How to elevate specific command lines with ProfileUnity

ProfileUnity includes a signed elevation helper, LwL.ProfileUnity.Client.CmdRunner.exe, that allows specific applications or commands to run with elevated privileges — without granting users local administrator access. This is the recommended approach for elevating a shortcut, a PowerShell script, or a CMD command on a per-need basis.

How It Works

CmdRunner acts as an elevation broker. Rather than elevating an entire PowerShell session or granting a user full admin rights, you define a list of pre-approved commands in its companion config file. Each command is assigned a numeric ID. At runtime, a ProfileUnity Shortcut calls CmdRunner with the ID of the command to elevate — CmdRunner then launches that specific process with elevated privileges as a child process.

Step 1 — Configure the Config File

Open LwL.ProfileUnity.Client.CmdRunner.exe.config in a text editor and locate the ConfigCommands section. Add a <ConfigCommand> entry for each process you want to allow elevation for. Each entry requires a unique id starting at 1.

The basic structure of the ConfigCommands section:

Config Examples

The following examples cover the three supported invocation methods: direct EXE, PowerShell, and CMD. All examples use notepad.exe as the target for consistency.

Method 1 — Direct EXE

The simplest approach. Provide the full path to the executable, quoted with ".

Method 2 — Via PowerShell

Use PowerShell's Start-Process to launch the target. Note the mix of single quotes (for the inner path) and " (for XML escaping of the outer executable).

The single quotes around the target path are PowerShell string syntax — do not use " for the inner path when using this method.

Method 3 — Via CMD

Use cmd.exe /c to run a command or launch an executable. Useful when the target is a batch file or a command string rather than a standalone EXE.

Method 4 — Interactive Window (silent="false")

When you want to present an interactive cmd.exe or powershell.exe window to the user — rather than running silently in the background — add the silent="false" attribute. Without this, the window will be hidden.

The default behavior when silent is omitted or set to true is to run the process without showing a window. Always use silent="false" when elevating an interactive shell that a user needs to interact with.

Step 2 — Call from a ProfileUnity Shortcut

Once the config file is set up, create a Shortcut in the ProfileUnity Management Console. Set the shortcut target to lwl_userapp_trigger64.exe and pass CmdRunner as the first argument followed by the //RunCommand switch and the /elevate flag.

Full example — run the command at config ID 1:

RunCommand Index Reference

The //RunCommand argument takes a zero-based index that maps to the id values in the config file, which start at 1. The offset of zero means RunCommand 0 maps to config id="1", RunCommand 1 maps to id="2", and so on.

Example — three commands defined, each called from a separate shortcut:

Each shortcut in this example calls a different elevated command independently. Users see only the shortcut — they never interact with CmdRunner directly.