2003

Check that the selected account has full administrator rights, the executable path is correct, the command is quoted correctly, and the password was entered successfully. A valid RunAs command cannot provide administrator access when the selected account is not an administrator.

Security and operational cautions

An elevated Process Explorer instance can perform actions with system-wide impact. Depending on the operation, changing or terminating a process can interrupt services, close applications, lose unsaved work, or destabilize Windows.

• Use administrator credentials only when elevated access is needed.
• Review UAC and credential prompts carefully before approving them.
• Do not terminate, alter, suspend, or otherwise manipulate an unfamiliar process solely because its name is unknown.
• Confirm process ownership, path, purpose, and impact before taking action.
• Follow organizational change-control and support procedures on managed computers.

Practical comparison: another user's process

Suppose another signed-in user owns a process you need to investigate. In a non-elevated Process Explorer window, the process may appear in the list while selected properties are blank or an action returns access denied. Close or restart the utility using Run as administrator on modern Windows, or use RunAs with an administrator account on Windows XP or Server 2003. Reopen the process properties and compare the result. More information should normally be available, but protected processes can still restrict access.

Summary

• Process Explorer can run without elevation, but its visibility and control are limited by Windows permissions.
• Elevation is most useful when inspecting other users' processes, services, or different logon sessions.
• On Windows Vista and later, use the executable's Run as administrator command and approve the UAC prompt.
• On Windows XP and Windows Server 2003, use an account with full administrator rights, often through RunAs.
• Blank fields and access-denied messages are often permission limitations rather than program failures.
• Even an administrator may face restrictions when examining protected processes.

For related guidance, see Run As Administrator.