What does '__COMPAT_LAYER' actually do?

Question

Recently, i was trying to give my application administrator rights without system asking for "Do you want to give administrator rights?" and i found a way which is working perfectly.

Solution I Found

I created a bat file named nonadmin.bat and wrote the below code in it

cmd min C set __COMPAT_LAYER=RunAsInvoker && start  %1

and if we drag any exe on it, it gives them administrator rights (before it was not letting me access environment variables without it but after draging the file on bat it did work).

Question

Now my question is:-

1. What actually '__COMPAT_LAYER' means and what does it do?
2. How do i remove such a thing so that it asks for administrator rights again?
3. Does this reduce system security?

Answer 1

__COMPAT_LAYER, and How To Use It
__COMPAT_LAYER is a system environment variable that allows you to set compatibility layers, which are the settings you can adjust when you right-click on an executable, select Properties, and go to the Compatibility tab.

There are several options to choose from in addition to the one you know about:

• 256Color - Runs in 256 colors
• 640x480 - Runs in 640x480 screen resolution
• DisableThemes - Disables Visual Themes
• Win95 - Runs the program in compatibility mode for Windows 95
• Win98 - Runs the program in compatibility mode for Windows 98/ME
• Win2000 - Runs the program in compatibility mode for Windows 2000
• NT4SP5 - Runs the program in compatibility mode for Windows NT 4.0 SP5

You can use multiple options by separating them with a space: set __COMPAT_LAYER=Win98 640x480

Unsetting the __COMPAT_LAYER Variable
These settings persist for as long as the variable exists. The variable stops existing when either the command prompt in which the variable was set is closed, or when the variable is manually unset with the command set __COMPAT_LAYER=.

Since you are setting the variable via batch script, the variable is automatically unset once the executable you drag onto it completes and the script closes. It is important to note that the variable settings persist to any child processes that are spawned by the executable you select.

The Security of Using __COMPAT_LAYER
Setting __COMPAT_LAYER to RunAsInvoker does not actually give you administrator privileges if you do not have them; it simply prevents the UAC pop-up from appearing and then runs the program as whatever user called it. As such, it is safe to use this since you are not magically obtaining admin rights.

You can also set the variable to RunAsHighest (only triggers UAC if you have admin rights, but also does not grant admin rights if you do not have them) or RunAsAdmin (always triggers UAC).