windows - How to call environment variables in runas command for right click context menu

I am having trouble with using environmental variables with using runas when using the command in the registry for a right click context menu command. I have tried different methods of escaping the variable, however runas has some different syntax that is not clearly explained.

I am using a custom command in the registry for a right click context menu item. For example I am trying to make a new right click command e.g. HKEY_USERS\\Software\Classes\Msi.Package\shell\RunAsAdmin\command.

I realize that I can hold down shift and right click to use the shell interface to run as a different user, however using runas from the command line provides the ability to use additional options and parameter switches such as \noprofile and \savecred.

Initial attempt

using runas directly, un-escaped

Here is what I tried initially using runas directly:

runas /noprofile /user:Administrator "\"%SystemRoot%\System32\msiexec.exe\" /i \"%1\" %*"

using cmd first, un-escaped

For debugging purposes, I sent the command first to cmd (with the option not to close the window) and then to runas

cmd /k "runas /noprofile /user:Administrator "\"%SystemRoot%\System32\msiexec.exe\" /i \"%1\" %*""

using runas directly or cmd first, un-escaped

The result shows the environmental variable is not being interpreted correctly. For some reason the %s is being replaced by a 1

Attempting to start "1ystemRoot\System32\msiexec.exe" /i "D:\Downloads\somePackage.msi"  as user "Administrator" ...
RUNAS ERROR: Unable to run - "1ystemRoot\System32\msiexec.exe" /i "D:\Downloads\somePackage.msi"
2: The system cannot find the file specified.

using runas directly or cmd first, escaped with backslash

With my first attempt at escaping the variable, I get the same result 1ystemRoot if I escape the percent signs with a backslash \ around the environment variable (e.g. \%SystemRoot\%) for both sending to cmd first or sending to runas directly.

I also tried putting quotes \" around the environment variable (e.g. \"%SystemRoot\"%) and that didn't work either.

Workaround

using cmd first, escaped with percent

I found that the following works after sending to cmd first and then runas

cmd /k "runas /noprofile /user:Administrator "\"%%SystemRoot%%\System32\msiexec.exe\" /i \"%1\" %*""

Attempting to start "C:\Windows\System32\msiexec.exe" /i "D:\Downloads\somePackage.msi" as user "Administrator" ...

And it worked

using runas directly, escaped with percent

However when I use the same syntax with runas directly, it does not interpret or replace the environmental variable with it's value, which seems very strange to me.

runas /noprofile /user:Administrator "\"%%SystemRoot%%\System32\msiexec.exe\" /i \"%1\" %*"

This result shows runas not replacing the environment variable as shown below before the command prompt window quickly closes

Attempting to start "%SystemRoot%\System32\msiexec.exe" /i "D:\Downloads\somePackage.msi" as user "Administrator" ...

Correct runas syntax?

using runas directly, correct syntax?

Is there a correct way to escape or call out environment variables for runas directly when using right click context menu registry commands?

(It seems like it has something to do with explorer sending commands/parameters differently or runas interpreting commands/parameters differently.)

Or do I have to send to cmd first and then runas to get the environment variables to populate, as I did for debugging purposes?

References

1. Using backslash to escape characters in cmd.exe


2. runas does not allow complex arguments? - Stack Overflow


3. Quotes, Escape Characters, Delimiters - Windows CMD - SS64


4. Batch files - Escape Characters - Rob van der Woude's Scripting Pages