VB.NET中如何从管理员权限程序启动无管理员权限的子应用？

有两种常用的落地方式，可根据你的场景选择：

方法1：通过资源管理器间接启动（最简实现，无额外依赖） #

原理是Windows资源管理器explorer.exe默认以当前登录的普通用户权限运行，通过它启动目标程序时，会使用自身的普通权限创建进程，不会继承父程序的管理员权限。

代码示例 #

' 引入命名空间
Imports System.Diagnostics

' 启动逻辑
Dim targetAppPath As String = """C:\Program Files\你的子应用路径\app.exe""" ' 路径带空格需要包裹双引号
Process.Start("explorer.exe", targetAppPath)

优缺点 #

• 优点：代码量极小，无需调用底层API，适配90%以上常规场景
• 缺点：无法直接给子进程传递启动参数，有传参需求不要用该方案

方法2：调用Windows API降权启动（适配所有场景，支持传参） #

原理是获取当前桌面运行的资源管理器的普通用户权限令牌，基于该令牌创建子进程，完全控制启动参数。

完整代码示例 #

Imports System.Runtime.InteropServices
Imports System.Diagnostics

Public Class NormalUserProcessLauncher
    ' API声明
    <DllImport("advapi32.dll", SetLastError:=True, CharSet:=CharSet.Auto)>
    Private Shared Function CreateProcessWithTokenW(
        hToken As IntPtr,
        dwLogonFlags As UInteger,
        lpApplicationName As String,
        lpCommandLine As String,
        dwCreationFlags As UInteger,
        lpEnvironment As IntPtr,
        lpCurrentDirectory As String,
        <[In]> ByRef lpStartupInfo As STARTUPINFO,
        <Out> ByRef lpProcessInformation As PROCESS_INFORMATION
    ) As Boolean
    End Function

    <DllImport("user32.dll", SetLastError:=True)>
    Private Shared Function GetShellWindow() As IntPtr
    End Function

    <DllImport("user32.dll", SetLastError:=True)>
    Private Shared Function GetWindowThreadProcessId(hWnd As IntPtr, ByRef lpdwProcessId As UInteger) As UInteger
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Shared Function OpenProcess(dwDesiredAccess As UInteger, bInheritHandle As Boolean, dwProcessId As UInteger) As IntPtr
    End Function

    <DllImport("advapi32.dll", SetLastError:=True)>
    Private Shared Function OpenProcessToken(hProcess As IntPtr, dwDesiredAccess As UInteger, ByRef hToken As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Shared Function CloseHandle(hObject As IntPtr) As Boolean
    End Function

    ' 结构体定义
    Private Structure STARTUPINFO
        Public cb As Integer
        Public lpReserved As String
        Public lpDesktop As String
        Public lpTitle As String
        Public dwX As Integer
        Public dwY As Integer
        Public dwXSize As Integer
        Public dwYSize As Integer
        Public dwXCountChars As Integer
        Public dwYCountChars As Integer
        Public dwFillAttribute As Integer
        Public dwFlags As Integer
        Public wShowWindow As Short
        Public cbReserved2 As Short
        Public lpReserved2 As IntPtr
        Public hStdInput As IntPtr
        Public hStdOutput As IntPtr
        Public hStdError As IntPtr
    End Structure

    Private Structure PROCESS_INFORMATION
        Public hProcess As IntPtr
        Public hThread As IntPtr
        Public dwProcessId As UInteger
        Public dwThreadId As UInteger
    End Structure

    ' 对外调用方法
    Public Shared Function Launch(appFullPath As String, Optional arguments As String = "") As Boolean
        Dim shellWindowHandle = GetShellWindow()
        If shellWindowHandle = IntPtr.Zero Then Return False

        Dim explorerPid As UInteger
        GetWindowThreadProcessId(shellWindowHandle, explorerPid)

        Dim explorerProcessHandle = OpenProcess(&H400 Or &H10, False, explorerPid)
        If explorerProcessHandle = IntPtr.Zero Then Return False

        Dim userTokenHandle As IntPtr
        Dim tokenAccessFlag As UInteger = &H2000000 Or &H8 Or &H1 Or &H2
        If Not OpenProcessToken(explorerProcessHandle, tokenAccessFlag, userTokenHandle) Then
            CloseHandle(explorerProcessHandle)
            Return False
        End If

        Dim startupInfo As New STARTUPINFO()
        startupInfo.cb = Marshal.SizeOf(startupInfo)
        Dim processInfo As New PROCESS_INFORMATION()

        Dim commandLine As String = If(String.IsNullOrEmpty(arguments), appFullPath, $"""{appFullPath}"" {arguments}")
        Dim launchSuccess = CreateProcessWithTokenW(userTokenHandle, 0, Nothing, commandLine, 0, IntPtr.Zero, Nothing, startupInfo, processInfo)

        ' 释放句柄
        CloseHandle(userTokenHandle)
        CloseHandle(explorerProcessHandle)
        If launchSuccess Then
            CloseHandle(processInfo.hThread)
            CloseHandle(processInfo.hProcess)
        End If

        Return launchSuccess
    End Function
End Class

调用示例 #

' 无参数启动
NormalUserProcessLauncher.Launch("C:\Program Files\你的子应用路径\app.exe")

' 带参数启动
NormalUserProcessLauncher.Launch("C:\Program Files\你的子应用路径\app.exe", "-mode test -config custom.ini")

• 两种方案都仅适用于父程序是通过UAC提权获得管理员权限、当前系统已登录普通交互用户的场景，如果父程序是系统服务级别的管理员权限运行，需要额外处理用户会话切换逻辑
• 所有涉及文件路径的参数如果包含空格，必须用双引号包裹路径，否则会出现路径识别错误

内容的提问来源于stack exchange，提问作者arti