Force a program to run *without* administrator privileges or UAC?












111















Is there any way that I can force a program that normally requires administrator privileges (via UAC) to run without them? (ie: no UAC prompt and no system-wide access.)



Added: Without modifying the executable itself.





In spite of James's answer, I have found a few ways that it can almost be done:




  1. By modifying the executable I can remove the trustInfo entry from the manifest (or the manifest entirely, so I can use an external one), allowing the program to start without UAC. Unfortunately this modifies the executable, so it exits shortly after due to an internal checksum test.

  2. By using Process Explorer I can launch it as a Limited User. However this seems to limit it significantly more than I would like (it runs like Protected Mode IE and so can access significantly less than what my standard un-elevated user can).










share|improve this question




















  • 1





    You specify not modifying the executable, yet modifying the .exe is one of your attempted ways?

    – cutrightjm
    Apr 20 '12 at 4:39






  • 2





    @ekaj I only specified that after I found out that it wouldn't work ;)

    – Andrew Russell
    Apr 21 '12 at 15:29











  • Could you maybe specify the program, even if you don't use it anymore? That might help people to know what it is trying to access that requires admin privileges

    – cutrightjm
    Apr 21 '12 at 16:45











  • @ekaj Unfortunately not. However it's not especially relevant: UAC is triggered by a program asking for elevation during process creation (the usual way - as in this case - is with a manifest). Once a process is started, it cannot change its elevation status - no matter what restricted resources it tries to access.

    – Andrew Russell
    Apr 22 '12 at 4:59











  • If a program has no manifest and refuses to run with no admin privileges, it is most likely due to UAC Installer Detection. I posted this question and misha256 has a good solution. I tested it and I can confirm that it works. superuser.com/questions/857616/… I did some research and I found that there is no reason for Installer Detection to exist. Note that if the admin privileges are due to a trustinfo entry in a manifest, obviously this will not work.

    – user1258361
    Dec 29 '14 at 0:28
















111















Is there any way that I can force a program that normally requires administrator privileges (via UAC) to run without them? (ie: no UAC prompt and no system-wide access.)



Added: Without modifying the executable itself.





In spite of James's answer, I have found a few ways that it can almost be done:




  1. By modifying the executable I can remove the trustInfo entry from the manifest (or the manifest entirely, so I can use an external one), allowing the program to start without UAC. Unfortunately this modifies the executable, so it exits shortly after due to an internal checksum test.

  2. By using Process Explorer I can launch it as a Limited User. However this seems to limit it significantly more than I would like (it runs like Protected Mode IE and so can access significantly less than what my standard un-elevated user can).










share|improve this question




















  • 1





    You specify not modifying the executable, yet modifying the .exe is one of your attempted ways?

    – cutrightjm
    Apr 20 '12 at 4:39






  • 2





    @ekaj I only specified that after I found out that it wouldn't work ;)

    – Andrew Russell
    Apr 21 '12 at 15:29











  • Could you maybe specify the program, even if you don't use it anymore? That might help people to know what it is trying to access that requires admin privileges

    – cutrightjm
    Apr 21 '12 at 16:45











  • @ekaj Unfortunately not. However it's not especially relevant: UAC is triggered by a program asking for elevation during process creation (the usual way - as in this case - is with a manifest). Once a process is started, it cannot change its elevation status - no matter what restricted resources it tries to access.

    – Andrew Russell
    Apr 22 '12 at 4:59











  • If a program has no manifest and refuses to run with no admin privileges, it is most likely due to UAC Installer Detection. I posted this question and misha256 has a good solution. I tested it and I can confirm that it works. superuser.com/questions/857616/… I did some research and I found that there is no reason for Installer Detection to exist. Note that if the admin privileges are due to a trustinfo entry in a manifest, obviously this will not work.

    – user1258361
    Dec 29 '14 at 0:28














111












111








111


67






Is there any way that I can force a program that normally requires administrator privileges (via UAC) to run without them? (ie: no UAC prompt and no system-wide access.)



Added: Without modifying the executable itself.





In spite of James's answer, I have found a few ways that it can almost be done:




  1. By modifying the executable I can remove the trustInfo entry from the manifest (or the manifest entirely, so I can use an external one), allowing the program to start without UAC. Unfortunately this modifies the executable, so it exits shortly after due to an internal checksum test.

  2. By using Process Explorer I can launch it as a Limited User. However this seems to limit it significantly more than I would like (it runs like Protected Mode IE and so can access significantly less than what my standard un-elevated user can).










share|improve this question
















Is there any way that I can force a program that normally requires administrator privileges (via UAC) to run without them? (ie: no UAC prompt and no system-wide access.)



Added: Without modifying the executable itself.





In spite of James's answer, I have found a few ways that it can almost be done:




  1. By modifying the executable I can remove the trustInfo entry from the manifest (or the manifest entirely, so I can use an external one), allowing the program to start without UAC. Unfortunately this modifies the executable, so it exits shortly after due to an internal checksum test.

  2. By using Process Explorer I can launch it as a Limited User. However this seems to limit it significantly more than I would like (it runs like Protected Mode IE and so can access significantly less than what my standard un-elevated user can).







windows administrator uac






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Aug 4 '10 at 16:09







Andrew Russell

















asked Aug 4 '10 at 13:49









Andrew RussellAndrew Russell

7653711




7653711








  • 1





    You specify not modifying the executable, yet modifying the .exe is one of your attempted ways?

    – cutrightjm
    Apr 20 '12 at 4:39






  • 2





    @ekaj I only specified that after I found out that it wouldn't work ;)

    – Andrew Russell
    Apr 21 '12 at 15:29











  • Could you maybe specify the program, even if you don't use it anymore? That might help people to know what it is trying to access that requires admin privileges

    – cutrightjm
    Apr 21 '12 at 16:45











  • @ekaj Unfortunately not. However it's not especially relevant: UAC is triggered by a program asking for elevation during process creation (the usual way - as in this case - is with a manifest). Once a process is started, it cannot change its elevation status - no matter what restricted resources it tries to access.

    – Andrew Russell
    Apr 22 '12 at 4:59











  • If a program has no manifest and refuses to run with no admin privileges, it is most likely due to UAC Installer Detection. I posted this question and misha256 has a good solution. I tested it and I can confirm that it works. superuser.com/questions/857616/… I did some research and I found that there is no reason for Installer Detection to exist. Note that if the admin privileges are due to a trustinfo entry in a manifest, obviously this will not work.

    – user1258361
    Dec 29 '14 at 0:28














  • 1





    You specify not modifying the executable, yet modifying the .exe is one of your attempted ways?

    – cutrightjm
    Apr 20 '12 at 4:39






  • 2





    @ekaj I only specified that after I found out that it wouldn't work ;)

    – Andrew Russell
    Apr 21 '12 at 15:29











  • Could you maybe specify the program, even if you don't use it anymore? That might help people to know what it is trying to access that requires admin privileges

    – cutrightjm
    Apr 21 '12 at 16:45











  • @ekaj Unfortunately not. However it's not especially relevant: UAC is triggered by a program asking for elevation during process creation (the usual way - as in this case - is with a manifest). Once a process is started, it cannot change its elevation status - no matter what restricted resources it tries to access.

    – Andrew Russell
    Apr 22 '12 at 4:59











  • If a program has no manifest and refuses to run with no admin privileges, it is most likely due to UAC Installer Detection. I posted this question and misha256 has a good solution. I tested it and I can confirm that it works. superuser.com/questions/857616/… I did some research and I found that there is no reason for Installer Detection to exist. Note that if the admin privileges are due to a trustinfo entry in a manifest, obviously this will not work.

    – user1258361
    Dec 29 '14 at 0:28








1




1





You specify not modifying the executable, yet modifying the .exe is one of your attempted ways?

– cutrightjm
Apr 20 '12 at 4:39





You specify not modifying the executable, yet modifying the .exe is one of your attempted ways?

