Language: English | Deutsch
Download: Latest release
Documentation: Installation | Using xucRun | Reference | Security model | Build instructions
xucRun stands for eXecute Under User Context.
Status: xucRun is actively maintained and continues to evolve. It has been proven in practical use on the author's Windows 10 and Windows 11 systems. Further changes are possible, and defects cannot be ruled out.
xucRun runs a program, command, or script under the user account selected for that purpose while the user remains in the current Windows session. The target account can be a standard account or belong to the local Administrators group; in the latter case, the launch can optionally use elevated privileges. Its central use case is an experienced Windows user who normally works from a standard account and wants to perform a specific administrative action without switching to a separate administrator session or entering the account name and password again for every matching invocation.
xucRun keeps the signed-in account and the selected target account separate. It does not temporarily turn a standard user into an administrator. Programs use the identity, permissions, and user profile of the selected target account. Account selection and elevation remain separate decisions.
No separate initial setup is required. xucRun requests a target account, credentials, UAC confirmation, and an approval when they are first needed. Once suitable approvals exist, normal use usually requires only the program and its arguments. The security model explains the account separation, authorization model, safeguards, and remaining risks.
A user who already works from an account in the local Administrators group and only wants to occasionally elevate programs under that same account can normally use Windows UAC or Sudo for Windows. xucRun is primarily useful when the signed-in standard account and the account used for administrative actions remain separate and recurring launches should work without entering the password again each time, while the user can still decide whether only the exact same invocation or, for example, different arguments are allowed. Account selection and elevation remain separate decisions.
xucRun is intended for experienced Windows users who understand Windows accounts, UAC, and
permissions. The
comparison and decision guidance
explains how it differs from Fast User Switching, UAC, Sudo for Windows, runas.exe /savecred,
and other approaches.
- Download the current x64 package or graphical installer from the official release.
- Compare the downloaded file's SHA-256 hash with
SHA256SUMS.txtfrom the release. - Run
xucRun-Installer-<Version>-x64.exeand approve the Windows UAC request. - Optionally let the installer add xucRun to the machine-wide PATH so that
xucRun.exeworks without an absolute path in interactive commands.
Windows may report an unknown publisher on first launch because the public installer is currently not Authenticode-signed. The installer creates or reuses a protected machine-local certificate and uses it to establish trust between the installed xucRun components. xucRun is not portable: Installation sets up a Windows service, protected access permissions, and a machine-local certificate that establishes trust between the components.
The installation guide contains package verification, prerequisites, graphical and script-based installation, updates, Tray compatibility, and uninstallation.
After installation, open PowerShell or Command Prompt. The shortest typical invocation is:
xucRun.exeWithout arguments, xucRun replaces a supported parent shell with the same shell in the
automatically selected account and privilege context while preserving the working directory. The
primary use case is to switch quickly from the current shell to the same shell type with elevated
privileges. This works with Command Prompt (cmd.exe), Windows PowerShell (powershell.exe), and
PowerShell 7 (pwsh.exe). The invocation contains neither a target-account name nor a password.
Open or download the short demonstration video: It shows switching from a non-elevated shell to the same shell type with elevated privileges and the elevated launch of an individual program.
Programs and their arguments can be started directly:
xucRun.exe powershell.exe -NoExit
xucRun.exe regedit.exeWhen required information or confirmations are missing, xucRun requests them as needed:
- select an enabled local target account;
- enter that account's credentials on the separate protected xucRun desktop;
- confirm Windows UAC when elevated privileges are requested;
- choose the duration and scope of the xucRun approval.
On later matching invocations, stored credentials may be used without asking for the password again when the applicable approval permits it.
| Select target account | Enter credentials | Confirm storage |
|---|---|---|
 |
 |
 |
Account markers identify Administrators-group members ([A]), standard accounts ([S]), and
accounts whose membership could not be determined ([?]). The detailed first-use flow and all
account-selection switches are documented in
Using xucRun.
The following examples show how xucRun combines account selection, optional elevation, stored
credentials, approvals, and argument forwarding in one invocation. Many of the single-line cmd
examples are also well suited as targets for desktop shortcuts when absolute program paths are
specified.
Open Windows administrative tools with elevated privileges from a standard-user session:
xucRun.exe /user-elevated "C:\Windows\System32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
xucRun.exe /user-elevated "C:\Windows\System32\mmc.exe" "C:\Windows\System32\diskmgmt.msc"xucRun treats the respective .msc file as an argument to the explicitly identified mmc.exe.
The first invocation opens Device Manager, and the second opens Windows Disk Management. Neither
invocation contains the administrator account or its password. The examples use /user-elevated
to explicitly request an elevated launch under a suitable account in the local Administrators
group. If automatic account selection already unambiguously results in such a launch, the switch
can be omitted. This also applies to the examples below.
Open PowerShell under an account selected for this launch:
"C:\Program Files\xucRun\xucRun.exe" /user:* "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoExit/user:* always opens the selection of enabled local accounts and starts PowerShell under the
selected account without requesting additional elevation through xucRun. Missing credentials are
requested before the launch.
Run Thunderbird from PowerShell with the profile and identity
of the MailUser Windows account without requesting elevation:
& 'C:\Program Files\xucRun\xucRun.exe' `
/user:MailUser `
'C:\Program Files\Mozilla Thunderbird\thunderbird.exe'This example deliberately changes the Windows account without requesting elevation. Thunderbird uses the target account's profile, settings, and stored application sign-ins.
