Set up RunAdminGate step by step

Get the zip from the download page and check its SHA-256 against the value on the release page. Files from the internet carry a “downloaded” mark, so unblock the zip before you extract it.

PS C:\Setup> Get-FileHash .\RunAdminGate-x64.zip -Algorithm SHA256
PS C:\Setup> Unblock-File .\RunAdminGate-x64.zip
PS C:\Setup> Expand-Archive .\RunAdminGate-x64.zip -DestinationPath .\RunAdminGate

Keep both files in the same folder: runadmingate.exe is the service and launcher, runadmingate-manager.exe is the window you configure it with.

Open runadmingate-manager.exe and approve the UAC prompt; the manager needs admin rights because it writes to HKLM and installs a service. The header shows Service not installed. Click Install service.

The install:

• copies the launcher to C:\Program Files\RunAdminGate\runadmingate.exe,
• creates the RunAdminGate service (automatic start, restarts after a failure),
• creates the key HKLM\SOFTWARE\RunAdminGate and registers the Event Log source,
• starts the service. The header changes to Service running.

From a script, use the same switch. The launcher is a windowed program, so wait for it to read the exit code:

PS C:\Setup\RunAdminGate> $p = Start-Process .\runadmingate.exe -ArgumentList '/install','/quiet' -Wait -PassThru
PS C:\Setup\RunAdminGate> $p.ExitCode
0

Use one of the three buttons above the list:

• Add app picks one program file. This is the safest choice.
• Add folder allows the programs in a folder. Tick Include subfolders to go deeper.
• Add rule takes a path or pattern you type, for example an installer share.

The drive letter or \\server\share must be written out. Relative paths and entries such as *\setup.exe are rejected, so an entry can never mean “a file with this name anywhere”.

Select the program in the list. Under Run as, pick the account it starts with:

• SYSTEM account: works for any user. The program doesn't see the user's own settings, HKEY_CURRENT_USER or mapped drives.
• The user, with administrator rights: the program runs under the user's own account, elevated, so it sees their settings and files. The user never joins the local Administrators group. Stored as /asadmin at the end of the entry.

Under Allowed arguments, pick one:

• No arguments: the program starts exactly as listed. Anything extra is refused.
• Let users open a file with it: no arguments, or one full file path. The manager stores this as %1, and Open with needs it.
• Only these arguments: the arguments must match what you type, ignoring case. Inside arguments, * matches anything and ? one character, so /S /D=* allows any install folder.

Shortcut. Under Shortcut, choose Desktop (all users), Start menu (all users) or Choose a folder…, then Create shortcut. It is called “App (admin)”, uses the app's icon and runs the app through the launcher.

Open with. Turn on Show in the “Open with” menu and list the file types, for example .txt, .log, .ini. Suggest fills in the types the app already handles. Click Save.

Scripts and your own shortcuts. Call the installed launcher with the program and its arguments:

C:\> "C:\Program Files\RunAdminGate\runadmingate.exe" "C:\Program Files\Fabrikam\Updater\update.exe"

1. Sign in with an account that is not in the local Administrators group.
2. Double-click the “App (admin)” shortcut. The app opens with no UAC prompt.
3. In Task Manager, open Details. The User name column shows SYSTEM for the app.
4. Try a program that isn't on the list. RunAdminGate shows a message that it is not on the allow-list, and nothing starts.

PS C:\Users\mlee> & "C:\Program Files\RunAdminGate\runadmingate.exe" C:\Windows\System32\cmd.exe
# A message box says: This program is not on the RunAdminGate allow-list.

Open Event Viewer › Windows Logs › Application, choose Filter Current Log… and pick the event source RunAdminGate.

PS C:\> Get-WinEvent -FilterHashtable @{ LogName = 'Application'; ProviderName = 'RunAdminGate' } -MaxEvents 20 |
    Format-Table TimeCreated, Id, Message -Wrap

Silent install. Run this from your deployment tool as SYSTEM or as an administrator. /allowedpath: takes entries separated by ; and adds them to the existing list without removing anything. Running /install again upgrades in place.

C:\Setup\RunAdminGate> start /wait runadmingate.exe /install /allowedpath:"C:\Program Files\Fabrikam\Updater\update.exe;\\fs01\updates\setup*.msi /qn" /quiet
C:\Setup\RunAdminGate> echo %ERRORLEVEL%
0

Exit code 0 means installed and running. 1603 means it failed; the reason is in the Application log.

Group Policy. Manage the list centrally with a Group Policy Preferences registry item:

The service reads the value on every request, so a policy refresh is enough. The policy replaces the whole value each time it applies, so changes made in the manager on that PC will be overwritten. Keep the list in one place.

Shortcuts by policy. A Group Policy Preferences shortcut works the same as the manager's: target C:\Program Files\RunAdminGate\runadmingate.exe, the quoted program path as the arguments, and the program file as the icon.

Click Uninstall in the manager, or run the launcher from your setup folder:

C:\Setup\RunAdminGate> start /wait runadmingate.exe /uninstall /quiet

This removes the service, the HKLM\SOFTWARE\RunAdminGate key with the allow-list, the Open with entries, the shortcuts the manager created, the Event Log source and C:\Program Files\RunAdminGate. If you run it from inside that folder, the last file is deleted at the next restart. Remove any Group Policy item first, or it will create the key again.