– cutrightjm
Apr 20 '12 at 4:39




2




2





@ekaj I only specified that after I found out that it wouldn't work ;)

– Andrew Russell
Apr 21 '12 at 15:29





@ekaj I only specified that after I found out that it wouldn't work ;)

– Andrew Russell
Apr 21 '12 at 15:29













Could you maybe specify the program, even if you don't use it anymore? That might help people to know what it is trying to access that requires admin privileges

– cutrightjm
Apr 21 '12 at 16:45





Could you maybe specify the program, even if you don't use it anymore? That might help people to know what it is trying to access that requires admin privileges

– cutrightjm
Apr 21 '12 at 16:45













@ekaj Unfortunately not. However it's not especially relevant: UAC is triggered by a program asking for elevation during process creation (the usual way - as in this case - is with a manifest). Once a process is started, it cannot change its elevation status - no matter what restricted resources it tries to access.

– Andrew Russell
Apr 22 '12 at 4:59





@ekaj Unfortunately not. However it's not especially relevant: UAC is triggered by a program asking for elevation during process creation (the usual way - as in this case - is with a manifest). Once a process is started, it cannot change its elevation status - no matter what restricted resources it tries to access.

– Andrew Russell
Apr 22 '12 at 4:59













If a program has no manifest and refuses to run with no admin privileges, it is most likely due to UAC Installer Detection. I posted this question and misha256 has a good solution. I tested it and I can confirm that it works. superuser.com/questions/857616/… I did some research and I found that there is no reason for Installer Detection to exist. Note that if the admin privileges are due to a trustinfo entry in a manifest, obviously this will not work.

– user1258361
Dec 29 '14 at 0:28





If a program has no manifest and refuses to run with no admin privileges, it is most likely due to UAC Installer Detection. I posted this question and misha256 has a good solution. I tested it and I can confirm that it works. superuser.com/questions/857616/… I did some research and I found that there is no reason for Installer Detection to exist. Note that if the admin privileges are due to a trustinfo entry in a manifest, obviously this will not work.

– user1258361
Dec 29 '14 at 0:28










9 Answers
9






active

oldest

votes


















68














Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT*shellforcerunasinvoker]
@="Run without privilege elevation"

[HKEY_CLASSES_ROOT*shellforcerunasinvokercommand]
@="cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "%1"""


Save this text in <name_of_file>.reg and add it to the Windows Registry. (Double-clicking on it should do the trick.)



Afterwards, right-click the app you'd like to run without administrative privileges and select "Run without privilege elevation".



In some cases - small amount 0.1% of programs may ask twice about UAC prompt.






share|improve this answer





















  • 1





    I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better.

    – Ben Voigt
    Apr 17 '13 at 21:28






  • 1





    Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn " into ").

    – Andrew Russell
    Dec 29 '14 at 15:33











  • @Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks!

    – Derek
    Jan 6 '15 at 16:25








  • 1





    I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality..

    – Gizmo
    Mar 11 '15 at 22:19






  • 1





    @jpmc26 I think the /min is an error. The solution works exactly the same without it. Vom must have mixed up cmd and start switches. It seems that cmd.exe doesn't complain of wrong switches. Try cmd /whatever, for example.

    – cdlvcdlv
    Jul 2 '17 at 11:50





















47














Save to nonadmin.bat:



cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"


Now you can drag and drop programs to this to run them without admin.



This doesn't require admin privileges as changing that registry key does. Also you won't clutter the context menu.



Based on Vom's answer





Update: Should now work with programs that have spaces in name as well.






share|improve this answer


























  • I tried it on some programs requiring access on my drives and it couldn't detect them or didn't work in the first place :/ (rufus rufus.akeo.ie for example)

    – keinabel
    Apr 11 '16 at 19:04






  • 6





    @keinabel That's probably because they actually needed admin to work. This script is for programs which demands admin privileges without actually doing something which requires it. Raw access to drives is a typical admin-thing.

    – Hjulle
    Apr 11 '16 at 19:23






  • 2





    Pretty neat! Was able to install XAMPP using this method.

    – Krishnaraj
    Aug 8 '16 at 9:31











  • This doesn't seem to be working for me for any executables in the "C:Program Files..." directory. I get a Windows cannot find 'C:Program'. Make sure you typed the name correctly, and then try again. I've tried this command manually several times with slight variations and no luck. Any ideas?

    – Jake Smith
    Sep 30 '16 at 18:09






  • 1





    I had the same issue with the location of the file being in a folder with spaces. Solved it removing some double quotes: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"

    – ragnar
    Feb 13 '17 at 17:30





















32














I hope I'm not too late to the party, but I was looking for a similar question and without seeing an answer here I found out that Windows' builtin RunAscommand, when run as administrator, can do that with /trustlevel switch.



RUNAS /trustlevel:<TrustLevel> program

/showtrustlevels displays the trust levels that can be used
as arguments to /trustlevel.
/trustlevel <Level> should be one of levels enumerated
in /showtrustlevels.


This worked in my case.
Ironically, starting a program explicitly without elevation requires an elevated command prompt. Go figure. :)
I hope it helps you.






share|improve this answer


























  • I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation".

    – user1258361
    Dec 28 '14 at 3:21






  • 8





    @user1258361 you have to run this command from elevated prompt, just like I wrote in bold...

    – Mxx
    Dec 28 '14 at 4:01











  • It doesn't seem to require an elevated prompt on Windows 7...

    – SamB
    Sep 9 '15 at 1:23






  • 3





    Tested with elevated prompt, used command line runas /trustlevel:0x20000 (program), program ran as admin anyway. For reference, 0x20000 is basic user.

    – user1258361
    Jan 15 '17 at 23:21






  • 1





    requires an elevated command prompt...of course it does. Otherwise you're already without admin rights and any process you start will also lack them.

    – Twisty Impersonator
    Jan 20 '18 at 2:24



















13














If you have a particular application that you want to always run without UAC, you can target it with the Registry (add the text to a REG file and import it into the Registry):



Windows Registry Editor Version 5.00

[HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsLayers]
"C:\example\application.exe"="RunAsInvoker"


Unlike this answer, this solution requires no alternate click or change to user interaction.



Microsoft calls this process adding the RunAsInvoker "Compatibility Shim".






share|improve this answer


























  • The answer to a different, yet related question provided the inspiration for this answer.

    – palswim
    Sep 9 '16 at 20:17








  • 1





    Thank you very much! This was the only thing worked for me! I had am Application which was being called from the windows context menu, and it was always coming up as administrator, despite it being called correctly from everywhere else. After this fix, the application started being called correctly.

    – user
    May 6 '17 at 17:55



















3














I solved this problem today using the MS application customization toolkit.



I followed the instructions in a tech republic article.



Basically:



1) you get the toolkit from MS here .



2) Click Fix



3) Choose the RunAsInvoker option



4) Right Click the fix and choose Install






share|improve this answer


























  • Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question.

    – Mxx
    Jan 22 '14 at 14:07











  • @mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether.

    – LogicDaemon
    Mar 29 '15 at 9:54











  • @LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for.

    – Mxx
    Mar 29 '15 at 14:35











  • @mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps.

    – LogicDaemon
    Mar 30 '15 at 11:53













  • As long as Explorer, a non-admin cmd, or any other standard process is the parent, RunAsInvoker will run with the same limited rights. (Explorer runs restricted by default, otherwise it would never ask you to elevate to delete a file.) It actually seems to work even with new apps. RunAsInvoker means it inherits the exact same ACL token.

    – SilverbackNet
    Oct 30 '15 at 5:59





















1














While in his question Andrew stated that the following did not quite work:




By modifying the executable I can remove the trustInfo entry from the
manifest (or the manifest entirely, so I can use an external one),
allowing the program to start without UAC. Unfortunately this modifies
the executable, so it exits shortly after due to an internal checksum
test.




