VMware ESXi and vSphere Cluster Management
Run Processes from Process Explorer
Learn how to launch programs from Process Explorer as the current user, an administrator, or a limited user, then verify the resulting process context.
Process Explorer, also known as Procexp, is a Microsoft Sysinternals utility for monitoring and managing running processes. A process is an executing instance of a program. Process Explorer can also start a new executable without requiring you to leave the application.
The launch choice is available from the File menu. You can run a program normally, request administrative elevation, or test it with reduced permissions. This is useful when diagnosing access problems, testing an application under a different privilege level, or opening a management tool from an administrative Process Explorer session.
Prerequisites and execution context
- Install or run the Sysinternals Process Explorer utility.
- Know the path to the executable or command you want to start, or be able to browse to it.
- Understand that the available security context depends partly on whether Process Explorer itself is running normally or with administrative elevation.
A user context is the Windows user identity associated with a process. Elevation means running with an administrative security token and expanded permissions. A security token contains identity, group membership, privileges, and restrictions used by Windows when controlling the process.
Open the process-launch command
- Open Process Explorer.
- Open the File menu.
- Choose one of Run, Run as Administrator, or Run as Limited User.
- In the normal launch workflow, enter the target executable or command, or browse to it.
- Complete any requested approval or credential prompt.
Example executables include notepad.exe, cmd.exe, powershell.exe, and mmc.exe. These are examples only. Use administrative tools only when you are authorized to do so.
Compare the three launch options
| File menu option | Resulting user or privilege context | UAC behavior | Best use case | Security considerations |
|---|---|---|---|---|
| Run | Uses the same user account and effective security context as Process Explorer. | Does not automatically request elevation. | Normal applications that do not need additional privileges. | If Process Explorer is elevated, the child process generally receives that elevated context. |
| Run as Administrator | Starts the target with administrative elevation. | If Process Explorer is not elevated, UAC may request approval or administrator credentials. | Authorized management and diagnostic tasks that require protected access. | An elevated application can make system-wide changes. Use it only when necessary. |
| Run as Limited User | Starts the target with reduced permissions and limited administrative capability. | Designed to avoid granting administrative rights for the target. | Least-privilege testing and diagnosing unnecessary administrator dependencies. | Access to protected files, registry locations, services, drivers, and system settings may fail intentionally. |
Use Run for the current user
Run starts the selected program under the same user account and effective security context as Process Explorer. It does not mean “switch to another Windows account.” It means launch the program using the account that owns the Process Explorer session.
- Open File in Process Explorer.
- Choose Run.
- Enter or select an executable such as
notepad.exe. - Confirm that the application starts under the same context as Process Explorer.
If Process Explorer was started with elevation, a program launched with Run generally inherits that elevated context. If Process Explorer was started normally, Run normally starts a standard, non-elevated child process. Use Run as Administrator when elevation is specifically required.
Use Run as Administrator
Run as Administrator starts the target program with an administrative security token. An administrator is a user or elevated context permitted to perform protected system-level tasks.
- Open the File menu.
- Choose Run as Administrator.
- Enter or browse to a management utility, such as
mmc.exe, or another authorized tool. - Respond to the UAC prompt if one appears.
- Verify that the resulting process has the intended elevated context.
User Account Control (UAC) is the Windows mechanism that requests approval or credentials before administrative elevation. If the current account is not an administrator, Windows may require administrator credentials. Organizational policy can also restrict elevation or require approval. An already elevated Process Explorer may not need a separate elevation step for the child process, but verify the result rather than assuming it.
Use Run as Limited User
Run as Limited User starts the target with reduced permissions. This is useful for testing whether an application works without administrator rights and for identifying unnecessary privilege dependencies.
- Open the File menu.
- Choose Run as Limited User.
- Launch the target application.
- Repeat the action suspected of requiring elevated rights.
- Compare the result with a normal or elevated launch.
A limited process may be unable to modify protected files, registry locations, services, drivers, system-wide settings, or protected directories. Such failures can be expected and can help identify which operation depends on elevated access. The result does not automatically prove that elevation is appropriate; determine whether the task truly requires it or whether the application can be configured or redesigned for standard-user operation.
