How do you create a hardlink of cmd.exe itself (Windows 10)?

Question

I have a registry addition to allow opening any folder in cmd.exe as admin, but it requires cmd.exe to always run as admin.

You can't change cmd.exe itself to do that, because it's protected.

But I found instructions somewhere in the past (which I can't find now) which allowed it by changing the security - I assume changing the permissions. After creating the hardlink, you had to change it back or it wouldn't work normally.

So I believe the process was:

• change permissions of cmd.exe
• create hardlink of cmd.exe (something like cmdAdmin.exe)
• set cmdAdmin.exe to always run as admin
• revert permissions of cmd.exe

Does anyone know the permissions I need to change (or whatever property it is)?

Answer 1

If I am guessing correctly, look at the registry stuff for the cmd.exe call. Use something like this instead:

powershell -Command "Start-Process cmd -ArgumentList '/s /k pushd \"%V\"' -Verb RunAs"

• The "%V" is the current directory passed by the windows explorer.
• The verb "RunAs" is telling powershell to escalate the process. You can see all of the options avail. to Start-Process here .

I used to disable UAC back in the beginning but now, I don't think that it is a good idea. MOST of the things you are doing shouldn't be spawning the silly UAC dialog. It is a good warning for "HEY! Bad stuff could happen here. This process can do whatever it wants."

Answer 2

This is an example of the XY problem. You don't need to create any hardlink just to run cmd elevated. There are various ways to have a menu item that runs cmd as admin

The simplest way is to apply Andrew Richards' Enhancing the “Open Command Prompt here” Context Menu experience tweak and have the option to run cmd/powershell/bash both as normal and elevated rights

Just import the below *.reg file (or copy from the MSDN blog above)

Windows Registry Editor Version 5.00

; Command Prompt

[HKEY_CLASSES_ROOT\Directory\shell\01MenuCmd]
"MUIVerb"="Command Prompts"
"Icon"="cmd.exe"
"ExtendedSubCommandsKey"="Directory\\ContextMenus\\MenuCmd"

[HKEY_CLASSES_ROOT\Directory\background\shell\01MenuCmd]
"MUIVerb"="Command Prompts"
"Icon"="cmd.exe"
"ExtendedSubCommandsKey"="Directory\\ContextMenus\\MenuCmd"

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuCmd\shell\open]
"MUIVerb"="Command Prompt"
"Icon"="cmd.exe"

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuCmd\shell\open\command]
@="cmd.exe /s /k pushd \"%V\""

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuCmd\shell\runas]
"MUIVerb"="Command Prompt Elevated"
"Icon"="cmd.exe"
"HasLUAShield"=""

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuCmd\shell\runas\command]
@="cmd.exe /s /k pushd \"%V\""


; PowerShell

[HKEY_CLASSES_ROOT\Directory\shell\02MenuPowerShell]
"MUIVerb"="PowerShell Prompts"
"Icon"="powershell.exe"
"ExtendedSubCommandsKey"="Directory\\ContextMenus\\MenuPowerShell"

[HKEY_CLASSES_ROOT\Directory\background\shell\02MenuPowerShell]
"MUIVerb"="PowerShell Prompts"
"Icon"="powershell.exe"
"ExtendedSubCommandsKey"="Directory\\ContextMenus\\MenuPowerShell"

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuPowerShell\shell\open]
"MUIVerb"="PowerShell"
"Icon"="powershell.exe"

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuPowerShell\shell\open\command]
@="powershell.exe -noexit -command Set-Location '%V'"

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuPowerShell\shell\runas]
"MUIVerb"="PowerShell Elevated"
"Icon"="powershell.exe"
"HasLUAShield"=""

[HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuPowerShell\shell\runas\command]
@="powershell.exe -noexit -command Set-Location '%V'"


; Ensure OS Entries are on the Extended Menu (Shift-Right Click)

[HKEY_CLASSES_ROOT\Directory\shell\cmd]
"Extended"=""

[HKEY_CLASSES_ROOT\Directory\background\shell\cmd]
"Extended"=""

[HKEY_CLASSES_ROOT\Directory\shell\Powershell]
"Extended"=""

[HKEY_CLASSES_ROOT\Directory\background\shell\Powershell]
"Extended"=""

Answer 3

Use the inbuilt Windows' VB.Net compiler to elevate.

RunAsAdminConsole.exe creates an elevated console or runs a command leaving the console elevated. The program prompts for credentials. Copy following three text files into a folder and double click the batch file.

The advantage of this put in a shortcut is the admin icon overlay appears on the shortcut's icon. If you just tick Run As Admin in compatibility tab it doesn't get the icon overlay.

REM Three files follow
REM RunAsAdminConsole.bat
REM This file compiles RunAsAdminconsole.vb to RunAsAdminconsole.exe using the system VB.NET compiler.
REM Runs a command elevated using a manifest OR elevates the current console without parameters.
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc "%~dp0\RunAsAdminconsole.vb" /win32manifest:"%~dp0\RunAsAdmin.manifest" /out:"%~dp0\RunAsAdminConsole.exe" /target:exe
REM To use
rem RunAsAdminconsole 
pause

---

;RunAsAdminConsole.vb
imports System.Runtime.InteropServices 
Public Module MyApplication  
  
 Public Sub Main ()
  Dim wshshell as object
  WshShell = CreateObject("WScript.Shell")
  Shell("cmd.exe /k " & Command())
 End Sub 

End Module

---

Name this file RunAsAdmin.manifest

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
    version="1.0.0.0"
    processorArchitecture="*"
    name="Color Management"
    type="win32"
/>
<description>Serenity's Editor</description>
<trustinfo xmlns="urn:schemas-microsoft-com:asm.v2"> 
<security> 
    <requestedprivileges> 
        <requestedexecutionlevel level="requireAdministrator" uiAccess="false"/> 
    </requestedPrivileges> 
</security> 
</trustInfo> 

---

From https://winsourcecode.blogspot.com/2019/12/rem-three-files-followrem.html