How to create a Run As Administrator shortcut using Powershell

Question

In my PowerShell script, I create a shortcut to a .exe (using something similar to the answer from this question):

$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$Home\Desktop\ColorPix.lnk")
$Shortcut.TargetPath = "C:\Program Files (x86)\ColorPix\ColorPix.exe"
$Shortcut.Save()

Now, when I create the shortcut, how do I add to the script to make it default to running as Administrator?

Norling

Answer 1

This answer is a PowerShell translation of an excellent answer to this question How can I use JScript to create a shortcut that uses "Run as Administrator".

In short, you need to read the .lnk file in as an array of bytes. Locate byte 21 (0x15) and change bit 6 (0x20) to 1. This is the RunAsAdministrator flag. Then you write you byte array back into the .lnk file.

In your code this would look like this:

$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$Home\Desktop\ColorPix.lnk")
$Shortcut.TargetPath = "C:\Program Files (x86)\ColorPix\ColorPix.exe"
$Shortcut.Save()

$bytes = [System.IO.File]::ReadAllBytes("$Home\Desktop\ColorPix.lnk")
$bytes[0x15] = $bytes[0x15] -bor 0x20 #set byte 21 (0x15) bit 6 (0x20) ON
[System.IO.File]::WriteAllBytes("$Home\Desktop\ColorPix.lnk", $bytes)

If anybody want to change something else in a .LNK file you can refer to official Microsoft documentation.

Nonfeasance

The last line didnt't work for me, so I used $bytes | Set-Content $shortcutPath -Encoding Byte instead – Galven

PowerShell arrays starts from item 0, so it is the 22nd byte, more precisely bit 6 of the 2nd byte in the LinkFlags structure of the ShellLinkHeader structure, so bit 14 of the LinkFlags structure, getting us to documented position N "RunAsUser". But on 64-bit Windows, it's the bit 6 of the 43rd byte that is modified. My guess is that each byte being stored on 16 bits instead of 8, the space reserved for the 8 first flags is now doubled, so the flag for RunAsUser is on byte 4*2 + 16*2 + 1*2 + 1 = 43. And since it seems byte 42 isn't 0x00, I suspect W64 to use new undocumented flags... – Forme

Can u give some more detail about, why we need to change "byte 21 (0x15)"?, and x64 or x86 is it different or not? @Forme – Mayfield

@IchigoKurosaki just try :) It's been a while, I don't remember exactly, but given my comment, I must have been fairly sure of myself at that time! – Forme

Answer 2

You can use the -Elevate true switch for this:

    CreateShortcut -name "myApp" -Target 
    "${env:ProgramFiles}\mApp\myApp.exe" -OutputDirectory 
    "C:\Users\Public\Desktop" -Elevated True

Ruddy

Is this an answer or a question? What is even CreateShortcut? – Auberbach