最常用的方法是runas，例如
runas /noprofile /user:xxx-PC\administrator cmd
以管理员权限启动cmd，但是对于没有密码的账户会失败
另一种方式是利用mshta、vbscript、ie配合的方式启动程序
mshta vbscript:CreateObject("Shell.Application").ShellExecute("xxx.exe","","","runas",1)(window.close)
启动程序时会弹出UAC确认框
关于ShellExecute参数参考：
https://docs.microsoft.com/en-us/windows/win32/shell/shell-shellexecute
IShellDispatch2.ShellExecute(sFile [, vArguments] [, vDirectory] [, vOperation] [, vShow])
| sFile | Required. A String that contains the name of the file on which ShellExecute will perform the action specified by vOperation. |
|---|---|
| vArguments | Optional. A Variant that contains the parameter values for the operation. |
| vDirectory | Optional. A Variant that contains the fully qualified path of the directory that contains the file specified by sFile. If this parameter is not specified, the current working directory is used. |
| vOperation | Optional. A Variant that specifies the operation to be performed. It should be set to one of the verb strings that is supported by the file. For a discussion of verbs, see the Remarks section. If this parameter is not specified, the default operation is performed. |
| vShow | Optional. A Variant that recommends how the window that belongs to the application that performs the operation should be displayed initially. The application can ignore this recommendation. vShow can take one of the following values. If this parameter is not specified, the application uses its default value.0 Open the application with a hidden window. |
如果需要在批处理文件bat中获得管理员权限，则可以利用参数%1 和dos注释符“::”配合执行
%1 mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c %~s0 ::","","runas",1)(window.close)&&exit
REM 这里开始执行管理员指令
pause