Choose the appropriate launch context
| Task | Recommended choice | Reason |
|---|---|---|
| Open an ordinary user application | Run | Uses the current account without intentionally adding privileges. |
| Perform an authorized administrative task | Run as Administrator | Provides the elevated token required by protected operations. |
| Check whether an application requires administrator rights | Run as Limited User | Tests behavior under reduced permissions. |
Prefer the minimum permissions necessary. Do not use an elevated launch merely because it avoids an access error; first establish which resource requires access and whether the application can operate safely without elevation.
Verify the newly launched process
After launching a program, locate it in the Process Explorer process tree. A program started directly from Process Explorer should normally appear as a child process of Process Explorer. Expand the relevant tree node if necessary, or search the process list by executable name.
| Property to inspect | What it confirms | Why it matters |
|---|---|---|
| Parent process | Which process created the program. | Confirms that the launch came directly from Process Explorer when it appears as its child. |
| User account | The Windows identity associated with the process. | Confirms that the expected account, rather than another account, is being used. |
| Integrity level | The Windows mandatory integrity classification. | Helps distinguish standard and elevated execution levels. |
| Token privileges | Privileges, groups, and restrictions in the process security token. | Shows whether administrative capabilities are present or restricted. |
| Command line | The executable path and arguments used to start the process. | Detects an incorrect target, missing argument, or unexpected launch parameters. |
Open the launched process's properties and inspect its user, integrity, token, and command-line information. The exact labels and views can vary by Process Explorer or Windows version, so use the information currently displayed by the application.
Practical verification example
- Open File and choose Run.
- Launch
notepad.exe. - Find Notepad in the process tree.
- Inspect its parent process and user account.
- Check the integrity or token information to confirm that it has the expected context.
For a privilege comparison, repeat the test with Run as Administrator and then with Run as Limited User, if available. Compare the process properties and the application's ability to access protected resources.
Troubleshooting
Run as Administrator prompts for credentials or is denied
The current account may not be an administrator, UAC policy may require administrator credentials, or organizational policy may restrict elevation. Use an authorized administrator account or obtain the required approval. Do not change security policy without authorization.
Run does not provide the expected privileges
Run does not elevate a normally running Process Explorer. Check whether Process Explorer itself was started with elevation. If the task requires administrative access, use Run as Administrator, then inspect the child process token and integrity level.
The application fails as a limited user
The application may be attempting to modify protected files, registry locations, services, drivers, or system settings. Use the failure to identify the protected resource. Decide whether elevation is genuinely required or whether the application can be configured for standard-user operation.
The launched process cannot be found
The application may have exited immediately, the executable path or arguments may be invalid, or the target may have created another process and then exited. Check for an error message, validate the path, search by process name, and inspect process-tree changes and command-line details.
File menu choices are unavailable or behave unexpectedly
Version differences, restricted system policy, insufficient rights, customized settings, or an unusual execution environment can affect behavior. Confirm the Process Explorer version and applicable Windows policies. Review application settings and use the separate Process Explorer defaults-reset procedure when interface or behavior settings need to be restored. Resetting defaults is not normally required merely to launch a process.
Keyboard and menu access
Use the visible File menu to avoid relying on undocumented shortcuts. On Windows, menu access keys may be available through the Alt key and the underlined letters shown by the current application or system settings. Keyboard behavior and displayed access keys can differ by Process Explorer version and Windows configuration. When in doubt, open the menu with the mouse or follow the current application documentation.
Key points
- Process Explorer can launch an executable without leaving the utility.
- The three launch choices are Run, Run as Administrator, and Run as Limited User.
- Run follows Process Explorer's current user and effective security context; it does not switch accounts.
- Run as Administrator requests an elevated token and may trigger UAC.
- Run as Limited User is valuable for least-privilege testing, but protected operations may fail.
- Verify the result in the process tree and inspect the parent, user, integrity level, token privileges, and command line.