Okay, I figured out a way to do it without too much hassle or exposing a password "in the clear".
First, you'll need to enable the administrator account. This is the most inconvenient part. I set my normal account to auto-login, but it's annoying that the administrator account is available on the login screen, even if I never really see it. Some may complain that by exposing the administrator account, it makes the system a little less secure, but since you must set a password for the account in order to use it from the command-line anyway, that concern is moot.
The method I chose requires using some sort of SHELLEXECUTE program that supports running programs minimized. (One could use the START command built into the command interpreter CMD instead, but that would cause a command prompt window to flash whereas a windowless non-console program would avoid that.) There are plenty to choose from, but I just used one that I wrote way back when.
Now, just create a registry entry in the RUN key that calls the ShellExecute, specifying the minimize option, and using RUNAS as the program to execute. (There are other programs that can run a program using a different account if you prefer, but RUNAS comes with Windows and can save the password to avoid including it in the command-line.)
Finally, you'll need to pass the program (and any arguments for it) as an argument to RUNAS.
(Don't forget to run the target program—or any program for that matter—with RUNAS, specifying the /SAVECRED option, at least once in order to save the password.)
The command-line to use can get pretty complex because it is a program calling a program calling a program. It gets worse if you need to specify arguments to the target program, and much worse, if you need to include spaces. The quotation mark situation can quickly become maddening, so a lot of experimentation will likely be necessary.
For example, if you use ShelExec from P.J. Naughter and want to run SpeedFan, you would use a command-line like this:
shelexec /showcmd:sw_hide "/params:/user:administrator /savecred ""C:\Program Files\SpeedFan\speedfan.exe""" /EXE runas
I should point out that I have set SpeedFan's options to start minimized, otherwise instead of running speedfan "directly", I would have to run a second ShellExecute program with its minimize option to run SpeedFan (a program calling a program calling a program calling a program). Getting that to work would almost certainly drive even the most accomplished computer administrator stark raving mad.
It can be a lot of work to get the command-line worked out, but it seems to work quite well for any auto-run background tasks that require administrative access.
(Oh, and while it works, it does have its down-sides, most notably that because it runs the programs indirectly, autorun managers like Autoruns, StartupDelayer, HijackThis etc. will not be able to detect which actual program is being autorun—they'll still work and be able to disable/delete/etc., but they won't show the right icon or file resource info.)
