[EN] Running a Specific Program Without Giving the User Admin Rights

In corporate and personal computer environments, some applications may require administrator privileges in order to run properly. This situation is especially common with older software, camera monitoring applications, accounting programs, hardware management tools, technical service utilities, or applications that need to interact with system-level components.

In many cases, the easiest solution may seem to be giving the user local administrator rights. However, this approach can create serious security risks. When a user is granted local admin privileges, they are not only allowed to run a specific application; they also gain the ability to change system settings, install or remove software, manage services, modify security configurations, and potentially allow malicious software to run with elevated permissions.

For this reason, when only a specific application needs elevated privileges, it is better to use alternative methods instead of granting full local administrator rights to the user. One of these methods is using the built-in Windows runas.exe command to run the application under a different user account.

What Is Runas.exe?

runas.exe is a built-in Windows command-line tool that allows an application to be launched using a different user account than the currently logged-in user.

For example, even if a user is logged in with a standard user account, a specific application can be started using the local Administrator account or another authorized account.

This method can be useful in scenarios where the user should not be given local admin rights, where a specific application requires administrator privileges, where the administrator password should not be shared repeatedly, or where legacy software does not work properly under a standard user account.

Example Usage Scenario

For example, camera monitoring applications such as SmartPSS may require administrator privileges on some systems. When a user tries to run the application with a standard account, the program may fail to open, display errors, or some features may not work correctly.

Instead of granting the user full local admin rights, the application can be configured to run under a specific administrator account.

An example command is shown below:

C:\Windows\System32\runas.exe /user:COMPUTER_NAME\Administrator /savecred "cmd /c cd /d \"C:\Program Files\Program Folder\" && start \"\" Program.exe"

This command runs the specified program using the selected user account. During the first run, Windows asks for the password of that account. Because the /savecred parameter is used, the credentials are stored by Windows, and the application can be launched in future sessions without asking the user for the password again.

Explanation of the Command

Let’s examine the command step by step.

C:\Windows\System32\runas.exe

This part starts the built-in Windows runas.exe utility.

/user:COMPUTER_NAME\Administrator

This part defines which user account will be used to run the application.

The COMPUTER_NAME section must be replaced with the actual computer name. The Administrator section refers to the authorized account that will run the application.

For example, if the computer name is PC-001, the command should be written as follows:

/user:PC-001\Administrator

In a domain environment, a domain user account can also be used instead of a local user account:

/user:DOMAIN_NAME\AuthorizedUser

/savecred

This parameter allows Windows to save the password entered during the first run. As a result, the user will not be asked for the password again in future executions.

However, this parameter must be carefully evaluated from a security perspective. Saved credentials may be reused within the same user session, which can create security risks if not properly controlled.

"cmd /c cd /d \"C:\Program Files\Program Folder\" && start \"\" Program.exe"

This part first changes the working directory to the application folder and then starts the executable file.

The cd /d command changes the current directory. The /d parameter ensures that the command works correctly even when the target folder is located on a different drive.

The start "" Program.exe command launches the application. The empty quotation marks after start represent the window title parameter. This structure is important, especially when the file path contains spaces.

How to Apply This Method

To use this method, you first need to know the installation path of the application and the executable file name.

For example, if the application is installed in the following directory:

C:\Program Files\SmartPSS

and the executable file name is:

SmartPSS.exe

the command can be configured as follows:

C:\Windows\System32\runas.exe /user:PC-001\Administrator /savecred "cmd /c cd /d \"C:\Program Files\SmartPSS\" && start \"\" SmartPSS.exe"

This command can be saved as a .bat file or used as a desktop shortcut.

Using the Command as a BAT File

To create a BAT file, open Notepad and paste the prepared command into it.

Example:

@echo off
C:\Windows\System32\runas.exe /user:PC-001\Administrator /savecred "cmd /c cd /d \"C:\Program Files\SmartPSS\" && start \"\" SmartPSS.exe"
exit

Then save the file with a name such as:

Run_SmartPSS.bat

While saving the file, select “All Files” as the file type and make sure the extension is .bat.

