I can try and ask `explorer.exe` to launch the process on our behalf. # Detailed Description of the Pull Request / Additional commentsĪfter playing with de-elevation a bit, it turns out it behaves weirdly with packaged applications. * Requires documentation to be updated - sure does, but that'll come all at the end. `elevate:false` will do nothing special. `elevate:true` will attempt to auto-elevate the profile The action will use whatever is set by the profile. `elevate:null` (_the default_) does not change the profile's elevation status. This allows a user to create an action that will elevate the profile, even if the profile is not otherwise set to auto-elevate. * the `elevate: bool?` property to `NewTerminalArgs` (`newTab`, `splitPane`) `elevate:false` basically just means 'do nothing special with me'. This includes cases where the window is elevated, and the profile is set to `elevate:false`. Otherwise, we'll just open a new tab in the existing window.

If the user is running unelevated, **and** `elevate` is set to `true`, then instead of opening a new tab, we'll open an elevated Terminal window with the profile. * the `elevate: bool` property to profiles WE determined that we didn't want to do #11308 after all, so this should be profile auto-elevation, without the warning. This is the resurrection of #8514 and #11310. We're working on designing a solution that might support this in the future, but we can't commit to anything until we're sure that we can come up with an appropriately secure solution, that ensures that a lower privileged process can't drive a higher privilege terminal. Originally, there was no plan to support this, since it wouldn't work with the single HWND we had. Okay, so this comment didn't age super well. (as a matter of linking related threads, #146) If you had an elevated commandline running in an unelevated window, an untrusted bad actor could execute an elevation-of-privilege attack by driving the unelevated windows that's running the elevated commandline. The main problem is due to the fact that any unelevated processes can send keystrokes to any other unelevated windows. Yes I know sudo is a thing, but we've had lots of discussions with the security team about the creation of a sudo for Windows. I don't think we plan on supporting mixed elevated and unelevated tabs, because it's a bit of a security hole.

Windows terminal run as administrator