如何一步启动以其他用户身份运行的高权限Windows应用？

Let’s break down why your current approach isn’t working, then walk through two reliable solutions to get your admin-only app running as the technical user from a regular user’s session.

Core Issue: You Can’t Combine Credential Switching and UAC Elevation in a Single Process.Start Call #

Windows’ security model keeps these operations separate for good reason, and here’s why each of your attempts fails:

1. Using Credentials with UseShellExecute=false:
   When you pass alternate credentials to Process.Start, it uses the LogonUser API to create a session for your technical user. By default, this gives you a standard (filtered) token—even if the user is an admin. Windows strips admin privileges from the token unless you explicitly request an elevated token during process creation. Your target app’s requireAdministrator manifest expects an elevated token, so the process throws the "requires elevated privileges" error. UAC doesn’t kick in here because prompts only trigger when launching via the shell (UseShellExecute=true) with the current user’s context.

2. Using Verb="runas" (UAC Elevation):
   The runas verb tells Windows to launch with elevated privileges, but this only works in the current user’s context. You can’t pass alternate credentials here because the ShellExecute API (used when UseShellExecute=true) doesn’t support specifying different user credentials. This leaves you either elevating the current user (if they have admin rights) or prompting them for admin credentials—neither of which fits your goal.

Solutions to Run the App as the Technical Admin with Elevated Privileges #

You have two solid options to achieve what you want: using Windows APIs to manually retrieve an elevated token for the technical user, or leveraging the Task Scheduler to handle elevation and user context automatically.

Option 1: Use Windows APIs to Get an Elevated Token and Start the Process #

This approach requires pinvoking several Windows APIs to logon the user, fetch their elevated token, and start the process with that token. Here’s a simplified implementation:

First, define the necessary P/Invoke signatures and constants:

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Security;

public static class ElevatedProcessRunner
{
    // Windows API constants
    private const int LOGON32_LOGON_INTERACTIVE = 2;
    private const int LOGON32_PROVIDER_DEFAULT = 0;
    private const int TOKEN_QUERY = 0x0008;
    private const int TOKEN_DUPLICATE = 0x0002;
    private const int TOKEN_ASSIGN_PRIMARY = 0x0001;
    private const int CREATE_NEW_CONSOLE = 0x00000010;
    private const int TokenElevationType = 18;
    private const int TokenElevationTypeFull = 2;

    [StructLayout(LayoutKind.Sequential)]
    private struct STARTUPINFO
    {
        public int cb;
        public string lpReserved;
        public string lpDesktop;
        public string lpTitle;
        public int dwX;
        public int dwY;
        public int dwXSize;
        public int dwYSize;
        public int dwXCountChars;
        public int dwYCountChars;
        public int dwFillAttribute;
        public int dwFlags;
        public short wShowWindow;
        public short cbReserved2;
        public IntPtr lpReserved2;
        public IntPtr hStdInput;
        public IntPtr hStdOutput;
        public IntPtr hStdError;
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct PROCESS_INFORMATION
    {
        public IntPtr hProcess;
        public IntPtr hThread;
        public int dwProcessId;
        public int dwThreadId;
    }

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    private static extern bool LogonUser(
        string lpszUsername,
        string lpszDomain,
        SecureString lpszPassword,
        int dwLogonType,
        int dwLogonProvider,
        out IntPtr phToken);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool GetTokenInformation(
        IntPtr TokenHandle,
        int TokenInformationClass,
        IntPtr TokenInformation,
        int TokenInformationLength,
        out int ReturnLength);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool DuplicateTokenEx(
        IntPtr hExistingToken,
        uint dwDesiredAccess,
        IntPtr lpTokenAttributes,
        int ImpersonationLevel,
        int TokenType,
        out IntPtr phNewToken);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool CreateProcessWithTokenW(
        IntPtr hToken,
        int dwLogonFlags,
        string lpApplicationName,
        string lpCommandLine,
        int dwCreationFlags,
        IntPtr lpEnvironment,
        string lpCurrentDirectory,
        ref STARTUPINFO lpStartupInfo,
        out PROCESS_INFORMATION lpProcessInformation);

