Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.



Windows 7: Elevated Program Shortcut - Create for Standard User


How to Create an Elevated Program Shortcut Any User is able to Run in Vista, Windows 7, and Windows 8
Published by Brink
25 Oct 2011
Published by

How to Create an Elevated Program Shortcut Any User is able to Run in Vista, Windows 7, and Windows 8

information   Information
This will show you how to create an elevated program shortcut that allows any user (ex: Standard user) to be able to run a program that runs as administrator without being prompted to enter the administator's password each time in Vista, Windows 7, and Windows 8.

Note   Note
If the user you want to have this shortcut has been restricted with Parental Controls in Windows 7 with it set as Standard Account can only use the programs I allow, then they will not be able to use the shortcut in this tutorial since they will not be allowed to use the runas.exe file used by this shortcut. Windows 7 will not allow runas.exe to be added to the allowed to run list.



If the user you want to have this shortcut has been restricted with Family Safety in Windows 8 with it set as (user) can only use the apps I allow, then they will not be able to use the shortcut in this tutorial since they will not be allowed to use the runas.exe file used by this shortcut. Windows 8 will not allow runas.exe to be added to the allowed to run list.



You will not be able to do this in Vista Starter, Vista Home Basic, Vista Home Premium, Windows 7 Home Basic, and Windows 7 Starter editions since the runas /savecred switch option is not available and will be ignored in them.



If you disable the built-in Administrator account, the elevated shortcut will stop working until you enable the built-in Administrator again. This is because the elevated shortcut uses the password of the built-in Administrator to approve running it.

Tip   Tip
The Administrator's password (credential) used by the elevated shortcut is encrypted and stored by the Credential Manager (Control Panel (icons view)) as a "interactive logon" entry under Windows Credentials like below. If you like, you can Remove (delete) this credential at anytime in Credential Manager to strip the password from the elevated shortcut to make it invalid and no longer work.

Elevated Program Shortcut - Create for Standard User-password.jpg





Here's How:

1. If you have not already, enable the built-in elevated "Administrator" account, and create a password for it.
NOTE: You must use the actual built-in Adminstrator account, and not just another administrator type user account. If you don't the shortcut will not work.


2. Log in to the built-in Administrator account, right click or press and hold on an empty space on the desktop, and click/tap on New and Shortcut.


3. Type the location below into the location area, and click/tap on the Next button. (see screenshot below)
Name:  Step1.jpg
Views: 16562
Size:  93.6 KB
Note   Note
  • You would substitute ComputerName in the command below with the actual computer name.
  • If the Administrator account has been renamed, then you would also need to substitute Administrator in the command below with the new name.
  • You would substitute Full path to program's exe file in the command below with the actual full path of the elevated program's exe file within quotes that you want to have the standard user be able to run.
Code:
runas /user:ComputerName\Administrator /savecred "Full path to program's exe file"
For example: I would like to have a standard user to be able to run CCleaner without me or them having to enter the Administrator's account password each time. For this, I would type this:
Code:
runas /user:Brink-PC\Administrator /savecred "C:\Program Files\CCleaner\CCleaner.exe"
3. Type in the name of the program (ex: CCleaner), and click/tap on the Finish button. (see screenshot below)
Name:  Step2.jpg
Views: 16228
Size:  71.5 KB
4. Right click or press and hold on the new shortcut, click/tap on Properties, Shortcut tab, and on the Change Icon button. (see screenshot below)
Name:  Step3.jpg
Views: 16320
Size:  60.7 KB
5. Click/tap on OK. (see screenshot below)
Name:  Step4.jpg
Views: 16072
Size:  22.6 KB
6. Click/tap on the Browse button, navigate to the location of the program's (ex: CCleaner) exe file, click on Open, select the program's icon, and click/tap on OK. (see screenshots below)
Name:  Step5A.jpg
Views: 16072
Size:  32.8 KB

