diff --git a/build/actions/os.js b/build/actions/os.js
index e04bb112..7060cd94 100644
--- a/build/actions/os.js
+++ b/build/actions/os.js
@@ -1,5 +1,5 @@
 (function() {
-  var _, async, commandOptions, diskio, fs, mkdirp, npm, os, packageJSON, path, progressStream, resin, updateActions, visuals;
+  var _, async, commandOptions, diskio, elevate, fs, mkdirp, npm, os, packageJSON, path, progressStream, resin, updateActions, visuals;
 
   _ = require('lodash-contrib');
 
@@ -29,6 +29,8 @@
 
   updateActions = require('./update');
 
+  elevate = require('../elevate');
+
   exports.download = {
     signature: 'os download <id>',
     description: 'download device OS',
@@ -151,14 +153,13 @@
           return diskio.writeStream(params.device, imageFileStream, callback);
         }
       ], function(error) {
-        var resinWritePath, windosu;
+        var resinWritePath;
         if (error == null) {
           return done();
         }
-        if (_.all([os.platform() === 'win32', error.code === 'EPERM' || error.code === 'EACCES', !options.fromScript])) {
-          windosu = require('windosu');
+        if (elevate.shouldElevate(error) && !options.fromScript) {
           resinWritePath = "\"" + (path.join(__dirname, '..', '..', 'bin', 'resin-write')) + "\"";
-          return windosu.exec("\"" + process.argv[0] + "\" " + resinWritePath + " \"" + params.image + "\" \"" + params.device + "\"");
+          return elevate.run("\"" + process.argv[0] + "\" " + resinWritePath + " \"" + params.image + "\" \"" + params.device + "\"");
         } else {
           return done(error);
         }
diff --git a/build/elevate.js b/build/elevate.js
new file mode 100644
index 00000000..6bdc3f64
--- /dev/null
+++ b/build/elevate.js
@@ -0,0 +1,23 @@
+(function() {
+  var isWindows, os, path;
+
+  os = require('os');
+
+  path = require('path');
+
+  isWindows = function() {
+    return os.platform() === 'win32';
+  };
+
+  exports.shouldElevate = function(error) {
+    return _.all([isWindows(), error.code === 'EPERM' || error.code === 'EACCES']);
+  };
+
+  exports.run = function(command) {
+    if (!isWindows()) {
+      return;
+    }
+    return require('windosu').exec(command);
+  };
+
+}).call(this);
diff --git a/lib/actions/os.coffee b/lib/actions/os.coffee
index b36fc2d0..e6a4761e 100644
--- a/lib/actions/os.coffee
+++ b/lib/actions/os.coffee
@@ -12,6 +12,7 @@ commandOptions = require('./command-options')
 npm = require('../npm')
 packageJSON = require('../../package.json')
 updateActions = require('./update')
+elevate = require('../elevate')
 
 exports.download =
 	signature: 'os download <id>'
@@ -188,18 +189,10 @@ exports.install =
 		], (error) ->
 			return done() if not error?
 
-			if _.all [
-				os.platform() is 'win32'
-				error.code is 'EPERM' or error.code is 'EACCES'
+			if elevate.shouldElevate(error) and not options.fromScript
 
-				# Prevent re-running resin-write infinitely
-				# If we have an EPERM or EACCES even after running
-				# windosu, we throw it as there is not much we can do
-				not options.fromScript
-			]
-				windosu = require('windosu')
 				# Need to escape every path to avoid errors
 				resinWritePath = "\"#{path.join(__dirname, '..', '..', 'bin', 'resin-write')}\""
-				windosu.exec("\"#{process.argv[0]}\" #{resinWritePath} \"#{params.image}\" \"#{params.device}\"")
+				elevate.run("\"#{process.argv[0]}\" #{resinWritePath} \"#{params.image}\" \"#{params.device}\"")
 			else
 				return done(error)
diff --git a/lib/elevate.coffee b/lib/elevate.coffee
new file mode 100644
index 00000000..ede74340
--- /dev/null
+++ b/lib/elevate.coffee
@@ -0,0 +1,15 @@
+os = require('os')
+path = require('path')
+
+isWindows = ->
+	return os.platform() is 'win32'
+
+exports.shouldElevate = (error) ->
+	return _.all [
+		isWindows()
+		error.code is 'EPERM' or error.code is 'EACCES'
+	]
+
+exports.run = (command) ->
+	return if not isWindows()
+	require('windosu').exec(command)