VB.NET中从管理员权限程序启动无权限进程的技术问询

我完全懂你的困扰——当程序以管理员权限运行时，子进程默认会继承这个高权限，哪怕你特意去掉了runas动词也没用。之前的方法不管用，核心原因是Windows的进程权限继承机制在起作用：用UseShellExecute=False时，.NET调用的CreateProcess会直接复用父进程的访问令牌；而UseShellExecute=True时，如果父进程是管理员，在某些UAC配置下，默认的open动词还是会启动带管理员权限的进程。

这里有两个更简便的解决方案，不需要依赖额外的辅助程序：

方法一：通过Explorer.exe代理启动（最省心） #

Windows的资源管理器explorer.exe几乎总是运行在当前用户的非提升权限下（除非你手动右键以管理员启动它，日常使用中基本不会这么做）。让explorer帮我们启动目标程序，就能自动继承它的标准权限，完美绕开父进程的管理员权限继承。

代码示例：

Dim myProcess As New Process()
With myProcess.StartInfo
    .UseShellExecute = True
    .FileName = "explorer.exe"
    ' 注意引号处理，避免路径含空格时出错
    .Arguments = $"""{System.IO.Path.Combine(Environment.CurrentDirectory, "aprogram.exe")}"" Some stuff"
    .WorkingDirectory = Environment.CurrentDirectory
End With
Dim ProcessStarted As Boolean = myProcess.Start()

这个方法的优势是零额外依赖，利用系统自带进程实现权限降级，稳定性拉满。

方法二：用Windows API直接创建非提升进程（更灵活） #

如果你不想依赖explorer，可以调用Windows原生API CreateProcessWithLogonW，它允许你以当前用户的标准权限启动进程，还不需要输入密码。虽然要写点API声明，但可控性更强。

首先在你的类里添加API声明：

Imports System.Runtime.InteropServices

Public Class ProcessHelper
    <StructLayout(LayoutKind.Sequential)>
    Private Structure STARTUPINFO
        Public cb As Integer
        Public lpReserved As String
        Public lpDesktop As String
        Public lpTitle As String
        Public dwX As Integer
        Public dwY As Integer
        Public dwXSize As Integer
        Public dwYSize As Integer
        Public dwXCountChars As Integer
        Public dwYCountChars As Integer
        Public dwFillAttribute As Integer
        Public dwFlags As Integer
        Public wShowWindow As Short
        Public cbReserved2 As Short
        Public lpReserved2 As IntPtr
        Public hStdInput As IntPtr
        Public hStdOutput As IntPtr
        Public hStdError As IntPtr
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Private Structure PROCESS_INFORMATION
        Public hProcess As IntPtr
        Public hThread As IntPtr
        Public dwProcessId As Integer
        Public dwThreadId As Integer
    End Structure

    <DllImport("advapi32.dll", SetLastError:=True, CharSet:=CharSet.Unicode)>
    Private Shared Function CreateProcessWithLogonW(
        ByVal lpszUsername As String,
        ByVal lpszDomain As String,
        ByVal lpszPassword As String,
        ByVal dwLogonFlags As Integer,
        ByVal lpszApplicationName As String,
        ByVal lpszCommandLine As String,
        ByVal dwCreationFlags As Integer,
        ByVal lpEnvironment As IntPtr,
        ByVal lpszCurrentDirectory As String,
        ByRef lpStartupInfo As STARTUPINFO,
        ByRef lpProcessInformation As PROCESS_INFORMATION
    ) As Boolean
    End Function

    Private Const LOGON_WITH_PROFILE As Integer = &H1
    Private Const CREATE_UNICODE_ENVIRONMENT As Integer = &H400

    Public Shared Function StartProcessAsStandardUser(exePath As String, arguments As String, workingDir As String) As Boolean
        Dim si As New STARTUPINFO()
        si.cb = Marshal.SizeOf(si)
        Dim pi As New PROCESS_INFORMATION()

        ' 获取当前用户的域名和用户名，无需密码即可复用现有会话
        Dim currentUser = System.Security.Principal.WindowsIdentity.GetCurrent()
        Dim usernameParts = currentUser.Name.Split("\")
        Dim username = usernameParts(1)
        Dim domain = usernameParts(0)

        ' 拼接命令行：程序路径 + 参数
        Dim commandLine = $"""{exePath}"" {arguments}"

        Dim success = CreateProcessWithLogonW(
            username,
            domain,
            Nothing, ' 密码传空，使用当前用户的登录会话
            LOGON_WITH_PROFILE,
            Nothing,
            commandLine,
            CREATE_UNICODE_ENVIRONMENT,
            IntPtr.Zero,
            workingDir,
            si,
            pi
        )

        If success Then
            ' 关闭不需要的系统句柄，避免资源泄漏
            CloseHandle(pi.hProcess)
            CloseHandle(pi.hThread)
        End If

        Return success
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Shared Function CloseHandle(ByVal hObject As IntPtr) As Boolean
    End Function
End Class

然后直接调用这个工具方法：

Dim exePath = System.IO.Path.Combine(Environment.CurrentDirectory, "aprogram.exe")
Dim success = ProcessHelper.StartProcessAsStandardUser(exePath, "Some stuff", Environment.CurrentDirectory)

这个方法不依赖任何第三方进程，直接通过系统API实现权限降级，适合对稳定性和可控性要求更高的场景。

补充：为什么你之前的方法无效？ #

• 当UseShellExecute=False时，.NET使用CreateProcess API，它会直接继承父进程的访问令牌（包括管理员权限），所以子进程还是会以管理员身份运行。
• 当UseShellExecute=True时，如果父进程是管理员，且UAC设置为“从不通知”，Windows可能会默认以提升权限启动程序，即使你没指定runas动词。这时候用explorer代理或者API调用就能绕开这个继承逻辑。

内容的提问来源于stack exchange，提问作者Rob