Okay, I figured out a way to do it without too much hassle or exposing a password in the clear.
First, you’ll need to enable the administrator account. This is the most inconvenient part. I set my normal account to auto-login, but it’s annoying that the administrator account is available on the login screen, even if I never really see it. Some may complain that by exposing the administrator account, it makes the system a little less secure, but since you must set a password for the account in order to use it from the command-line anyway, that concern is moot.
The method I chose requires using some sort of SHELLEXECUTE program that supports running programs minimized. (One could use the START command built into the command interpreter CMD instead, but that would cause a command prompt window to flash whereas a windowless non-console program would avoid that.) There are plenty to choose from, but I just used one that I wrote way back when.
Now, just create a registry entry in the RUN key that calls the ShellExecute, specifying the minimize option, and using RUNAS as the program to execute. (There are other programs that can run a program using a different account if you prefer, but RUNAS comes with Windows and can save the password to avoid including it in the command-line.) Alternately, you can create a regular Windows shortcut and move it to the Startup folder.
Finally, you’ll need to pass the program (and any arguments for it) as an argument to RUNAS.
(Don’t forget to run the target program—or any program for that matter—with RUNAS, specifying the /SAVECRED option, at least once without running it minimized in order to save the password.)
The command-line to use can get pretty complex because it is a program calling a program calling a program. It gets worse if you need to specify arguments to the target program, and much worse, if you need to include spaces. The quotation mark situation can quickly become maddening, so a lot of experimentation will likely be necessary.
For example, if you use ShelExec from P.J. Naughter and want to run SpeedFan, you would use a command-line like this:
shelexec /showcmd:sw_hide /EXE runas "/params:/user:administrator /savecred ""C:\Program Files\SpeedFan\speedfan.exe"""
I should point out that I have set SpeedFan’s options to start minimized, otherwise instead of running speedfan “directly”, I would have to run a second ShellExecute program with its minimize option to run SpeedFan (a program calling a program calling a program calling a program). Getting that to work would almost certainly drive even the most accomplished computer administrator stark raving mad.
It can be a bit of work to get the command-line worked out, but it seems to work quite well for any auto-run background tasks that require administrative access. Best of all, it works for standard/limited user accounts, so you can use this method to have programs auto-run with elevated privileges without giving a UAC prompt for regular users.
(While it works nicely, it does have its down-sides, most notably that because it runs the programs indirectly, autorun managers like Autoruns, StartupDelayer, HijackThis etc. will not be able to detect which actual program is being autorun—they’ll still work and be able to disable/delete/etc., but they won’t show the right icon or file resource info.)
The built-in autorun functions only run them without admin which limits their functions (eg Speedfan uses a different, less-functional monitoring chip when not admin). Like I said, they need to run as early as possible and scheduling them as tasks is later than in the RUN key in the registry. Using the shortcut method (ie in the Startup folder has the same problem). – Synetech – 2010-12-11T00:18:26.490
Even after specifying RUN AS ADMINISTRATOR in the COMPATIBILITY tab? – Sparx – 2010-12-11T05:35:33.800
Using that option causes a UAC prompt. Autorun tasks obviously need to run without a prompt. I'll add that to the question though just to be absolutely clear. – Synetech – 2010-12-11T06:43:18.987