Run .BAT as admin without UAC prompt?

topgundcp · 10 Feb 2017

If you want to use the converter. IMO, it is better to use a portable version, why install something that is seldom used, Here's the link for portable version (no setup/install required):
Bat To Exe Converter Portable - Free download and software reviews - CNET Download.com
However, I think using registry hack is good enough.

kc42 · 26 Jun 2018

topgundcp said:

Create a reg file with code below and merge into the registry to avoid UAC prompt from bat file:
Windows Registry Editor Version 5.00

Code:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{E2F13B98-650F-47DB-845A-420A1ED34EC7}User\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
"LowRiskFileTypes"=".exe;.bat;.cmd;.vbs"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
"LowRiskFileTypes"=".exe;.bat;.cmd;.vbs"

I've tried this on Windows 10 Pro 1803 x64, and I can't get a .bat file to run (which has text saved within to elevate to admin), without a UAC window appearing.

I need to be able to have a colleague (with non-admin credentials), on a domain environment, have the ability to run a basic batch script to automatically start an inbuilt Windows Service, without any admin intervention required.

Any help you can provide is greatly appreciated.

Many thanks,

kc

Mikhoul · 15 Dec 2018

Here's a solution that worked for me under Windows 10, it is a script that you append at the beginning of your script:

Code:

@echo off

:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )



:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"


    "%temp%\getadmin.vbs"
    exit /B


:gotAdmin
    if exist "%temp%\getadmin.vbs" ( del "%temp%\getadmin.vbs" )
    pushd "%CD%"

    CD /D "%~dp0"
:--------------------------------------

YOUR BATCH SCRIPT HERE>
Source: https://sites.google.com/site/eneerg.../batchgotadmin

kc42 · 19 Dec 2018

Mikhoul said:

Here's a solution that worked for me under Windows 10, it is a script that you append at the beginning of your script:

Code:

@echo off

:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )



:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"


    "%temp%\getadmin.vbs"
    exit /B


:gotAdmin
    if exist "%temp%\getadmin.vbs" ( del "%temp%\getadmin.vbs" )
    pushd "%CD%"

    CD /D "%~dp0"
:--------------------------------------

YOUR BATCH SCRIPT HERE>
Source: https://sites.google.com/site/eneerg.../batchgotadmin

-

Thanks for your message.
When i clicked on your source link at the bottom - the page i'm redirected to states that their intention to use the code was to force an admin UAC prompt to appear to allow for elevated privileges.
What i'm actually trying to do is allow for a batch file to use elevated privileges, without displaying an admin UAC. This is because i have a batch file that i'm trying to run on a non-admin user account in a domain environment, and need for the user to be able to do this independently without requesting assistance from myself using my admin account.
I've tested your solution above this morning on a non-admin account, and i'm still presented with an admin UAC prompt.
Any further suggestions would be appreciated please.

Kyhi · 19 Dec 2018

Add at beginning of script

Code:

set "params=%*"
setlocal EnableDelayedExpansion
cd /d "%~dp0" && ( if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" ) && fsutil dirty query %systemdrive% 1>nul 2>nul || (  echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "cmd.exe", "/k cd ""%~sdp0"" && %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" && "%temp%\getadmin.vbs" && exit /B )
%windir%\system32\reg.exe query "HKU\S-1-5-19" 1>nul 2>nul || (
echo.
echo ============================================================
echo ERROR: Run the script as administrator.
echo ============================================================
echo.
echo Press any key to exit...
pause >nul
goto :eof
)

Try3 · 19 Dec 2018

I do this with a couple of batch files. It is fairly quick and painless but
1 You must put the batch file somewhere that non-Admin users do not have write permissions to otherwise they would be able to alter the contents of the batch file to do whatever they wanted without intervention. Just give them read & execute permissions. I created a single high level folder called C:\Tools then set the limited permissions on that so that they can be inherited by the various subfolders I put my batch files in.
2 The solution only works for batch files that have no user interaction or any user interface [which seems to suit what you want to do].

The solution is to call the batch file from a Task scheduler task for which you
- have set Run with highest privileges,
- have set Run whether user is not logged on or not, and
- have saved your admin password on the task.

