How to create a Run As Administrator shortcut using Powershell

Question

In my PowerShell script, I create a shortcut to a .exe (using something similar to the answer from this question):

$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$Home\Desktop\ColorPix.lnk")
$Shortcut.TargetPath = "C:\Program Files (x86)\ColorPix\ColorPix.exe"
$Shortcut.Save()

Now, when I create the shortcut, how do I add to the script to make it default to running as Administrator?

score 57 · Accepted Answer · edited May 23 '17 at 12:02

57

This answer is a PowerShell translation of an excellent answer to this question How can I use JScript to create a shortcut that uses "Run as Administrator".

In short, you need to read the .lnk file in as an array of bytes. Locate byte 21 (0x15) and change bit 6 (0x20) to 1. This is the RunAsAdministrator flag. Then you write you byte array back into the .lnk file.

In your code this would look like this:

$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$Home\Desktop\ColorPix.lnk")
$Shortcut.TargetPath = "C:\Program Files (x86)\ColorPix\ColorPix.exe"
$Shortcut.Save()

$bytes = [System.IO.File]::ReadAllBytes("$Home\Desktop\ColorPix.lnk")
$bytes[0x15] = $bytes[0x15] -bor 0x20 #set byte 21 (0x15) bit 6 (0x20) ON
[System.IO.File]::WriteAllBytes("$Home\Desktop\ColorPix.lnk", $bytes)

If anybody want to change something else in a .LNK file you can refer to official Microsoft documentation.

edited May 23 '17 at 12:02

Community

1
1

answered Mar 12 '15 at 05:03

Jan Chrbolka

4,184
2
29
38

The last line didnt't work for me, so I used `$bytes | Set-Content $shortcutPath -Encoding Byte` instead – Andy Joiner Jul 16 '19 at 18:53
2

PowerShell arrays starts from item 0, so it is the 22nd byte, more precisely bit 6 of the 2nd byte in the LinkFlags structure of the ShellLinkHeader structure, so bit 14 of the LinkFlags structure, getting us to documented position N "RunAsUser". But on 64-bit Windows, it's the bit 6 of the 43rd byte that is modified. My guess is that each byte being stored on 16 bits instead of 8, the space reserved for the 8 first flags is now doubled, so the flag for RunAsUser is on byte 4*2 + 16*2 + 1*2 + 1 = 43. And since it seems byte 42 isn't 0x00, I suspect W64 to use new undocumented flags... – hymced Oct 12 '20 at 11:32

score -4 · Answer 2 · edited Apr 08 '20 at 08:01

-4

You can use the -Elevate true switch for this:

    CreateShortcut -name "myApp" -Target 
    "${env:ProgramFiles}\mApp\myApp.exe" -OutputDirectory 
    "C:\Users\Public\Desktop" -Elevated True

edited Apr 08 '20 at 08:01

Bhargav Rao

50,140
28
121
140

answered Oct 14 '19 at 12:56

Elgin Methley Prince

7
2

6

Is this an answer or a question? What is even `CreateShortcut`? – Martin Prikryl Oct 14 '19 at 13:05

How to create a Run As Administrator shortcut using Powershell

2 Answers2

Linked