How to pass environment variables on administrator context (4287273)

How to pass environment variables on administrator context

When running a batch file in an application launcher element with administrative rights (by selecting the "Run as Administrator" option in the element settings section) the batch file works as expected when the user is a local or domain administrator account but it fails when the user is a regular user with no administrative rights.

When an application launcher is applied with administrative rights ("Run as administrator" option es enabled) the application runs in the context of the Desktop Authority Domain User Account (the one assigned in the administrative service in Domain Controller) and not the actual user account, this account impersonates the actual user to be able to execute the application with administration rights.

If a batch file uses environmental variables like %username% or %temp% these variables will be resolved in the current user context, and if the context used is the Desktop Authority Domain User Account (because "Run as administrator" option was enabled) then these variables will return the values for Desktop Authority User Account and not the actual user account, the batch file is working but returning different values than expected.

To use a batch file with environment variables, these values must be passed as arguments to the batch file, the reason for this is that the variables evaluated while the element is being processed are still the ones belonging to the current user's context, the Desktop Authority User Account will be used when the application is launched, not before.

For example, if the batch file is:

@echo off
icacls C:\Users\%username%\AppData\LocalLow\Sun\Java\Deployment\deployment.properties /grant everyone:(rx) /deny everyone:(wd) /t /c

And the Application Launcher element will be

File name including path: filename.bat
Arguments:

Then even though the current user was for example CorrectUserName, if Desktop Authority Domain User Account is DAUser then the evaluation of the statement will be:

@echo off
icacls C:\Users\DAUser\AppData\LocalLow\Sun\Java\Deployment\deployment.properties /grant everyone:(rx) /deny everyone:(wd) /t /c

And this command will be applied to wrong user, not to CorrectUserName account.

To avoid this, the batch file could be changed to:

@echo off
icacls C:\Users\%1\AppData\LocalLow\Sun\Java\Deployment\deployment.properties /grant everyone:(rx) /deny everyone:(wd) /t /c

The %1 will be treated as an argument, then modifying the element

File name including path: filename.bat
Arguments: %username%

then the application launcher, when evaluated, will trigger the batch file as

filename.bat CorrectUserName

And the batch file will take the correct parameter when %1 is resolved as CorrectUserName.