I was able to modify an external .manifest file for the software I was using and change



<ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false" />



to



<ms_asmv2:requestedExecutionLevel level="asInvoker" uiAccess="false" />



Turns out the software I was using did not really require administrator rights so I was able to run it on a Standard User account without UAC or administrator passwords. Thanks!






share|improve this answer
























  • It might be easier to edit the executable instead, as the manifest may just be included in the file. Note that the namespace prefix ms_asmv2: might also be omitted. Also, it is possible that changing the size of the embedded xml block may corrupt the binary, so "requireAdministrator" should be changed to "asInvoker" padded to the same length with spaces before uiAccess.

    – kdb
    Feb 13 at 16:33





















-1














I fixed this problem by going changing the permissions on the folder that contained the program.



I added each user that will run that program and gave them "full control" priviledges. That took care of the problem and I left the "run as admin" unchecked.



I don't have any security concerns for the users who will be running the program.






share|improve this answer

































    -1














    If it's a setup (installation) exe file that is requiring administration privilege, there's a trick to run it without elevated access:



    If the file's name contains words like setup or install windows forcefully runs it with elevated access even if it doesn't need elevated access:



    enter image description here






    share|improve this answer



















    • 1





      Of course, that only works when the application manifest doesn’t explicitly specify it must run elevated.

      – Daniel B
      Jan 25 at 11:57






    • 1





      @DanielB: in fact this trick only works when there is no manifest

      – AntoineL
      Mar 5 at 15:33



















    -4














    No, if a program requires UAC then it is trying to access something outside of its sandbox. The program will not correctly run without the elevated access.



    If you just want to get rid of the notification, you can disable UAC.



    Disable UAC on Windows Vista: Start, type "user". Click on "User Accounts". On the window that pops up, click on "User Account Control Settings" and then Turn off UAC.



    Disable UAC on Windows 7: Start, type "user". Click on "User Account Control Settings". Drag the choice bar all the way to the bottom to "Never Notify."






    share|improve this answer



















    • 5





      Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors.

      – Andrew Russell
      Aug 4 '10 at 14:32











    • Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access.

      – James Watt
      Aug 4 '10 at 14:47











    • James: Actually - it looks like you can - I've updated my question.

      – Andrew Russell
      Aug 4 '10 at 16:11











    • Short of modifying the program code itself, I would be interested to know of a working solution if you find one.

      – James Watt
      Aug 5 '10 at 5:17










    protected by Community Sep 22 '15 at 19:34



    Thank you for your interest in this question.
    Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).



    Would you like to answer one of these unanswered questions instead?














    9 Answers
    9






    active

    oldest

    votes








    9 Answers
    9






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    68














    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT*shellforcerunasinvoker]
    @="Run without privilege elevation"

    [HKEY_CLASSES_ROOT*shellforcerunasinvokercommand]
    @="cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "%1"""


    Save this text in <name_of_file>.reg and add it to the Windows Registry. (Double-clicking on it should do the trick.)



    Afterwards, right-click the app you'd like to run without administrative privileges and select "Run without privilege elevation".



    In some cases - small amount 0.1% of programs may ask twice about UAC prompt.






    share|improve this answer





















    • 1





      I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better.

      – Ben Voigt
      Apr 17 '13 at 21:28






    • 1





      Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn " into ").

      – Andrew Russell
      Dec 29 '14 at 15:33











    • @Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks!

      – Derek
      Jan 6 '15 at 16:25








    • 1





      I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality..

      – Gizmo
      Mar 11 '15 at 22:19






    • 1





      @jpmc26 I think the /min is an error. The solution works exactly the same without it. Vom must have mixed up cmd and start switches. It seems that cmd.exe doesn't complain of wrong switches. Try cmd /whatever, for example.

      – cdlvcdlv
      Jul 2 '17 at 11:50


















    68














    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT*shellforcerunasinvoker]
    @="Run without privilege elevation"

    [HKEY_CLASSES_ROOT*shellforcerunasinvokercommand]
    @="cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "%1"""


    Save this text in <name_of_file>.reg and add it to the Windows Registry. (Double-clicking on it should do the trick.)



    Afterwards, right-click the app you'd like to run without administrative privileges and select "Run without privilege elevation".



    In some cases - small amount 0.1% of programs may ask twice about UAC prompt.






    share|improve this answer





















    • 1





      I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better.

      – Ben Voigt
      Apr 17 '13 at 21:28






    • 1





      Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn " into ").

      – Andrew Russell
      Dec 29 '14 at 15:33











    • @Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks!

      – Derek
      Jan 6 '15 at 16:25








    • 1





      I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality..

      – Gizmo
      Mar 11 '15 at 22:19






    • 1





      @jpmc26 I think the /min is an error. The solution works exactly the same without it. Vom must have mixed up cmd and start switches. It seems that cmd.exe doesn't complain of wrong switches. Try cmd /whatever, for example.

      – cdlvcdlv
      Jul 2 '17 at 11:50
















    68












    68








    68







    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT*shellforcerunasinvoker]
    @="Run without privilege elevation"

    [HKEY_CLASSES_ROOT*shellforcerunasinvokercommand]
    @="cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "%1"""


    Save this text in <name_of_file>.reg and add it to the Windows Registry. (Double-clicking on it should do the trick.)



    Afterwards, right-click the app you'd like to run without administrative privileges and select "Run without privilege elevation".



    In some cases - small amount 0.1% of programs may ask twice about UAC prompt.






    share|improve this answer















    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT*shellforcerunasinvoker]
    @="Run without privilege elevation"

    [HKEY_CLASSES_ROOT*shellforcerunasinvokercommand]
    @="cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "%1"""


    Save this text in <name_of_file>.reg and add it to the Windows Registry. (Double-clicking on it should do the trick.)



    Afterwards, right-click the app you'd like to run without administrative privileges and select "Run without privilege elevation".



    In some cases - small amount 0.1% of programs may ask twice about UAC prompt.







    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited Mar 6 '18 at 20:46







    user477799

















    answered Jul 18 '12 at 15:20









    VomVom

    71263




    71263








    • 1





      I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better.

      – Ben Voigt
      Apr 17 '13 at 21:28






    • 1





      Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn " into ").

      – Andrew Russell
      Dec 29 '14 at 15:33











    • @Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks!

      – Derek
      Jan 6 '15 at 16:25








    • 1





      I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality..

      – Gizmo
      Mar 11 '15 at 22:19






    • 1





      @jpmc26 I think the /min is an error. The solution works exactly the same without it. Vom must have mixed up cmd and start switches. It seems that cmd.exe doesn't complain of wrong switches. Try cmd /whatever, for example.

      – cdlvcdlv
      Jul 2 '17 at 11:50
















    • 1





      I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better.

      – Ben Voigt
      Apr 17 '13 at 21:28






    • 1





      Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn " into ").

      – Andrew Russell
      Dec 29 '14 at 15:33











    • @Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks!

      – Derek
      Jan 6 '15 at 16:25








    • 1





      I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality..

      – Gizmo
      Mar 11 '15 at 22:19






    • 1





      @jpmc26 I think the /min is an error. The solution works exactly the same without it. Vom must have mixed up cmd and start switches. It seems that cmd.exe doesn't complain of wrong switches. Try cmd /whatever, for example.

      – cdlvcdlv
      Jul 2 '17 at 11:50










    1




    1





    I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better.

    – Ben Voigt
    Apr 17 '13 at 21:28





    I used to use the Application Compatibility Toolkit shim, but that was a lot of work for each executable and left junk in the registry for each file as well. This method works and I like it a lot better.

    – Ben Voigt
    Apr 17 '13 at 21:28




    1




    1





    Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn " into ").

    – Andrew Russell
    Dec 29 '14 at 15:33





    Accepting this as it seems to be the most straightforward method, and I've (finally!) been able to verify it. Also has the very nice property of being trivially usable as a once-off command line (remove the outer " and then turn " into ").

    – Andrew Russell
    Dec 29 '14 at 15:33













    @Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks!

