Windows batch file not running when I double click, how to restore the association with cmd.exe

How do I get current logged in user name when running a batch file as administrator

It runs fine when the current user has local admin privileges, but for users who aren't I have to enter the domain administrator password for the changes to take place.

With the below example you just set a variable with the environmental variables as you already have in your ICACLS command logic, and then use that variable to specify the account to grant the applicable permissions passing it to a CALL routine.

@ECHO OFF
SET Identity=%userdomain%\%username%
CALL :ICACLS "%Identity%"
GOTO EOF

:ICACLS
runas /user:MYDOMAIN\USER icacls "program files directory" /grant %~1:F
GOTO EOF

If you have trouble

If you're running cmd.exe with RUNAS and you determine the %userdomain%\%username% variables don't set (or list) the expected values which you need to use for the ICACLS commands to work as expected, then run the below commands in cmd.exe before using the RUNAS functionality to find the current logged on domain and username credential values which you can then use with the ICACLS commands for setting the permissions for that identity\security principal.

SET Identity=%userdomain%\%username%
ECHO %Identity%

The situation you describe is expected behavior when logged on with the built-in Administrator account, even if you have User Account Control (UAC) enabled.

Starting with Windows Vista (and as of this writing, including Windows 10) in the default configuration, applications run with the built-in Administrator account are executed with full administrative privileges. This is because of the default setting of the "Admin Approval Mode" security policy is Disabled:

The User Account Control: Admin Approval Mode for the built-in Administrator account policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account.

The options are:

• Enabled. The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation.

• Disabled. (Default) The built-in Administrator account runs all applications with full administrative privilege.

How to Change the Admin Approval Mode Setting

If you have the Professional/Business/Enterprise/Ultimate edition of Windows: You can change this setting by editing local Group Policy:

1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER.

2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

3. In the console tree, expand Local Policies, and then click Security Options.

4. In the details pane, scroll down and double-click the Group Policy setting User Account Control: Admin Approval Mode for the built-in Administrator account

5. On the Properties page, make your selection, and then click OK.

If you have the Home or Starter edition of Windows: You don't have access to secpol.msc and therefore cannot edit the Local Security Policy. However, this Super User answer points us to another fortunately, still accessible link at askvg.com that explains how to change the setting in the Registry:

1. Type regedit in RUN or Start Menu search box and press Enter. It'll open Registry Editor. Now go to following key:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

2. Under Policies key look for a key with the name "System". If it's not present then create it by right-click on Policies key and select "New -> Key" and give it name "System".

3. Now select System key and in right-side pane create a new DWORD value to apply the desired tweak as mentioned in following list:

User Account Control: Admin Approval Mode for the Built-in Administrator account

DWORD Value - FilterAdministratorToken

To Enable - 1
To Disable - 0