REG.EXE throwing access denied when run in command line, but not as a .lnk

Question

I have a strange problem here. I am trying to disable UAC via the command line (batch file) and by using REG.EXE (as it doesn't ask for UAC access itself). I have been able to create a shortcut (.lnk) with the target:

C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f

If I run that as an administrator - there is no problem at all, it changes the registry. If I try to run that command via the command line itself (run as the exact same administrator), I get access denied.

Eventually, I want to move it to a batch script, but that should be no problem once I am able to run it on the command line. Any ideas? Thank you.

Answer 1

Just because it doesn't prompt for UAC escalation, doesn't mean it doesn't need it.

It needs it.

You'll need to run it from an escalated context - an escalated command prompt, a scheduled task with "run as highest privilege" checked, something. The registry simply cannot be modified without some form of privilege escalation.

Answer 2

You need an elevated context to do it. I searched too much for a task that I needed, and couldn't find a way to request an elevation from the prompt in a batch file.

However, contrary to what Shane Madden has mentioned in the comments of the previous answer, I've been using Prio from prnwatch.com since time immemorial to do automatic silent elevation of certain processes. Naturally, you cannot count on this if you will be distributing your batch file to run on other computers....