Pass several structured arguments, including values and a path with spaces, directly to
netsh.exe:
xucRun.exe /user-elevated "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Local example server" dir=in action=allow program="C:\Program Files\ExampleServer\server.exe" enable=yes profile=privatexucRun keeps the target program and its arguments separate across the required process boundaries; the invocation does not need a nested command line for a separate account-switching and elevation tool chain.
Graphical applications with multiple structured arguments can also be launched directly, for example Total Commander with predefined panel paths:
xucRun.exe /user-elevated "C:\totalcmd\TOTALCMD64.EXE" /L="C:\Windows\System32\config" /R="C:\Program Files" /P=LThe same application can instead be opened without requested elevation under the Robert Windows
account with that account's %LOCALAPPDATA% directory:
xucRun.exe /user:Robert "C:\totalcmd\TOTALCMD64.EXE" /L=^%LOCALAPPDATA^% /R="C:\Program Files" /P=LThe carets prevent cmd.exe from expanding %LOCALAPPDATA% in the calling account's context; the
variable passes through xucRun unchanged, and the launched application expands it only after the
account switch. This invocation is intended for interactive entry in cmd.exe.
Interactive commands may use executable short names. Scripts, shortcuts, scheduled tasks, and
other fixed invocations should use the actual absolute paths of both xucRun.exe and the target
program to reduce executable-search redirection risks. More examples, shell replacement, batch
files, Explorer, desktop shortcuts, and one possible integration using custom commands in Total
Commander are covered in Using xucRun. The
comparison with other approaches
explains the differences without assuming that one solution is best for every use case.
xucRun stores credentials through Windows APIs and uses them only when a matching approval permits the requested launch. Approvals can bind the target account, program, file hash, arguments, working directory, and other characteristics with different scopes and durations. Windows UAC remains a separate interactive step where required.
Use /showcred and /showapprovals to inspect stored target accounts and active approvals. The
complete management workflow is described in
Using xucRun; the authorization model is
described in the security model.
| Command | Purpose |
|---|---|
xucRun.exe [<program> [arguments...]] |
launch a program or replace a supported parent shell |
xucRun.exe /addcred [<account>] |
optionally store credentials before the first program launch |
xucRun.exe /showcred |
show accounts with stored xucRun credentials |
xucRun.exe /showapprovals |
show active approvals |
xucRun.exe /backup |
manage local backups |
xucRun.exe /info |
show version, signing, broker, and configuration information |
xucRun.exe /audit |
run the security diagnostics |
xucRun.exe /help |
show the complete built-in help |
The command and configuration reference documents all switches, advanced LocalSystem and TrustedInstaller launches, exit codes, backups, configuration, and diagnostics.
xucRun supports x64 editions of Windows 10 and Windows 11 and requires the Microsoft Visual C++ Redistributable v14 for x64.
Windows UAC must remain enabled system-wide. Elevated cross-account launches additionally require
Windows Admin Approval Mode for the selected administrator account, particularly the built-in
Administrator account. The
requirements and intended use section
explains the configuration and its system-wide effects.
Important security notices: xucRun uses Windows APIs to store credentials. For xucRun to start a program under another user account, however, xucRun must process the required credentials temporarily. Complete protection against reading or misuse by sufficiently privileged malware or an already compromised system therefore cannot be guaranteed. The source code of xucRun is disclosed so that the implemented technical measures, their limits, and the remaining risks can be understood and independently reviewed. Disclosure alone is neither a security guarantee nor evidence of an independent security audit. Use xucRun at your own responsibility. xucRun should be used only on trusted, self-managed systems that do not require an elevated level of protection, and preferably with dedicated target accounts having the minimum required privileges. Scripts, shortcuts, scheduled tasks, and configuration files that invoke xucRun or provide its parameters must also be trusted and protected against unauthorized modification. These security notices are not exhaustive; not all risks and security vulnerabilities can be anticipated or ruled out. To the extent permitted by law, the author and contributors accept no liability for damage, data loss, or other consequences arising from the use or incorrect use of xucRun, software defects or security vulnerabilities, malware, or a compromised system. This includes, in particular, the loss, disclosure, or misuse of credentials. The disclaimer of warranty and limitation of liability in the Apache License 2.0 govern.
The complete security model documents the broker trust boundary, caller and launch-target validation, credential protection, fixed-invocation risks, and residual risks.
The separately installed xucRun Tray add-on provides status information and convenient access to common management functions. xucRun and its broker remain fully usable without an installed or running Tray. Core and Tray versions must match exactly.
The background and origins describe why xucRun was created, the practical needs that shaped it, and the significance of its security considerations.
Development can be supported voluntarily through Patreon. Support is not required to download or use xucRun and does not provide exclusive software, features, releases, downloads, personal support, or response times.
Do not report unpatched or suspected vulnerabilities publicly. SECURITY.md describes the confidential reporting path and supported versions.
The build instructions describe how to create an xucRun package from source. The installation guide covers installation of that package. If normal uninstallation is unavailable, follow the manual removal guide.
xucRun is open source under the Apache License 2.0. NOTICE contains attribution notices.
External code contributions are not currently accepted; see CONTRIBUTING.md.