    – Derek
    Jan 6 '15 at 16:25







    @Vom - Do you know of an easy way to get past programs that ask multiple times? Thanks!

    – Derek
    Jan 6 '15 at 16:25






    1




    1





    I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality..

    – Gizmo
    Mar 11 '15 at 22:19





    I have the same issue as @Derek, the application seems to constantly keep re-asking for UAC, I don't trust it with system wide access but I need its functionality..

    – Gizmo
    Mar 11 '15 at 22:19




    1




    1





    @jpmc26 I think the /min is an error. The solution works exactly the same without it. Vom must have mixed up cmd and start switches. It seems that cmd.exe doesn't complain of wrong switches. Try cmd /whatever, for example.

    – cdlvcdlv
    Jul 2 '17 at 11:50







    @jpmc26 I think the /min is an error. The solution works exactly the same without it. Vom must have mixed up cmd and start switches. It seems that cmd.exe doesn't complain of wrong switches. Try cmd /whatever, for example.

    – cdlvcdlv
    Jul 2 '17 at 11:50















    47














    Save to nonadmin.bat:



    cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"


    Now you can drag and drop programs to this to run them without admin.



    This doesn't require admin privileges as changing that registry key does. Also you won't clutter the context menu.



    Based on Vom's answer





    Update: Should now work with programs that have spaces in name as well.






    share|improve this answer


























    • I tried it on some programs requiring access on my drives and it couldn't detect them or didn't work in the first place :/ (rufus rufus.akeo.ie for example)

      – keinabel
      Apr 11 '16 at 19:04






    • 6





      @keinabel That's probably because they actually needed admin to work. This script is for programs which demands admin privileges without actually doing something which requires it. Raw access to drives is a typical admin-thing.

      – Hjulle
      Apr 11 '16 at 19:23






    • 2





      Pretty neat! Was able to install XAMPP using this method.

      – Krishnaraj
      Aug 8 '16 at 9:31











    • This doesn't seem to be working for me for any executables in the "C:Program Files..." directory. I get a Windows cannot find 'C:Program'. Make sure you typed the name correctly, and then try again. I've tried this command manually several times with slight variations and no luck. Any ideas?

      – Jake Smith
      Sep 30 '16 at 18:09






    • 1





      I had the same issue with the location of the file being in a folder with spaces. Solved it removing some double quotes: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"

      – ragnar
      Feb 13 '17 at 17:30


















    47














    Save to nonadmin.bat:



    cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"


    Now you can drag and drop programs to this to run them without admin.



    This doesn't require admin privileges as changing that registry key does. Also you won't clutter the context menu.



    Based on Vom's answer





    Update: Should now work with programs that have spaces in name as well.






    share|improve this answer


























    • I tried it on some programs requiring access on my drives and it couldn't detect them or didn't work in the first place :/ (rufus rufus.akeo.ie for example)

      – keinabel
      Apr 11 '16 at 19:04






    • 6





      @keinabel That's probably because they actually needed admin to work. This script is for programs which demands admin privileges without actually doing something which requires it. Raw access to drives is a typical admin-thing.

      – Hjulle
      Apr 11 '16 at 19:23






    • 2





      Pretty neat! Was able to install XAMPP using this method.

      – Krishnaraj
      Aug 8 '16 at 9:31











    • This doesn't seem to be working for me for any executables in the "C:Program Files..." directory. I get a Windows cannot find 'C:Program'. Make sure you typed the name correctly, and then try again. I've tried this command manually several times with slight variations and no luck. Any ideas?

      – Jake Smith
      Sep 30 '16 at 18:09






    • 1





      I had the same issue with the location of the file being in a folder with spaces. Solved it removing some double quotes: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"

      – ragnar
      Feb 13 '17 at 17:30
















    47












    47








    47







    Save to nonadmin.bat:



    cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"


    Now you can drag and drop programs to this to run them without admin.



    This doesn't require admin privileges as changing that registry key does. Also you won't clutter the context menu.



    Based on Vom's answer





    Update: Should now work with programs that have spaces in name as well.






    share|improve this answer















    Save to nonadmin.bat:



    cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"


    Now you can drag and drop programs to this to run them without admin.



    This doesn't require admin privileges as changing that registry key does. Also you won't clutter the context menu.



    Based on Vom's answer





    Update: Should now work with programs that have spaces in name as well.







    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited Mar 24 '17 at 8:35

























    answered Oct 2 '15 at 11:27









    HjulleHjulle

    686615




    686615













    • I tried it on some programs requiring access on my drives and it couldn't detect them or didn't work in the first place :/ (rufus rufus.akeo.ie for example)

      – keinabel
      Apr 11 '16 at 19:04






    • 6





      @keinabel That's probably because they actually needed admin to work. This script is for programs which demands admin privileges without actually doing something which requires it. Raw access to drives is a typical admin-thing.

      – Hjulle
      Apr 11 '16 at 19:23






    • 2





      Pretty neat! Was able to install XAMPP using this method.

      – Krishnaraj
      Aug 8 '16 at 9:31











    • This doesn't seem to be working for me for any executables in the "C:Program Files..." directory. I get a Windows cannot find 'C:Program'. Make sure you typed the name correctly, and then try again. I've tried this command manually several times with slight variations and no luck. Any ideas?

      – Jake Smith
      Sep 30 '16 at 18:09






    • 1





      I had the same issue with the location of the file being in a folder with spaces. Solved it removing some double quotes: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"

      – ragnar
      Feb 13 '17 at 17:30





















    • I tried it on some programs requiring access on my drives and it couldn't detect them or didn't work in the first place :/ (rufus rufus.akeo.ie for example)

      – keinabel
      Apr 11 '16 at 19:04






    • 6





      @keinabel That's probably because they actually needed admin to work. This script is for programs which demands admin privileges without actually doing something which requires it. Raw access to drives is a typical admin-thing.

      – Hjulle
      Apr 11 '16 at 19:23






    • 2





      Pretty neat! Was able to install XAMPP using this method.

      – Krishnaraj
      Aug 8 '16 at 9:31











    • This doesn't seem to be working for me for any executables in the "C:Program Files..." directory. I get a Windows cannot find 'C:Program'. Make sure you typed the name correctly, and then try again. I've tried this command manually several times with slight variations and no luck. Any ideas?

      – Jake Smith
      Sep 30 '16 at 18:09






    • 1





      I had the same issue with the location of the file being in a folder with spaces. Solved it removing some double quotes: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"

      – ragnar
      Feb 13 '17 at 17:30



















    I tried it on some programs requiring access on my drives and it couldn't detect them or didn't work in the first place :/ (rufus rufus.akeo.ie for example)

    – keinabel
    Apr 11 '16 at 19:04





    I tried it on some programs requiring access on my drives and it couldn't detect them or didn't work in the first place :/ (rufus rufus.akeo.ie for example)

    – keinabel
    Apr 11 '16 at 19:04




    6




    6





    @keinabel That's probably because they actually needed admin to work. This script is for programs which demands admin privileges without actually doing something which requires it. Raw access to drives is a typical admin-thing.

    – Hjulle
    Apr 11 '16 at 19:23





    @keinabel That's probably because they actually needed admin to work. This script is for programs which demands admin privileges without actually doing something which requires it. Raw access to drives is a typical admin-thing.

    – Hjulle
    Apr 11 '16 at 19:23




    2




    2





    Pretty neat! Was able to install XAMPP using this method.

    – Krishnaraj
    Aug 8 '16 at 9:31





    Pretty neat! Was able to install XAMPP using this method.

    – Krishnaraj
    Aug 8 '16 at 9:31













    This doesn't seem to be working for me for any executables in the "C:Program Files..." directory. I get a Windows cannot find 'C:Program'. Make sure you typed the name correctly, and then try again. I've tried this command manually several times with slight variations and no luck. Any ideas?