During the first execution, Windows will ask for the password of the specified administrator account. Once the password is entered correctly, the application will run. On subsequent launches, the application will start without asking for the password again because /savecred stores the credentials.

Using the Command as a Desktop Shortcut

Instead of creating a BAT file, you can also create a desktop shortcut.

To do this, right-click on the desktop, select “New > Shortcut”, and paste the command into the target field.

Example:

C:\Windows\System32\runas.exe /user:PC-001\Administrator /savecred "cmd /c cd /d \"C:\Program Files\SmartPSS\" && start \"\" SmartPSS.exe"

You can give the shortcut a clear name, such as:

Run SmartPSS as Administrator

Optionally, the shortcut icon can also be changed for easier identification.

Advantages of This Method

The main advantage of this method is that it allows a specific application to run with elevated privileges without giving the user full local administrator rights.

The user continues to perform daily tasks with a standard user account. This provides a more controlled and secure operating environment.

Another advantage is that the administrator password does not need to be shared with the user every time the application is launched. The authorized person enters the password during the first run, and future executions use the saved credentials.

This method can be practical in small offices, camera monitoring stations, reception computers, or environments where limited access to a specific application is required.

Security Considerations

Although this method is practical, it must be used carefully. The /savecred parameter may create security risks in certain environments.

When this parameter is used, the entered credentials are stored in Windows Credential Manager. This may allow the same saved credentials to be reused for other operations under the same user profile.

Before using /savecred, the following questions should be evaluated:

Is it truly necessary to run the application with administrator privileges? Is there a safer method that avoids credential caching? Can the issue be resolved by adjusting folder, file, or registry permissions? Can a dedicated limited local account be created for this application? Is the computer joined to a domain or running in a workgroup? Is the device used by multiple users? Could the saved credentials be misused?

Using /savecred without this evaluation is not recommended, especially in corporate environments.

Alternative Solutions

This method may not be the best solution for every environment. In enterprise environments, more secure and centrally managed alternatives should be preferred.

For example, the application’s permission requirements can be analyzed, and only the necessary folder, file, or registry permissions can be granted. In some cases, this allows the application to run properly under a standard user account without requiring administrator privileges.

Depending on the environment, solutions such as Microsoft Endpoint Manager, Intune, Group Policy, AppLocker, Windows Defender Application Control, Application Compatibility Toolkit, or Privileged Access Management solutions can also be evaluated.

Third-party Endpoint Privilege Management solutions can provide a more controlled approach by allowing only specific applications to run with elevated privileges without granting users full local administrator rights.

Recommendations for Safer Usage

If this method must be used, it is recommended to create a dedicated local account specifically for the application instead of using the default Administrator account.

The account should have the minimum required permissions, a strong password, and should only be used for running the specific application.

The BAT file or shortcut should not be stored in a location where users can freely modify it. Otherwise, a user may change the command and attempt to run another application using the same saved credentials.

In addition, saved credentials should be reviewed regularly, and unused credentials should be removed from Windows Credential Manager.

How to Check Saved Credentials

Saved credentials can be reviewed through Windows Credential Manager.

You can access it from Control Panel using the following path:

Control Panel > Credential Manager > Windows Credentials

From this section, saved Windows credentials can be viewed and removed if necessary.

Alternatively, saved credentials can be listed using the following command:

cmdkey /list

If a specific saved credential needs to be removed, the following command can be used:

cmdkey /delete:TARGET_NAME

These operations should be performed carefully. Removing credentials that are still required by applications or services may cause access problems.

When a specific application requires administrator privileges, giving the user full local admin rights is not always the right approach. Local administrator access gives the user broad control over the entire system, not just the required application.

Using runas.exe with the /savecred parameter can provide a practical way to run a specific application under a different user account. This can be useful for applications such as SmartPSS or other software that requires elevated privileges.

However, the security impact of this method must be carefully evaluated. Because /savecred stores credentials, there is a risk that those credentials may be misused. For this reason, the organization’s security policies, user permissions, device usage model, and alternative solutions should be reviewed before implementing this method.

The best approach is to avoid giving users unnecessary privileges and to provide only the minimum access required for the application to function properly.