diff --git a/settings/campus.py b/settings/campus.py
index ab15d34..71cd560 100644
--- a/settings/campus.py
+++ b/settings/campus.py
@@ -583,6 +583,11 @@ def join_windows(cfg, base):
     if "$known = @{" not in text:
         raise RuntimeError("the Windows template changed: cannot put the program finder in")
     text = text.replace("# Status panel remote access", "# Run in PowerShell as administrator:  irm %s/join.ps1 | iex\n# Status panel remote access" % base, 1)
+    # Not elevated: say how, before anything runs (SC's Lighting PC got a DISM error instead, 2026-10-21).
+    text = text.replace("# Status panel remote access", """# Status panel remote access
+if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this as administrator: close this window, right-click Windows PowerShell > Run as administrator, then paste the line again. Nothing was changed.'
+}""", 1)
     text += """
 # 5. Tell %(ingest)s this PC is here: it sets it up within a minute.
 $hello = @{ user = $env:USERNAME; name = $env:COMPUTERNAME; os = 'windows'
diff --git a/tests/test_campus.py b/tests/test_campus.py
index 8dac170..6fc1297 100644
--- a/tests/test_campus.py
+++ b/tests/test_campus.py
@@ -550,3 +550,12 @@ class TestSwitchKeys(unittest.TestCase):
         lights = [t for t in kept_cfg["tiles"] if t["id"] == "lights"]
         self.assertEqual((len(lights), lights[0]["pos"], "LIGHTS" in kept), (1, [2, 7], True))
         self.assertEqual(len([t for t in kept_cfg["tiles"] if t.get("kind") == "autofix"]), 1)
+
+
+class TestJoinWindowsAdmin(unittest.TestCase):
+    def test_the_pc_line_stops_with_plain_words_when_not_administrator(self):
+        cfg = json.load(open(os.path.join(ROOT, "sites", "sc", "config.json")))
+        text = campus.join_windows(cfg, "http://10.5.2.60:8020")
+        check = text.index("IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)")
+        self.assertLess(check, text.index("Get-WindowsCapability"))                # before anything needs it
+        self.assertIn("Run as administrator", text)