    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern bool CloseHandle(IntPtr hObject);

    public static Process RunElevatedAsUser(string userDomain, string userName, SecureString userPassword, string workingDirectory, string programPath, string arguments)
    {
        IntPtr userToken = IntPtr.Zero;
        IntPtr elevatedToken = IntPtr.Zero;
        PROCESS_INFORMATION pi = new PROCESS_INFORMATION();

        try
        {
            // Logon the technical user to get a base token
            if (!LogonUser(userName, userDomain, userPassword, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, out userToken))
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }

            // Verify the user can elevate (is an admin)
            IntPtr elevationTypePtr = Marshal.AllocHGlobal(4);
            try
            {
                int returnLength;
                if (!GetTokenInformation(userToken, TokenElevationType, elevationTypePtr, 4, out returnLength))
                {
                    throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
                }

                int elevationType = Marshal.ReadInt32(elevationTypePtr);
                if (elevationType != TokenElevationTypeFull)
                {
                    throw new InvalidOperationException("The technical user does not have administrative privileges or cannot elevate.");
                }
            }
            finally
            {
                Marshal.FreeHGlobal(elevationTypePtr);
            }

            // Duplicate the token to get an elevated version
            const uint desiredAccess = TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY;
            if (!DuplicateTokenEx(userToken, desiredAccess, IntPtr.Zero, 2, 1, out elevatedToken))
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }

            // Start the target app with the elevated token
            STARTUPINFO si = new STARTUPINFO();
            si.cb = Marshal.SizeOf(si);
            string commandLine = $@"""{programPath}"" {arguments}";

            if (!CreateProcessWithTokenW(elevatedToken, 0, null, commandLine, CREATE_NEW_CONSOLE, IntPtr.Zero, workingDirectory, ref si, out pi))
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }

            return Process.GetProcessById(pi.dwProcessId);
        }
        finally
        {
            // Clean up unmanaged handles
            if (userToken != IntPtr.Zero) CloseHandle(userToken);
            if (elevatedToken != IntPtr.Zero) CloseHandle(elevatedToken);
            if (pi.hProcess != IntPtr.Zero) CloseHandle(pi.hProcess);
            if (pi.hThread != IntPtr.Zero) CloseHandle(pi.hThread);
        }
    }
}

Critical Notes:

• Privileges Required: Your launcher needs the SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege enabled. Regular users don’t have these by default, so you’ll need to grant them via Group Policy or during installation.
• Secure Password Handling: Always use SecureString to avoid storing passwords in plaintext memory.

Option 2: Use Task Scheduler (Simpler and More Reliable) #

A far easier approach is to create a scheduled task configured to run your target app as the technical admin with elevated privileges. Your launcher can then trigger this task instead of starting the app directly. Here’s how:

1. Create the Scheduled Task:

   • Open Task Scheduler and create a new task.
   • General Tab:
     • Select "Run whether user is logged on or not" (or "Run only when user is logged on" based on your needs).
     • Check "Run with highest privileges".
     • Enter the technical admin’s credentials and save the password.
   • Actions Tab:
     • Add an action to "Start a program", pointing to your target app’s executable and any arguments.
   • Settings Tab:
     • Check "Allow task to be run on demand".

2. Trigger the Task from Your Launcher:
   Use schtasks.exe to start the task programmatically:

public static void RunElevatedTask(string taskName)
{
    var startInfo = new ProcessStartInfo
    {
        FileName = "schtasks.exe",
        Arguments = $"/Run /TN \"{taskName}\"",
        UseShellExecute = false,
        CreateNoWindow = true
    };

    Process.Start(startInfo);
}

Why This Works:

• Task Scheduler handles the elevation and user context correctly, bypassing the limitations of Process.Start.
• No special privileges are needed for the launcher itself.
• The regular user won’t be prompted for credentials—everything runs silently using the stored technical admin account.

Key Takeaway #

Windows separates user switching and elevation to maintain security, so you can’t do both in a single Process.Start call. But either using Windows APIs (with the right privileges) or the Task Scheduler will let you run your admin-only app as the technical user from a regular user’s session.

内容的提问来源于stack exchange，提问作者Kai Giebeler