    – Jake Smith
    Sep 30 '16 at 18:09





    This doesn't seem to be working for me for any executables in the "C:Program Files..." directory. I get a Windows cannot find 'C:Program'. Make sure you typed the name correctly, and then try again. I've tried this command manually several times with slight variations and no luck. Any ideas?

    – Jake Smith
    Sep 30 '16 at 18:09




    1




    1





    I had the same issue with the location of the file being in a folder with spaces. Solved it removing some double quotes: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"

    – ragnar
    Feb 13 '17 at 17:30







    I had the same issue with the location of the file being in a folder with spaces. Solved it removing some double quotes: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %1"

    – ragnar
    Feb 13 '17 at 17:30













    32














    I hope I'm not too late to the party, but I was looking for a similar question and without seeing an answer here I found out that Windows' builtin RunAscommand, when run as administrator, can do that with /trustlevel switch.



    RUNAS /trustlevel:<TrustLevel> program

    /showtrustlevels displays the trust levels that can be used
    as arguments to /trustlevel.
    /trustlevel <Level> should be one of levels enumerated
    in /showtrustlevels.


    This worked in my case.
    Ironically, starting a program explicitly without elevation requires an elevated command prompt. Go figure. :)
    I hope it helps you.






    share|improve this answer


























    • I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation".

      – user1258361
      Dec 28 '14 at 3:21






    • 8





      @user1258361 you have to run this command from elevated prompt, just like I wrote in bold...

      – Mxx
      Dec 28 '14 at 4:01











    • It doesn't seem to require an elevated prompt on Windows 7...

      – SamB
      Sep 9 '15 at 1:23






    • 3





      Tested with elevated prompt, used command line runas /trustlevel:0x20000 (program), program ran as admin anyway. For reference, 0x20000 is basic user.

      – user1258361
      Jan 15 '17 at 23:21






    • 1





      requires an elevated command prompt...of course it does. Otherwise you're already without admin rights and any process you start will also lack them.

      – Twisty Impersonator
      Jan 20 '18 at 2:24
















    32














    I hope I'm not too late to the party, but I was looking for a similar question and without seeing an answer here I found out that Windows' builtin RunAscommand, when run as administrator, can do that with /trustlevel switch.



    RUNAS /trustlevel:<TrustLevel> program

    /showtrustlevels displays the trust levels that can be used
    as arguments to /trustlevel.
    /trustlevel <Level> should be one of levels enumerated
    in /showtrustlevels.


    This worked in my case.
    Ironically, starting a program explicitly without elevation requires an elevated command prompt. Go figure. :)
    I hope it helps you.






    share|improve this answer


























    • I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation".

      – user1258361
      Dec 28 '14 at 3:21






    • 8





      @user1258361 you have to run this command from elevated prompt, just like I wrote in bold...

      – Mxx
      Dec 28 '14 at 4:01











    • It doesn't seem to require an elevated prompt on Windows 7...

      – SamB
      Sep 9 '15 at 1:23






    • 3





      Tested with elevated prompt, used command line runas /trustlevel:0x20000 (program), program ran as admin anyway. For reference, 0x20000 is basic user.

      – user1258361
      Jan 15 '17 at 23:21






    • 1





      requires an elevated command prompt...of course it does. Otherwise you're already without admin rights and any process you start will also lack them.

      – Twisty Impersonator
      Jan 20 '18 at 2:24














    32












    32








    32







    I hope I'm not too late to the party, but I was looking for a similar question and without seeing an answer here I found out that Windows' builtin RunAscommand, when run as administrator, can do that with /trustlevel switch.



    RUNAS /trustlevel:<TrustLevel> program

    /showtrustlevels displays the trust levels that can be used
    as arguments to /trustlevel.
    /trustlevel <Level> should be one of levels enumerated
    in /showtrustlevels.


    This worked in my case.
    Ironically, starting a program explicitly without elevation requires an elevated command prompt. Go figure. :)
    I hope it helps you.






    share|improve this answer















    I hope I'm not too late to the party, but I was looking for a similar question and without seeing an answer here I found out that Windows' builtin RunAscommand, when run as administrator, can do that with /trustlevel switch.



    RUNAS /trustlevel:<TrustLevel> program

    /showtrustlevels displays the trust levels that can be used
    as arguments to /trustlevel.
    /trustlevel <Level> should be one of levels enumerated
    in /showtrustlevels.


    This worked in my case.
    Ironically, starting a program explicitly without elevation requires an elevated command prompt. Go figure. :)
    I hope it helps you.







    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited Jul 21 '13 at 0:28

























    answered Jan 5 '12 at 8:15









    MxxMxx

    2,53821534




    2,53821534













    • I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation".

      – user1258361
      Dec 28 '14 at 3:21






    • 8





      @user1258361 you have to run this command from elevated prompt, just like I wrote in bold...

      – Mxx
      Dec 28 '14 at 4:01











    • It doesn't seem to require an elevated prompt on Windows 7...

      – SamB
      Sep 9 '15 at 1:23






    • 3





      Tested with elevated prompt, used command line runas /trustlevel:0x20000 (program), program ran as admin anyway. For reference, 0x20000 is basic user.

      – user1258361
      Jan 15 '17 at 23:21






    • 1





      requires an elevated command prompt...of course it does. Otherwise you're already without admin rights and any process you start will also lack them.

      – Twisty Impersonator
      Jan 20 '18 at 2:24



















    • I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation".

      – user1258361
      Dec 28 '14 at 3:21






    • 8





      @user1258361 you have to run this command from elevated prompt, just like I wrote in bold...

      – Mxx
      Dec 28 '14 at 4:01











    • It doesn't seem to require an elevated prompt on Windows 7...

      – SamB
      Sep 9 '15 at 1:23






    • 3





      Tested with elevated prompt, used command line runas /trustlevel:0x20000 (program), program ran as admin anyway. For reference, 0x20000 is basic user.

      – user1258361
      Jan 15 '17 at 23:21






    • 1





      requires an elevated command prompt...of course it does. Otherwise you're already without admin rights and any process you start will also lack them.

      – Twisty Impersonator
      Jan 20 '18 at 2:24

















    I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation".

    – user1258361
    Dec 28 '14 at 3:21





    I can confirm this does not work. I just tested it and got an error: "RUNAS ERROR: Unable to run - (program name here). The requested operation requires elevation".

    – user1258361
    Dec 28 '14 at 3:21




    8




    8





    @user1258361 you have to run this command from elevated prompt, just like I wrote in bold...

    – Mxx
    Dec 28 '14 at 4:01





    @user1258361 you have to run this command from elevated prompt, just like I wrote in bold...

    – Mxx
    Dec 28 '14 at 4:01













    It doesn't seem to require an elevated prompt on Windows 7...

    – SamB
    Sep 9 '15 at 1:23





    It doesn't seem to require an elevated prompt on Windows 7...

    – SamB
    Sep 9 '15 at 1:23




    3




    3





    Tested with elevated prompt, used command line runas /trustlevel:0x20000 (program), program ran as admin anyway. For reference, 0x20000 is basic user.

    – user1258361
    Jan 15 '17 at 23:21





    Tested with elevated prompt, used command line runas /trustlevel:0x20000 (program), program ran as admin anyway. For reference, 0x20000 is basic user.

    – user1258361
    Jan 15 '17 at 23:21




    1




    1





    requires an elevated command prompt...of course it does. Otherwise you're already without admin rights and any process you start will also lack them.

    – Twisty Impersonator
    Jan 20 '18 at 2:24





    requires an elevated command prompt...of course it does. Otherwise you're already without admin rights and any process you start will also lack them.

    – Twisty Impersonator
    Jan 20 '18 at 2:24











    13














    If you have a particular application that you want to always run without UAC, you can target it with the Registry (add the text to a REG file and import it into the Registry):



    Windows Registry Editor Version 5.00

    [HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsLayers]
    "C:\example\application.exe"="RunAsInvoker"


    Unlike this answer, this solution requires no alternate click or change to user interaction.



