SEARCH

How-To Geek

How To Create a Shortcut That Lets a Standard User Run An Application as Administrator

image

Want to allow a standard user account to run an application as administrator without a UAC or password prompt? You can easily create a shortcut that uses the runas command with the /savecred switch, which saves the password.

Note that using /savecred could be considered a security hole – a standard user will be able to use the runas /savecred command to run any command as administrator without entering a password. However, it’s still useful for situations where this doesn’t matter much – perhaps you want to allow a child’s standard user account to run a game as Administrator without asking you.

We’ve also covered allowing a user to run an application as Administrator with no UAC prompts by creating a scheduled task.

Enabling the Administrator Account

First you’ll need to enable the built-in Administrator account, which is disabled by default.

To do so, search for Command Prompt in the Start menu, right-click the Command Prompt shortcut, and select Run as administrator.

image

Run the following command in the elevated Command Prompt window that appears:

net user administrator /active:yes

image

The Administrator user account is now enabled, although it has no password.

To set a password, open the Control Panel, select User Accounts and Family Safety, and select User Accounts. Click the Manage another account link in the User Accounts window.

image

Select the Administrator account, click Create a password, and create a password for the Administrator account.

image

Creating the Shortcut

Now we’ll create a new shortcut that launches the application with Administrator privileges.

Right-click the desktop (or elsewhere), point to New, and select Shortcut.

image

Enter a command based on the following one into the box that appears:

runas /user:ComputerName\Administrator /savecred “C:\Path\To\Program.exe

Replace ComputerName with the name of your computer and C:\Path\To\Program.exe with the full path of the program you want to run. For example, if your computer’s name was Laptop and you wanted to run CCleaner, you’d enter the following path:

runas /user:Laptop\Administrator /savecred “C:\Program Files\CCleaner\CCleaner.exe”

image

Enter a name for the shortcut.

image

To select an icon for your new shortcut, right-click it and select Properties.

image

Click the Change Icon button in the Properties window.

image

Select an icon for your shortcut. For example, you can browser to CCleaner.exe and choose an icon associated with it. If you’re using an other program, browse to its .exe file and select your preferred icon.

image

The first time you double-click your shortcut, you’ll be prompted to enter the Administrator account’s password, which you created earlier.

image

This password will be saved – the next time you double-click the shortcut, the application will launch as Administrator without asking you for a password.


As we mentioned above, the standard user account now has the ability to run any application as Administrator without entering a password (using the runas /savecred command to launch any .exe file), so bear that in mind.

The Administrator password is saved in the Windows Credential Manager – if you want to remove the saved password, you can do it from there.

Chris Hoffman is a technology writer and all-around computer geek. He's as at home using the Linux terminal as he is digging into the Windows registry. Connect with him on Google+.

  • Published 09/10/12

Comments (15)

  1. andyr354

    You must be a mind reader. I need to do this for a poorly written program on a users system today!!

    Andy

  2. andyr354

    I am on a domain system though and will not be using the local admin account but a domain admin.

  3. chess

    cool saved for later.

  4. Iszi

    @andyr354 Due to the security risk mentioned in the article, I wouldn’t recommend using a Domain Admin account for your script. Instead, use a different account which is still a member of the local Administrators group.

    Speaking of which, I’m glad to see HowToGeek mentioning that security risk in this walkthrough – things like this get missed all too often in articles like these. I’m also rather pleased to see that there is a way to do this without saving the password in a plaintext script file. Unfortunately, this does mean that the sysadmin probably needs to log into the machine once every morning to save the credentials.

    Another option you might want to consider is Sudowin. (http://sourceforge.net/projects/sudowin/) This allows users to be added to a “Sudoers” group, which permits them to elevate privileges for their own accounts on-demand. You can also set up restrictions so that they are only allowed to do this with certain programs.

    The significant down-side of any of these solutions however, is that you’re still allowing users to run a program under an Administrator-level account. If they’re allowed these privileges for any program that has a standard Open or Save As dialog, they can use that function to break out of whatever restriction you’ve placed on them in order to run any program of their choice as an Administrator. It’s much better, security-wise, to find a solution that does not require the user to have Administrator privileges at all.

  5. r

    @andyr35

    If you are on a domain an administrator needs to give your profile permission in group policies through Active Directory —easy stuff

  6. Binaryphile

    This is a great trick. If you need to do this for more than just a couple applications, I suggest looking at Surun.

    It’s a free tool that allows you to elevate from a normal user to administrator on demand. You can either right-click the application and start it as an administrator in the context menu, or you can right-click the titlebar of a running application and choose to restart it as administrator.

    I use it as a tool that enables true LUA…I run as a limited user all of the time, except when I choose to promote an application to an admin. I view using Windows built-in limited user restrictions as more reliably safe than running as admin + UAC.

    You can tell it to remember to run certain applications as administrator always. It’s got a fairly sophisticated control panel of options.

    The website for it is in German, but there’s a link for English translation near the top.

  7. heligo

    Once you’ve created the RunAs shortcut, is the Standard User then able to change the target to another program like setup.exe for example? Or is the target unchangable. Or do changes require authentication?

  8. Iszi

    @heligo If the shortcut is in the user’s profile, then the user can change it easily at-will. If it’s in one of the All Users folders though, it may require Admin access for them to change the target. The important thing to remember though, is that they don’t need to change the shortcut’s target – they can use runas with /savecred from their own command prompt, run dialog, or a new shortcut, and have the same effect.

  9. Iszi

    Another note about /savecred, from runas /?: It is not available on Windows 7 Home or Starter editions.

  10. KMFDMKid2000

    Thank you for this. One of the best tips in a long time.

  11. Oosterhagen

    Strange, I needed this yesterday on XP. I used to use a good freeware tool for it called “Raise my rights” It places a shortcut to any program in a desired location. Works flawless but haven’t tried it with W7.

    Added bonus is that it also checks if the intended program is tampered with. If the program is changed it asks for the Administra tor password again.

    You can find it at http://pmcchp.com/rmr/index.html

  12. Jorge

    Thank you

  13. Ali Ponjait

    Great tips…. Really useful for me…. Saved me from several log in and log out..

  14. johnx

    This isn’t working for me. When trying to run the shortcut for the first time, I am unable to enter any text when it asks for the password. It’s like the cmd won’t accept any keyboard input. AARrrgh….

  15. Randal Oulton

    You are kidding me. Making a Julia Child recipe would be faster and less work.

    How about Microsoft implements something along the line of a prompt that says “do you want to trust this program (this time only) or (always).” You select “always” and the machine remembers and you’re done.

    Unreal the steps you’d have have to go through to achieve this. Thanks for documenting them, though.

Get Free Articles in Your Inbox!

Join 134,000 newsletter readers

Email:

Go check your email!