How to load admin account in background and automatically login to non-admin account in foreground in windows 10?

Question

Is there an option to ensure windows 10 automatically starts loading the Admin account without granting the user access to it? Essentially transferring the state of the admin account from not loaded, to loaded, whilst keeping it locked.

My XY-Problem: I'm trying to automatically run a program from an admin account right after startup. Without automatically giving access to the admin account at startup. So I would like to run the admin account in the background whilst staying locked.

My current solution is to run a .vbs script placed in the startup folder of the admin account that automatically locks the admin account after startup, but that is still a small security risk, people can delete that startup script before it has run, right after automatic sign in of the user account.

There are 2 users on the windows 10: user0 (admin) and user1 (non-admin)

A lot of similar solutions are provided, however, these all entail the password being typed in, or grant access to the admin account through the automatic sign in.

Answer 1

Imagine if you asked the question about a physical door instead of an account password.

Can I go through a door that is locked?

No. The best thing to do is to not ask such a silly question.

But I really want the door to be locked, except in this one specific scenario!

No. If something is locked, it's locked, for all scenarios or none.

The typically preferred way to run software as another user, in Microsoft Windows, is to use the "Runas" feature. From the command line, you can use the "Runas" command. From the (File) Explorer program, you can hold the Shift key down and right-click to use the GUI. These methods require interaction.

Other solutions involve downloading third party programs, like SudoWin (named after the wonderful "sudo" program built into many Unix platforms). Such software may install a service to help with these things.

There is one more possible option, which may seem not-very-straightforward, but is commonly recognized as the most convenient available option. Use Task Scheduler. Task Scheduler can elevate, and ask you for a password when the task is created, and then the task can be run by a non-elevated user. This may be a way to help get one account to run as another account.

However, if you want the account to be usable, I would imagine it may need to be unlocked. Giving the account a sufficiently complex password should prevent unauthorized usage, thereby giving you the security that you seek. Marking the account as being entirely unable to authenticate may provide further help in the goal of preventing unauthorized usage, but like a locked door, may also have a side effect of also affecting the desirable usage. I'm not familiar with any sort of built in functionality to support having you declare a desired "exception" that will work, and with Microsoft Windows being closed source software, sometimes the most sensible approach to using this software is to just accept the limitations of the way it was designed (or try alternate software -- in this case, a different operating system).