One of the first things we do in the installation that our internal install framework generates is to elevate the user in case we run on Windows Vista or Windows Server 2008.
The way to do it is a common knowledge – in a VBScript file, start your process with ShellExecute and pass the “RunAs” parameter.
However, we had at least two problems with it, which were due to the fact that our install scripts assumed their working directory is the directory they reside in. While this was correct in a non-elevated environment (e.g. on Windows XP/2003), it turns out that when ShellExecute starts an elevated process, the elevated process does not inherit the working directory from the calling process, but instead, its working directory is initialized to the system directory.
I didn’t see this mentioned in any of the places that explain how to elevate a process, so I thought it will be good to at least post it here.
After I wrote this, I saw that Raymond Chen wrote that this was done in order to avoid certain security attacks. See also this post by Chris Jackson where he explains that elevated process doesn’t get the environment variables of the process that started it because it is not the real child process of the elevating process. He then adds in a reply to a commenter that the working directory is another story.
splintor's blog 