Whenever I have set up such tasks I have always had to make sure that I open Task scheduler as Admin in order to be able to set these privileged parameters up when defining the task but that might not be essential [judging by comments I have seen but never tested out].

The non-Admin user calls the task rather than the batch file itself

Code:

C:\Windows\System32\schtasks.exe /Run /TN "TheNameOfTheTask"

and this can be set as the properties of a shortcut that you put on their computers so they do not have to do anything else to make it run.

I think there is a TenForums tutorial on the subject.

Denis

Superfly · 19 Dec 2018

kc42 said:

-

Thanks for your message.
When i clicked on your source link at the bottom - the page i'm redirected to states that their intention to use the code was to force an admin UAC prompt to appear to allow for elevated privileges.
What i'm actually trying to do is allow for a batch file to use elevated privileges, without displaying an admin UAC. This is because i have a batch file that i'm trying to run on a non-admin user account in a domain environment, and need for the user to be able to do this independently without requesting assistance from myself using my admin account.
I've tested your solution above this morning on a non-admin account, and i'm still presented with an admin UAC prompt.
Any further suggestions would be appreciated please.

Any elevation from Standard user should produce a UAC prompt - that's a security feature - to run the script as Admin silently from a non-Admin a/c you will have to include the username and password when elevating it.

The work-around is running it from a Scheduled Task with System rights, thereby not hardcoding or exposing the password in the script - the caveat is the task will need to be created/imported under Admin rights.

kc42 · 20 Dec 2018

Kyhi said:

Add at beginning of script

Code:

set "params=%*"
setlocal EnableDelayedExpansion
cd /d "%~dp0" && ( if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" ) && fsutil dirty query %systemdrive% 1>nul 2>nul || (  echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "cmd.exe", "/k cd ""%~sdp0"" && %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" && "%temp%\getadmin.vbs" && exit /B )
%windir%\system32\reg.exe query "HKU\S-1-5-19" 1>nul 2>nul || (
echo.
echo ============================================================
echo ERROR: Run the script as administrator.
echo ============================================================
echo.
echo Press any key to exit...
pause >nul
goto :eof
)

-

Thanks for your message.
I've added your code at the beginning of my script, but i'm still receiving an admin UAC requesting credentials.
Here's my full code (with the inclusion of yours):

@echo off

set "params=%*"
setlocal EnableDelayedExpansion
cd /d "%~dp0" && ( if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" ) && fsutil dirty query %systemdrive% 1>nul 2>nul || ( echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "cmd.exe", "/k cd ""%~sdp0"" && %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" && "%temp%\getadmin.vbs" && exit /B )
%windir%\system32\reg.exe query "HKU\S-1-5-19" 1>nul 2>nul || (
echo.
echo ============================================================
echo ERROR: Run the script as administrator.
echo ============================================================
echo.
echo Press any key to exit...
pause >nul
goto :eof
)

:: BatchGotAdmin
:-------------------------------------
REM --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
echo Requesting administrative privileges...
goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"

"%temp%\getadmin.vbs"
exit /B

:gotAdmin
if exist "%temp%\getadmin.vbs" ( del "%temp%\getadmin.vbs" )
pushd "%CD%"

CD /D "%~dp0"
:--------------------------------------

cd c:\windows\system32
net start Audiosrv

-

Can you advise/ correct my code to enable this to work please?

Many thanks in advance for any assistance you can provide.

kc

coolusername · 27 Apr 2021

clam1952 said:

Compile the bat file and create it as an exe and the problem should go away. I use Batch Compiler Batch Compiler | Home | Freeware IDE compile convert bat to exe advance batch commands debugger and resources

This does not work, I just tried it

Try3 · 27 Apr 2021

coolusername said:

This does not work, I just tried it

Use the Task scheduler solution.

See also Create Elevated App Shortcut without UAC Prompt - TenForumsTutorials

If you have any questions, I suggest you start a new question of your own.

If you do so, include
@Try3
in your text somewhere so that I get passed a link to it.

Denis