Elevated Program Shortcut - Create for Standard User-step5b.jpg

7. Click/tap on OK. (see screenshot below)
Name:  Step6.jpg
Views: 16094
Size:  64.0 KB
8. While still logged in to the "Administrator" account, copy the shortcut to the desktop folder of the user account (ex: Test) that you would like to be able to run this elevated program without getting a UAC prompt or having to provide the administrator's password for it.
Elevated Program Shortcut - Create for Standard User-desktop.jpg
9. Right click or swipe down on the shortcut on the user's desktop that you just copied to, and click/tap on Properties. (see screenshot above)

10. Click/tap on the Security tab, and Advanced button. (see screenshot below)
Name:  Security-1.jpg
Views: 15766
Size:  68.1 KB
11. Select the user account (ex: Test), and click/tap on the Disable inheritance button. (see screenshot below)
Elevated Program Shortcut - Create for Standard User-security-2.jpg
12. Click/tap on Convert inherited permissions into explicit permissions on this object. (see screenshot below)
Name:  Security-3.jpg
Views: 15723
Size:  61.9 KB
13. Select the user account (ex: Test), and click/tap on the Edit button. (see screenshot below)
Elevated Program Shortcut - Create for Standard User-security-4.jpg
14. Make sure that only the Read & execute and Read "Allow" permissions are checked, and click/tap on OK. (see screenshot below)
NOTE: This will prevent the user (ex: Test) from being able to change the target of the elevated shortcut, and only be able to run the program the elevated shortcut was created to run.
Elevated Program Shortcut - Create for Standard User-security-5.jpg
15. Click/tap on OK. (see screenshot below step 13)

16. Click/tap on OK. (see screenshot below)
Name:  Security-7.jpg
Views: 15725
Size:  68.6 KB
17. Log on to the user account (ex: Test) that you made a copy of this shortcut to, and run the shortcut.

18. In the command prompt that opened, type in your built-in Administrator account's password and press Enter. You will not see the password while you are typing it in. (see screenshot below)

NOTE: You will only have to enter the Administrator's password for only the first time that this shortcut is ran in the user account (ex: Test). Afterwards, it will be remembered and entered automatically for the user when they run it without anyone being able to see the password.
Name:  step7.jpg
Views: 16454
Size:  30.8 KB
19. In Vista and Windows 7, the user can now Pin to Taskbar (Windows 7 only) or Pin to Start Menu, add to Quick Launch, assign a keyboard shortcut to it, or move this shortcut to where you like for easy use.

20. In Windows 8, the user can Pin to Taskbar on desktop, Pin to Start screen, add to Quick Launch, assign a keyboard shortcut to it, or move this shortcut to where you like for easy use.





That's it,
Shawn


.

26 Oct 2011   #1
sewordz

Windows 7 Ultimate x64
 
 

been waiting for this...
thanks Brink!

My System SpecsSystem Spec
.

26 Oct 2011   #2
Brink
Microsoft MVP

64-bit Windows 8.1 Enterprise
 
 

You're most welcome Sewordz. Yeah, it's been a bit of a wait.
My System SpecsSystem Spec
07 Nov 2011   #3
JerometheGiraff

Windows 8.1 Pro
 
 

I got to Step 8 then things grinned to a halt. When I run the short cut that is suppose to load up a command prompt in which to enter in the Admin password. Instead a command prompt loads and as soon as it loads, disappears.
My System SpecsSystem Spec
07 Nov 2011   #4
Brink
Microsoft MVP

64-bit Windows 8.1 Enterprise
 
 

Hello Jerome,

Double check to see if you may have made any mistakes or typos.