    Microsoft calls this process adding the RunAsInvoker "Compatibility Shim".






    share|improve this answer


























    • The answer to a different, yet related question provided the inspiration for this answer.

      – palswim
      Sep 9 '16 at 20:17








    • 1





      Thank you very much! This was the only thing worked for me! I had am Application which was being called from the windows context menu, and it was always coming up as administrator, despite it being called correctly from everywhere else. After this fix, the application started being called correctly.

      – user
      May 6 '17 at 17:55
















    13














    If you have a particular application that you want to always run without UAC, you can target it with the Registry (add the text to a REG file and import it into the Registry):



    Windows Registry Editor Version 5.00

    [HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsLayers]
    "C:\example\application.exe"="RunAsInvoker"


    Unlike this answer, this solution requires no alternate click or change to user interaction.



    Microsoft calls this process adding the RunAsInvoker "Compatibility Shim".






    share|improve this answer


























    • The answer to a different, yet related question provided the inspiration for this answer.

      – palswim
      Sep 9 '16 at 20:17








    • 1





      Thank you very much! This was the only thing worked for me! I had am Application which was being called from the windows context menu, and it was always coming up as administrator, despite it being called correctly from everywhere else. After this fix, the application started being called correctly.

      – user
      May 6 '17 at 17:55














    13












    13








    13







    If you have a particular application that you want to always run without UAC, you can target it with the Registry (add the text to a REG file and import it into the Registry):



    Windows Registry Editor Version 5.00

    [HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsLayers]
    "C:\example\application.exe"="RunAsInvoker"


    Unlike this answer, this solution requires no alternate click or change to user interaction.



    Microsoft calls this process adding the RunAsInvoker "Compatibility Shim".






    share|improve this answer















    If you have a particular application that you want to always run without UAC, you can target it with the Registry (add the text to a REG file and import it into the Registry):



    Windows Registry Editor Version 5.00

    [HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionAppCompatFlagsLayers]
    "C:\example\application.exe"="RunAsInvoker"


    Unlike this answer, this solution requires no alternate click or change to user interaction.



    Microsoft calls this process adding the RunAsInvoker "Compatibility Shim".







    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited Mar 20 '17 at 10:17









    Community

    1




    1










    answered Sep 9 '16 at 20:16









    palswimpalswim

    1,78382953




    1,78382953













    • The answer to a different, yet related question provided the inspiration for this answer.

      – palswim
      Sep 9 '16 at 20:17








    • 1





      Thank you very much! This was the only thing worked for me! I had am Application which was being called from the windows context menu, and it was always coming up as administrator, despite it being called correctly from everywhere else. After this fix, the application started being called correctly.

      – user
      May 6 '17 at 17:55



















    • The answer to a different, yet related question provided the inspiration for this answer.

      – palswim
      Sep 9 '16 at 20:17








    • 1





      Thank you very much! This was the only thing worked for me! I had am Application which was being called from the windows context menu, and it was always coming up as administrator, despite it being called correctly from everywhere else. After this fix, the application started being called correctly.

      – user
      May 6 '17 at 17:55

















    The answer to a different, yet related question provided the inspiration for this answer.

    – palswim
    Sep 9 '16 at 20:17







    The answer to a different, yet related question provided the inspiration for this answer.

    – palswim
    Sep 9 '16 at 20:17






    1




    1





    Thank you very much! This was the only thing worked for me! I had am Application which was being called from the windows context menu, and it was always coming up as administrator, despite it being called correctly from everywhere else. After this fix, the application started being called correctly.

    – user
    May 6 '17 at 17:55





    Thank you very much! This was the only thing worked for me! I had am Application which was being called from the windows context menu, and it was always coming up as administrator, despite it being called correctly from everywhere else. After this fix, the application started being called correctly.

    – user
    May 6 '17 at 17:55











    3














    I solved this problem today using the MS application customization toolkit.



    I followed the instructions in a tech republic article.



    Basically:



    1) you get the toolkit from MS here .



    2) Click Fix



    3) Choose the RunAsInvoker option



    4) Right Click the fix and choose Install






    share|improve this answer


























    • Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question.

      – Mxx
      Jan 22 '14 at 14:07











    • @mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether.

      – LogicDaemon
      Mar 29 '15 at 9:54











    • @LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for.

      – Mxx
      Mar 29 '15 at 14:35











    • @mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps.

      – LogicDaemon
      Mar 30 '15 at 11:53













    • As long as Explorer, a non-admin cmd, or any other standard process is the parent, RunAsInvoker will run with the same limited rights. (Explorer runs restricted by default, otherwise it would never ask you to elevate to delete a file.) It actually seems to work even with new apps. RunAsInvoker means it inherits the exact same ACL token.

      – SilverbackNet
      Oct 30 '15 at 5:59


















    3














    I solved this problem today using the MS application customization toolkit.



    I followed the instructions in a tech republic article.



    Basically:



    1) you get the toolkit from MS here .



    2) Click Fix



    3) Choose the RunAsInvoker option



    4) Right Click the fix and choose Install






    share|improve this answer


























    • Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question.

      – Mxx
      Jan 22 '14 at 14:07











    • @mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether.

      – LogicDaemon
      Mar 29 '15 at 9:54











    • @LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for.

      – Mxx
      Mar 29 '15 at 14:35











    • @mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps.

      – LogicDaemon
      Mar 30 '15 at 11:53













    • As long as Explorer, a non-admin cmd, or any other standard process is the parent, RunAsInvoker will run with the same limited rights. (Explorer runs restricted by default, otherwise it would never ask you to elevate to delete a file.) It actually seems to work even with new apps. RunAsInvoker means it inherits the exact same ACL token.

      – SilverbackNet
      Oct 30 '15 at 5:59
















    3












    3








    3







    I solved this problem today using the MS application customization toolkit.



    I followed the instructions in a tech republic article.



    Basically:



    1) you get the toolkit from MS here .



    2) Click Fix



    3) Choose the RunAsInvoker option



    4) Right Click the fix and choose Install






    share|improve this answer















    I solved this problem today using the MS application customization toolkit.



    I followed the instructions in a tech republic article.



    Basically:



    1) you get the toolkit from MS here .



    2) Click Fix



    3) Choose the RunAsInvoker option



    4) Right Click the fix and choose Install







    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited Nov 16 '18 at 9:16









    0xC0000022L

    3,42463867




    3,42463867










    answered May 18 '11 at 1:05









    user53639user53639

    20826




    20826













    • Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question.

      – Mxx
      Jan 22 '14 at 14:07











    • @mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether.

      – LogicDaemon
      Mar 29 '15 at 9:54











    • @LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for.

      – Mxx
      Mar 29 '15 at 14:35











    • @mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps.

      – LogicDaemon
      Mar 30 '15 at 11:53













    • As long as Explorer, a non-admin cmd, or any other standard process is the parent, RunAsInvoker will run with the same limited rights. (Explorer runs restricted by default, otherwise it would never ask you to elevate to delete a file.) It actually seems to work even with new apps. RunAsInvoker means it inherits the exact same ACL token.

      – SilverbackNet
      Oct 30 '15 at 5:59





















    • Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question.

      – Mxx
      Jan 22 '14 at 14:07











    • @mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether.

      – LogicDaemon
      Mar 29 '15 at 9:54











    • @LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for.

      – Mxx
      Mar 29 '15 at 14:35











    • @mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps.

      – LogicDaemon
      Mar 30 '15 at 11:53













    • As long as Explorer, a non-admin cmd, or any other standard process is the parent, RunAsInvoker will run with the same limited rights. (Explorer runs restricted by default, otherwise it would never ask you to elevate to delete a file.) It actually seems to work even with new apps. RunAsInvoker means it inherits the exact same ACL token.

      – SilverbackNet
      Oct 30 '15 at 5:59



















    Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question.

