windows-elevation-from-wsl

Handle "Access is denied" from powershell.exe or pwsh.exe run inside WSL — Register-ScheduledTask / Set-ScheduledTask on a RunLevel=HighestAvailable task, a service change (Set-Service, Stop-Service, New-Service), an LSA rights grant such as "Log on as a batch job" (SeBatchLogonRight, secedit, ntrights), an HKLM registry write, or any other change to Windows state from a WSL session. Use it BEFORE attempting such a write from WSL and the moment one is denied. PowerShell run from WSL inherits the elevation of the session that launched WSL, and an agent's session is not elevated: reads succeed (Get-ScheduledTask, Get-Service, the registry) so the surface looks available, writes that need elevation fail, and no flag, retry, Start-Process -Verb RunAs, schtasks, sudo, SYSTEM principal or downgraded RunLevel fixes it. Compose the command from WSL, export what it will overwrite (Export-ScheduledTask), then hand the operator the exact line for an elevated Windows prompt and say it needs elevation.

License

MIT

Compatibility

A WSL session on a Windows host that drives Windows through powershell.exe / pwsh.exe via interop. Not applicable on Claude.ai web, hosted sandboxes, macOS or plain Linux, and not needed in a session whose WSL was itself launched from an elevated Windows prompt.