Could you post the command that you used?
My System SpecsSystem Spec
08 Nov 2011   #5
JerometheGiraff

Windows 8.1 Pro
 
 

Quote:
runas /user:ComputerName\AdministratorAccountName /savecred "Full path to program's exe file"
That was the command I use. If I created any spelling mistakes the short-cut wouldn't work.
My System SpecsSystem Spec
08 Nov 2011   #6
patronanejo

Windows 7 Ultimate x64
 
 

Quote   Quote: Originally Posted by JerometheGiraff View Post
Quote:
runas /user:ComputerName\AdministratorAccountName /savecred "Full path to program's exe file"
That was the command I use. If I created any spelling mistakes the short-cut wouldn't work.
Windows will often give you a clue when things go awry--you just have to keep the CLI open. Try creating a batch file that looks like:

runas /user:ComputerName\AdministratorAccountName /savecred "Full path to program's exe file"

pause
My System SpecsSystem Spec
08 Nov 2011   #7
Brink
Microsoft MVP

64-bit Windows 8.1 Enterprise
 
 

Quote   Quote: Originally Posted by JerometheGiraff View Post
Quote:
runas /user:ComputerName\AdministratorAccountName /savecred "Full path to program's exe file"
That was the command I use. If I created any spelling mistakes the short-cut wouldn't work.
Doing what Patronanejo posted above will allow the command prompt to stay open to see what if any error message that you are getting to help ID what the problem may be.

Did you substitute the items in that command example with your actual "Computer Name", "account name", and "exe path"?

Do you have any spaces in the account name or computer name?
My System SpecsSystem Spec
08 Nov 2011   #8
JerometheGiraff

Windows 8.1 Pro
 
 

Quote:
Windows will often give you a clue when things go awry--you just have to keep the CLI open. Try creating a batch file that looks like:

runas /user:ComputerName\AdministratorAccountName /savecred "Full path to program's exe file"

pause
Here is the results from the batch file.

Quote:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\<AccountName>>C:\Users\<AccountName>\Desktop\programadmin.bat

C:\Users\<AccountName>>C:\Windows\System32\runas.exe /user: <AccountName>-PC\<account name>
er_Admin /savecred "C:\SpaceSn
RUNAS USAGE:

RUNAS [ [/noprofile | /profile] [/env] [/savecred | /netonly] ]
/user:<UserName> program

RUNAS [ [/noprofile | /profile] [/env] [/savecred] ]
/smartcard [/user:<UserName>] program

RUNAS /trustlevel:<TrustLevel> program

/noprofile specifies that the user's profile should not be loaded.
This causes the application to load more quickly, but
can cause some applications to malfunction.
/profile specifies that the user's profile should be loaded.
This is the default.
/env to use current environment instead of user's.
/netonly use if the credentials specified are for remote
access only.
/savecred to use credentials previously saved by the user.
This option is not available on Windows 7 Home or Windows 7
Starter Editions
and will be ignored.
/smartcard use if the credentials are to be supplied from a
smartcard.
/user <UserName> should be in form USER@DOMAIN or DOMAIN\USER
/showtrustlevels displays the trust levels that can be used as arguments
to /trustlevel.
/trustlevel <Level> should be one of levels enumerated
in /showtrustlevels.
program command line for EXE. See below for examples

Examples:
> runas /noprofile /user:mymachine\administrator cmd
> runas /profile /env /user:mydomain\admin "mmc %windir%\system32\dsa.msc"
> runas /env /user:user@domain.microsoft.com "notepad \"my file.txt\""

NOTE: Enter user's password only when prompted.
NOTE: /profile is not compatible with /netonly.
NOTE: /savecred is not compatible with /smartcard.

C:\Users\<AccountName>>
Quote:
Did you substitute the items in that command example with your actual "Computer Name", "account name", and "exe path"?
Yes.

Quote:
Do you have any spaces in the account name or computer name?
No.
My System SpecsSystem Spec
08 Nov 2011   #9
Brink
Microsoft MVP

64-bit Windows 8.1 Enterprise
 
 

Code:
runas.exe /user: <AccountName>-PC\<account name> er_Admin /savecred "C:\SpaceSn
If that is what you used at step 2, then that is the cause. It should be like this instead. The program you wanted to run needs to be the full path and include it's file extention within quotes.

Code:
runas.exe /user:<computer name>\<account name> /savecred "C:\SpaceSn.exe"
My System SpecsSystem Spec
Comment

 Elevated Program Shortcut - Create for Standard User





Tutorial Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:09 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33