# Remotely change a program to “Run as Administrator” by default

I manage 50-some machines which are experiencing an error with some legacy software. I spoke with the developer, who recommended changing the compatibility options on about a dozen applications on each system to Run as Administrator.

All of the machines are set so UAC does not notify, so that's not an issue, and all the pertinent folders are shared, however I cannot do \\MACHINE_NAME\path\to\apps\, right-click on app.exe, click properties, and change any options in the compatibility tab. Also you cannot mass-select apps while remote-controlling the machine and set them all at once, they must be done separately, and I have to interrupt the user's workflow to do it. I know the normal compatibility options can be changed in the registry as per this question but does the Run As Administrator flag end up there, too?

Is there any way to handle this more gracefully?

• @Ramhound I don't see how that could be the case, considering the logged-in user does not have all the privileges that an Administrator has. – Adam Smith Sep 29 '14 at 15:56
• @Ramhound He probably has UAC set to "Do not notify". You can't turn UAC off without registry changes. If a program is not flagged to elevate (either by the PE header or compatibility settings or heuristics), it won't be running as admin. – Darth Android Sep 29 '14 at 16:01
• @DarthAndroid exactly so. Sorry that wasn't clear :) I'll edit – Adam Smith Sep 29 '14 at 16:05

The administrator flag does end up there too, and is called RUNASADMIN.

To programatically set application compatibility settings in Windows, add a registry value to one of the following locations:

• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers (For the current user only)
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers (For all users on the system)

The registry value should have the full path to the executable as the name, be of the REG_SZ type, and contain a space-separated list of compatibility flags as the data. Up to 3 different compatibility settings can be configured:

Privilege Level:

• RUNASADMIN - Runs the program with the administrative security token

Display Settings:

• DISABLETHEMES - Disable Visual Themes
• 640X480 - Run in 640 x 480 screen resolution
• HIGHDPIAWARE - Disable display scaling on high DPI settings
• 256COLOR - Run in 256 colors
• DISABLEDWM - Disable Desktop Composition

Compatibility Mode:

• WIN95 - Windows 95
• WIN98 - Windows 98
• WIN4SP5 - Windows NT 4.0 SP5
• WIN2000 - Windows 2000
• WINXPSP2 - Windows XP SP2
• WINXPSP3 - Windows XP SP3
• VISTARTM - Vista
• VISTASP1 - Vista SP1
• VISTASP2 - Vista SP2
• WIN7RTM - Windows 7
• WINSRV03SP1 - Windows Server 2003 SP1
• WINSRV08SP1 - Windows Server 2008 SP1

Source

For example, the following flags an executable as requiring both administrative privileges and compatibility mode for Windows XP SP3:

reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\temp\compatmodel\iconsext.exe" /t REG_SZ /d "WINXPSP3 RUNASADMIN" /f


To apply this remotely, either push out registry settings with group policy, remotely execute a command like the above, or enable the remote registry service and use that to apply the settings.

• This is perfect! Now to lean on our network engineer to get him to push this out via GP.... – Adam Smith Sep 29 '14 at 16:19

For those looking to do this from PowerShell:

This is using HKCU, if you want HKLM, find/replace that. I did not find the HKLM version worked, only HKCU. Maybe it required a reboot.

#create the key if it doesn't exist already
if(-not (Test-Path -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"))
{
$_ = New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" -Name "AppCompatFlags" } if(-not (Test-Path -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers")) {$_ = New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\" -Name "Layers"
}

#create the value
\$_ = New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" -Name "C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\devenv.exe" -PropertyType String -Value 'RUNASADMIN'

• whee! Downvote with no feedback. – Pxtl Jun 6 '18 at 16:30