29

In my PowerShell script, I create a shortcut to a .exe (using something similar to the answer from this question):

$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$Home\Desktop\ColorPix.lnk")
$Shortcut.TargetPath = "C:\Program Files (x86)\ColorPix\ColorPix.exe"
$Shortcut.Save()

Now, when I create the shortcut, how do I add to the script to make it default to running as Administrator?

Community
  • 1
  • 1
Michelle
  • 613
  • 1
  • 8
  • 17
  • possible duplicate of [How can I use JScript to create a shortcut that uses "Run as Administrator"](http://stackoverflow.com/questions/11162802/how-can-i-use-jscript-to-create-a-shortcut-that-uses-run-as-administrator) – Nathan Rice Mar 11 '15 at 21:45
  • Definitely read the question Nathan linked above. To translate the code to PowerShell: $file = "$Home\Desktop\ColorPix.lnk"; $bytes = [System.IO.File]::ReadAllBytes($file); $bytes[0x15] = $bytes[0x15] -bor 0x20; #Set RunAsAdministrator [System.IO.File]::WriteAllBytes($file, $bytes); Use –bor to set RunAsAdministrator option and –bxor to unset. – Jan Chrbolka Mar 11 '15 at 23:26

2 Answers2

52

This answer is a PowerShell translation of an excellent answer to this question How can I use JScript to create a shortcut that uses "Run as Administrator".

In short, you need to read the .lnk file in as an array of bytes. Locate byte 21 (0x15) and change bit 6 (0x20) to 1. This is the RunAsAdministrator flag. Then you write you byte array back into the .lnk file.

In your code this would look like this:

$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$Home\Desktop\ColorPix.lnk")
$Shortcut.TargetPath = "C:\Program Files (x86)\ColorPix\ColorPix.exe"
$Shortcut.Save()

$bytes = [System.IO.File]::ReadAllBytes("$Home\Desktop\ColorPix.lnk")
$bytes[0x15] = $bytes[0x15] -bor 0x20 #set byte 21 (0x15) bit 6 (0x20) ON
[System.IO.File]::WriteAllBytes("$Home\Desktop\ColorPix.lnk", $bytes)

If anybody want to change something else in a .LNK file you can refer to official Microsoft documentation.

Community
  • 1
  • 1
Jan Chrbolka
  • 4,008
  • 2
  • 27
  • 37
  • 3
    That byte changing is some old school Windows hocus pocus. Thanks for the PowerShell translation. – hsimah Oct 19 '18 at 01:21
  • The last line didnt't work for me, so I used `$bytes | Set-Content $shortcutPath -Encoding Byte` instead – Andy Joiner Jul 16 '19 at 18:53
  • 1
    PowerShell arrays starts from item 0, so it is the 22nd byte, more precisely bit 6 of the 2nd byte in the LinkFlags structure of the ShellLinkHeader structure, so bit 14 of the LinkFlags structure, getting us to documented position N "RunAsUser". But on 64-bit Windows, it's the bit 6 of the 43rd byte that is modified. My guess is that each byte being stored on 16 bits instead of 8, the space reserved for the 8 first flags is now doubled, so the flag for RunAsUser is on byte 4*2 + 16*2 + 1*2 + 1 = 43. And since it seems byte 42 isn't 0x00, I suspect W64 to use new undocumented flags... – hymced Oct 12 '20 at 11:32
  • @hsimah regardless byte changing is good or bad, it has nothing to do with Windows. – g.pickardou Feb 04 '21 at 05:14
  • 2
    @g.pickardou I didn't know bytes existed on other platforms; thank you for taking time out of your day to share your vast knowledge – hsimah Feb 04 '21 at 18:41
-2

You can use the -Elevate true switch for this:

    CreateShortcut -name "myApp" -Target 
    "${env:ProgramFiles}\mApp\myApp.exe" -OutputDirectory 
    "C:\Users\Public\Desktop" -Elevated True
Bhargav Rao
  • 45,811
  • 27
  • 120
  • 136
Elgin Methley Prince
  • 11
  • 2