Security measures require Windows be logged in using Standard User login (not Administrator). Yet, sometimes an application has to be run “As Administrator” from a Standard User login. This paper describes how to create a shortcut icon to launch applications with the "Run as Administrator" option.
Security measures often require that Windows computer users be logged in as Standard Users and not as Administrator. Yet, there are times when an application has to be run “As Administrator” by a Standard User. That is, the application has to be run with elevated privileges. And, so we don’t confuse things, the need for elevating privileges by using “Run as Administrator” applies to both Administrators and Standard Users. In the latter, there are more steps involved – thus this paper.
When it’s common to have Standard Users and when such applications are in common use, it’s important to have a way to quickly launch them “As Administrator” – such as clicking on a desktop icon. Here we present a method that allows a Standard User to launch an application “As Administrator” without knowing the Administrator User login information. It focuses on creating a desktop icon for launching the application and gives step by step instructions (with screen shots) for doing this.
Windows systems have the ability to save credentials (login information) for various purposes, for each user profile / login. The state of saved credentials is accessible through Control Panel | Credential Manager. For launching applications with elevated privileges, we are interested in Windows Credentials
. The process described here will save Administrator login credentials to support launching applications with elevated privileges.
While it may seem possible to store credentials manually
for this purpose in Control Panel | Credential Manager, the credential needed has to be created by running particular programs. And the credential created this way doesn’t appear to work for other more general purposes – which would be a security concern.
Getting Ready to Create a Desktop Shortcut Icon
Setting up the shortcut requires creating some fairly long settings or “strings” of characters. So, to accommodate doing that with some copy and paste, we suggest using the Notepad application. This helps to avoid typos and provides strings that can be proofread as well as used for copying.
The first step is to log into the computer as the Standard User who will be using this shortcut. Open Notepad. Just type “notepad” in “Search programs and files”.
Here’s what the beginning of a filled-in notepad page might look like:
Here, we have entered the name of the computer that will have the new icon on the desktop and the name of the Administrator that will be used for the purpose of elevating the application’s privileges.
Next, find the program that the shortcut will be used to launch and add its name with the full path to the notepad:
The quote marks “ are important because there may be blank spaces in the sequence. So, it’s easiest to just include them.
The shortcut icon is going to be set up to run this program.
The template for the icon target is:
C:\Windows\system32\runas.exe /user:[computername]\[name of Administrator] /savecred [program]
So, using this template, simply copy and paste the strings for the computername, the name of Administrator and, at the end of the line, the full path to the program.
Creating the Shortcut Icon Right click anywhere in the desktop background. Select New | Shortcut:
The Create Shortcut dialog will open. Paste what you COPIED from the Notepad into the box:
Press NEXT to label the shortcut:
Type the name of the shortcut / the label for the Icon, into the box.
The shortcut will appear on the desktop.
Initializing the Shortcut with the Administrator Password
Double left-click on the new icon.
A command prompt window will open asking for the Administrator password.
Type in the password matching the Administrator name you used above. (It will not be displayed at all).
Press ENTER and the program window will open.
Then, close the program window.
Testing the Shortcut with the Administrator Password
Double left-click on the new icon. (A command prompt window may open briefly).
Now the program window will open.
The program will have Administrator privileges and no password is required from the user.
Changing the Icon Picture
You may want to change the shortcut icon picture. To do that:
Summary and Notes:
- First, find the file location for the icon (presumably for the program) - possibly from the Properties of an existing icon.
- Copy the full path to the desired icon or the file containing it.
- Right click on the desktop shortcut icon.
- Select Properties.
- Select Change Icon.
- Paste the full path of the desired icon into “Look for icons in this file"
Following these fairly simple steps, you can create shortcut icons to launch programs with privileges elevated to "as Administrator" level - particularly useful to assist those logged in as a Standard User and when the necessity arises. The actual user need not know the Administrator password that was used nor will have access to it. However, because the credential has been saved, with skillful creation of new shortcut icons, other shortcuts can be crafted that will launch other applications with the same elevated privileges. That possibility remains a security risk - although less than the risk of running with an Administrator login. Use at your own risk.
For further reading on this caution: http://www.derkeiler.com/Mailing-Lists/NT-Bugtraq/2003-07/0069.html