We are about to roll out several hundred new machines running windows 7, with the OS installed via WDS so at the moment we can make changes and sysprep them into the build.
The problem is a .Net app we wrote years ago which itself spawns a modified command shell. That shell runs a dataflex application that itself needs to run with elevated permissions.
We don't grant users any general admin rights.
Is there a mechanism where we can pre-allow our .Net app to run as administrator so that the command control runs as Administrator?
I'm aware of the changes I can make in the app.manifest to require that the program runs as Administrator. I'm not aware of how I can (as an Administrator) configure the machine to allow that to happen without giving the user more rights or credentials than I would want them to have.
Does the application have to run as Administrator, or does it just need access to specific things? If it has a spurious "am I admin" check at startup, you can probably use a shim from the Application Compatibility Toolkit to lie to it, and then configure access permissions to the things that it actually needs.
If that looks like it'll fly, then you'd be better off taking further questions over to serverfault.
What Roger is getting at is that many people assume that if an app doesn't work as a normal user, they have to give it Administrator rights.That's not true in many, if not most cases. You have to find out WHAT specific rights it's failing with, and then assign those rights. This is more work, but it avoids giving general administrator rights to people.
来源：https://stackoverflow.com/questions/8670839/can-i-modify-a-win7-environment-to-allow-a-net-program-to-always-run-as-adminis