NSIS - How to inherit admin level to ExecShell when RequestExecutionLevel admin is not enough?

in NSIS I want to execute a cmd/batch file that creates a desktop shortcut just for the local user that has no admin rights.

The problem is, that the main cmd command (query.exe) is just working, if the cmd is run as admin, and that in NSIS despite RequestExecutionLevel admin the ExecShell does not inherit enough privileges, because I get the error message that "query cannot be found". This occurs if cmd is run without admin rights.

Does anybody know what am I doing wrong when executing the cmd file? Or does anybody know a better way than cmd files for creating a shortcut for the user's desktop?

Thanks for your help in advance.

Here's the cmd file:

for /f "tokens=1 delims=> " %%a in ('query user ^| findstr /C:"console"') do SET USERNAME=%%a
mklink "C:\users\%USERNAME%\Desktop\7Zip Filemanager" "%programfiles%\7-zip\7zFM.exe"

And here's my NSIS file:

;------------------------------------
; Creates desktop shortcuts for the local user instead
; for that user that runs this installer (admin).
; ($DESKTOP references to the user that runs this installer)
;------------------------------------

;------------------------------------
;Includes
!include "MUI.nsh"
!include "LogicLib.nsh"

!define MUI_ABORTWARNING # This will warn the user if he exits from the installer.

;------------------------------------
;Pages of installer
!insertmacro MUI_PAGE_WELCOME # Welcome to the installer page.
!insertmacro MUI_PAGE_INSTFILES # Installing page.
!insertmacro MUI_PAGE_FINISH # Finished installation page.

;------------------------------------
;CRC check
CRCCheck On

;------------------------------------
;Language
!insertmacro MUI_LANGUAGE "English"

;------------------------------------
;Execution level
RequestExecutionLevel admin

;------------------------------------
;Check string length
!define STRING_LENGTH ${NSIS_MAX_STRLEN}

;------------------------------------
;Define the source files for the installer
!define MUI_PRODUCT "SHORTCUTS TEST" #Name of application
!define MUI_FILE_SHORTCUTS_CMD "shortcuts.cmd" #Source of further installation files

!define CMD_SHORTCUTS "$INSTDIR\${MUI_FILE_SHORTCUTS_CMD}"

;------------------------------------
;Define the destinations
Name "${MUI_PRODUCT}" # Name of the installer (usually the name of the application to install).
OutFile "${MUI_PRODUCT} Installer.exe" # Name of the installer's file.
InstallDir "C:\Test\${MUI_PRODUCT}" # Default installing folder ($PROGRAMFILES is Program Files folder).
ShowInstDetails show # This will always show the installation details.

;------------------------------------
;Installer section
Section "Install"

    ;Create directories:
    CreateDirectory $INSTDIR

    ;Add files
    SetOutPath $INSTDIR
    File "${MUI_FILE_SHORTCUTS_CMD}" #Move file

    ;Create shortcuts at user desktop:
    ;(cmd file needs to be run as administrator,
    ; otherwise the shortcut is created in the wrong desktop.)
    ExecShell "open" '${CMD_SHORTCUTS}' ${SW_SHOW}

SectionEnd

;eof

Solution

I don't think query.exe exists on every version of Windows, probably only on Windows Server and Pro SKUs. Even if it did exist everywhere it would be the wrong thing to do, the user can change the path and/or name of the desktop folder, it might not even be in the profile directory.

It is not 1995 anymore, if you are installing to %ProgramFiles% and writing to HKEY_LOCAL_MACHINE then you are doing a machine/"all users" install and you should use SetShellVarContext All so that $Desktop resolves to the shared desktop folder.

mklink creates a symlink but most installers should create a .lnk shortcut and you can do that in NSIS with CreateShortcut.

The Windows logo guidelines say you should only create a single shortcut in the start menu folder and nothing on the desktop!