    – Mxx
    Jan 22 '14 at 14:07





    Your answer does exactly the opposite of the desired effect. Original question was how to force an app that asks for elevated privileges to run without elevating. Your answer still uses UAC but just disables that prompt. That's a wrong answer for this question.

    – Mxx
    Jan 22 '14 at 14:07













    @mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether.

    – LogicDaemon
    Mar 29 '15 at 9:54





    @mxx actually no. If current user is limited (or you've got UAC enabled), then the process will launch with limited privileges altogether.

    – LogicDaemon
    Mar 29 '15 at 9:54













    @LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for.

    – Mxx
    Mar 29 '15 at 14:35





    @LogicDaemon If you actually read the article, you'll see that it explains that if you follow those steps, you'll run an app as Administrator without UAC prompt. This is opposite of what OP asked for.

    – Mxx
    Mar 29 '15 at 14:35













    @mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps.

    – LogicDaemon
    Mar 30 '15 at 11:53







    @mxx nope. Read on technet what RunAsInvoker actually do. This is indeed what topicstarter asked for, though this only works for older apps.

    – LogicDaemon
    Mar 30 '15 at 11:53















    As long as Explorer, a non-admin cmd, or any other standard process is the parent, RunAsInvoker will run with the same limited rights. (Explorer runs restricted by default, otherwise it would never ask you to elevate to delete a file.) It actually seems to work even with new apps. RunAsInvoker means it inherits the exact same ACL token.

    – SilverbackNet
    Oct 30 '15 at 5:59







    As long as Explorer, a non-admin cmd, or any other standard process is the parent, RunAsInvoker will run with the same limited rights. (Explorer runs restricted by default, otherwise it would never ask you to elevate to delete a file.) It actually seems to work even with new apps. RunAsInvoker means it inherits the exact same ACL token.

    – SilverbackNet
    Oct 30 '15 at 5:59













    1














    While in his question Andrew stated that the following did not quite work:




    By modifying the executable I can remove the trustInfo entry from the
    manifest (or the manifest entirely, so I can use an external one),
    allowing the program to start without UAC. Unfortunately this modifies
    the executable, so it exits shortly after due to an internal checksum
    test.




    I was able to modify an external .manifest file for the software I was using and change



    <ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false" />



    to



    <ms_asmv2:requestedExecutionLevel level="asInvoker" uiAccess="false" />



    Turns out the software I was using did not really require administrator rights so I was able to run it on a Standard User account without UAC or administrator passwords. Thanks!






    share|improve this answer
























    • It might be easier to edit the executable instead, as the manifest may just be included in the file. Note that the namespace prefix ms_asmv2: might also be omitted. Also, it is possible that changing the size of the embedded xml block may corrupt the binary, so "requireAdministrator" should be changed to "asInvoker" padded to the same length with spaces before uiAccess.

      – kdb
      Feb 13 at 16:33


















    1














    While in his question Andrew stated that the following did not quite work:




    By modifying the executable I can remove the trustInfo entry from the
    manifest (or the manifest entirely, so I can use an external one),
    allowing the program to start without UAC. Unfortunately this modifies
    the executable, so it exits shortly after due to an internal checksum
    test.




    I was able to modify an external .manifest file for the software I was using and change



    <ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false" />



    to



    <ms_asmv2:requestedExecutionLevel level="asInvoker" uiAccess="false" />



    Turns out the software I was using did not really require administrator rights so I was able to run it on a Standard User account without UAC or administrator passwords. Thanks!






    share|improve this answer
























    • It might be easier to edit the executable instead, as the manifest may just be included in the file. Note that the namespace prefix ms_asmv2: might also be omitted. Also, it is possible that changing the size of the embedded xml block may corrupt the binary, so "requireAdministrator" should be changed to "asInvoker" padded to the same length with spaces before uiAccess.

      – kdb
      Feb 13 at 16:33
















    1












    1








    1







    While in his question Andrew stated that the following did not quite work:




    By modifying the executable I can remove the trustInfo entry from the
    manifest (or the manifest entirely, so I can use an external one),
    allowing the program to start without UAC. Unfortunately this modifies
    the executable, so it exits shortly after due to an internal checksum
    test.




    I was able to modify an external .manifest file for the software I was using and change



    <ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false" />



    to



    <ms_asmv2:requestedExecutionLevel level="asInvoker" uiAccess="false" />



    Turns out the software I was using did not really require administrator rights so I was able to run it on a Standard User account without UAC or administrator passwords. Thanks!






    share|improve this answer













    While in his question Andrew stated that the following did not quite work:




    By modifying the executable I can remove the trustInfo entry from the
    manifest (or the manifest entirely, so I can use an external one),
    allowing the program to start without UAC. Unfortunately this modifies
    the executable, so it exits shortly after due to an internal checksum
    test.




    I was able to modify an external .manifest file for the software I was using and change



    <ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false" />



    to



    <ms_asmv2:requestedExecutionLevel level="asInvoker" uiAccess="false" />



    Turns out the software I was using did not really require administrator rights so I was able to run it on a Standard User account without UAC or administrator passwords. Thanks!







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Jul 21 '13 at 2:56









    AurimasAurimas

    9414




    9414













    • It might be easier to edit the executable instead, as the manifest may just be included in the file. Note that the namespace prefix ms_asmv2: might also be omitted. Also, it is possible that changing the size of the embedded xml block may corrupt the binary, so "requireAdministrator" should be changed to "asInvoker" padded to the same length with spaces before uiAccess.

      – kdb
      Feb 13 at 16:33





















    • It might be easier to edit the executable instead, as the manifest may just be included in the file. Note that the namespace prefix ms_asmv2: might also be omitted. Also, it is possible that changing the size of the embedded xml block may corrupt the binary, so "requireAdministrator" should be changed to "asInvoker" padded to the same length with spaces before uiAccess.

      – kdb
      Feb 13 at 16:33



















    It might be easier to edit the executable instead, as the manifest may just be included in the file. Note that the namespace prefix ms_asmv2: might also be omitted. Also, it is possible that changing the size of the embedded xml block may corrupt the binary, so "requireAdministrator" should be changed to "asInvoker" padded to the same length with spaces before uiAccess.

    – kdb
    Feb 13 at 16:33







    It might be easier to edit the executable instead, as the manifest may just be included in the file. Note that the namespace prefix ms_asmv2: might also be omitted. Also, it is possible that changing the size of the embedded xml block may corrupt the binary, so "requireAdministrator" should be changed to "asInvoker" padded to the same length with spaces before uiAccess.

    – kdb
    Feb 13 at 16:33













    -1














    I fixed this problem by going changing the permissions on the folder that contained the program.



    I added each user that will run that program and gave them "full control" priviledges. That took care of the problem and I left the "run as admin" unchecked.



    I don't have any security concerns for the users who will be running the program.






    share|improve this answer






























      -1














      I fixed this problem by going changing the permissions on the folder that contained the program.



      I added each user that will run that program and gave them "full control" priviledges. That took care of the problem and I left the "run as admin" unchecked.



      I don't have any security concerns for the users who will be running the program.






      share|improve this answer




























        -1












        -1








        -1







        I fixed this problem by going changing the permissions on the folder that contained the program.



        I added each user that will run that program and gave them "full control" priviledges. That took care of the problem and I left the "run as admin" unchecked.



        I don't have any security concerns for the users who will be running the program.






        share|improve this answer















        I fixed this problem by going changing the permissions on the folder that contained the program.



        I added each user that will run that program and gave them "full control" priviledges. That took care of the problem and I left the "run as admin" unchecked.



        I don't have any security concerns for the users who will be running the program.







        share|improve this answer














        share|improve this answer



        share|improve this answer








        edited Apr 20 '12 at 7:34









        slhck

        163k47450474




        163k47450474










        answered Apr 20 '12 at 4:28









        Tim DTim D

        71




        71























            -1














            If it's a setup (installation) exe file that is requiring administration privilege, there's a trick to run it without elevated access:



            If the file's name contains words like setup or install windows forcefully runs it with elevated access even if it doesn't need elevated access:



            enter image description here






            share|improve this answer



















            • 1





              Of course, that only works when the application manifest doesn’t explicitly specify it must run elevated.

              – Daniel B
              Jan 25 at 11:57






            • 1





              @DanielB: in fact this trick only works when there is no manifest

              – AntoineL
              Mar 5 at 15:33
















            -1














            If it's a setup (installation) exe file that is requiring administration privilege, there's a trick to run it without elevated access:



            If the file's name contains words like setup or install windows forcefully runs it with elevated access even if it doesn't need elevated access:



            enter image description here






            share|improve this answer



















            • 1





              Of course, that only works when the application manifest doesn’t explicitly specify it must run elevated.

              – Daniel B
              Jan 25 at 11:57






            • 1





              @DanielB: in fact this trick only works when there is no manifest

              – AntoineL
              Mar 5 at 15:33














            -1












            -1








            -1







            If it's a setup (installation) exe file that is requiring administration privilege, there's a trick to run it without elevated access:



            If the file's name contains words like setup or install windows forcefully runs it with elevated access even if it doesn't need elevated access:



            enter image description here






            share|improve this answer













            If it's a setup (installation) exe file that is requiring administration privilege, there's a trick to run it without elevated access:



            If the file's name contains words like setup or install windows forcefully runs it with elevated access even if it doesn't need elevated access:



            enter image description here







            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered Jan 25 at 11:54









            ShayanShayan

            146213




            146213








            • 1





              Of course, that only works when the application manifest doesn’t explicitly specify it must run elevated.

              – Daniel B
              Jan 25 at 11:57






            • 1





              @DanielB: in fact this trick only works when there is no manifest

              – AntoineL
              Mar 5 at 15:33














            • 1





              Of course, that only works when the application manifest doesn’t explicitly specify it must run elevated.

              – Daniel B
              Jan 25 at 11:57






            • 1





              @DanielB: in fact this trick only works when there is no manifest

              – AntoineL
              Mar 5 at 15:33








            1




            1





            Of course, that only works when the application manifest doesn’t explicitly specify it must run elevated.

            – Daniel B
            Jan 25 at 11:57





            Of course, that only works when the application manifest doesn’t explicitly specify it must run elevated.

            – Daniel B
            Jan 25 at 11:57




            1




            1





            @DanielB: in fact this trick only works when there is no manifest

            – AntoineL
            Mar 5 at 15:33





            @DanielB: in fact this trick only works when there is no manifest

            – AntoineL
            Mar 5 at 15:33











            -4














            No, if a program requires UAC then it is trying to access something outside of its sandbox. The program will not correctly run without the elevated access.



            If you just want to get rid of the notification, you can disable UAC.



            Disable UAC on Windows Vista: Start, type "user". Click on "User Accounts". On the window that pops up, click on "User Account Control Settings" and then Turn off UAC.



            Disable UAC on Windows 7: Start, type "user". Click on "User Account Control Settings". Drag the choice bar all the way to the bottom to "Never Notify."






            share|improve this answer



















            • 5





              Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors.

              – Andrew Russell
              Aug 4 '10 at 14:32











            • Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access.

              – James Watt
              Aug 4 '10 at 14:47











            • James: Actually - it looks like you can - I've updated my question.

              – Andrew Russell
              Aug 4 '10 at 16:11











            • Short of modifying the program code itself, I would be interested to know of a working solution if you find one.

              – James Watt
              Aug 5 '10 at 5:17
















            -4














            No, if a program requires UAC then it is trying to access something outside of its sandbox. The program will not correctly run without the elevated access.



            If you just want to get rid of the notification, you can disable UAC.



            Disable UAC on Windows Vista: Start, type "user". Click on "User Accounts". On the window that pops up, click on "User Account Control Settings" and then Turn off UAC.



            Disable UAC on Windows 7: Start, type "user". Click on "User Account Control Settings". Drag the choice bar all the way to the bottom to "Never Notify."






            share|improve this answer



















            • 5





              Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors.

              – Andrew Russell
              Aug 4 '10 at 14:32











            • Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access.

              – James Watt
              Aug 4 '10 at 14:47











            • James: Actually - it looks like you can - I've updated my question.

              – Andrew Russell
              Aug 4 '10 at 16:11











            • Short of modifying the program code itself, I would be interested to know of a working solution if you find one.

              – James Watt
              Aug 5 '10 at 5:17














            -4












            -4








            -4







            No, if a program requires UAC then it is trying to access something outside of its sandbox. The program will not correctly run without the elevated access.



            If you just want to get rid of the notification, you can disable UAC.



            Disable UAC on Windows Vista: Start, type "user". Click on "User Accounts". On the window that pops up, click on "User Account Control Settings" and then Turn off UAC.



            Disable UAC on Windows 7: Start, type "user". Click on "User Account Control Settings". Drag the choice bar all the way to the bottom to "Never Notify."






            share|improve this answer













            No, if a program requires UAC then it is trying to access something outside of its sandbox. The program will not correctly run without the elevated access.



            If you just want to get rid of the notification, you can disable UAC.



            Disable UAC on Windows Vista: Start, type "user". Click on "User Accounts". On the window that pops up, click on "User Account Control Settings" and then Turn off UAC.



            Disable UAC on Windows 7: Start, type "user". Click on "User Account Control Settings". Drag the choice bar all the way to the bottom to "Never Notify."







            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered Aug 4 '10 at 14:09









            James WattJames Watt

            1,55171625




            1,55171625








            • 5





              Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors.

              – Andrew Russell
              Aug 4 '10 at 14:32











            • Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access.

              – James Watt
              Aug 4 '10 at 14:47











            • James: Actually - it looks like you can - I've updated my question.

              – Andrew Russell
              Aug 4 '10 at 16:11











            • Short of modifying the program code itself, I would be interested to know of a working solution if you find one.

              – James Watt
              Aug 5 '10 at 5:17














            • 5





              Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors.

              – Andrew Russell
              Aug 4 '10 at 14:32











            • Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access.

              – James Watt
              Aug 4 '10 at 14:47











            • James: Actually - it looks like you can - I've updated my question.

              – Andrew Russell
              Aug 4 '10 at 16:11











            • Short of modifying the program code itself, I would be interested to know of a working solution if you find one.

              – James Watt
              Aug 5 '10 at 5:17








            5




            5





            Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors.

            – Andrew Russell
            Aug 4 '10 at 14:32





            Disabling UAC is not what I am trying to achieve. Also: your description of how UAC works is correct only in a general sense. It's possible for a program to request UAC when it doesn't strictly need it. And UAC happens before a program starts - once its running, if it steps beyond its permissions, it will simply get permission-denied errors.

            – Andrew Russell
            Aug 4 '10 at 14:32













            Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access.

            – James Watt
            Aug 4 '10 at 14:47





            Semantics aside, you can't "disable" UAC notifications for a specific program while still limiting their access.

            – James Watt
            Aug 4 '10 at 14:47













            James: Actually - it looks like you can - I've updated my question.

            – Andrew Russell
            Aug 4 '10 at 16:11





            James: Actually - it looks like you can - I've updated my question.

            – Andrew Russell
            Aug 4 '10 at 16:11













            Short of modifying the program code itself, I would be interested to know of a working solution if you find one.

            – James Watt
            Aug 5 '10 at 5:17





            Short of modifying the program code itself, I would be interested to know of a working solution if you find one.

            – James Watt
            Aug 5 '10 at 5:17





            protected by Community Sep 22 '15 at 19:34



            Thank you for your interest in this question.
            Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).



            Would you like to answer one of these unanswered questions instead?



            Popular posts from this blog

            Paul Cézanne

            UIScrollView CustomStickyHeader Resize height generates problems when scroll is too fast

            Angular material date-picker (MatDatepicker) auto completes the date on focus out