How can I run a legacy application with elevated access without giving users administrator credentials?

Use Process Monitor to identify exactly what fails when the program runs as a standard user. Legacy applications often try to write under Program Files, protected folders, or HKLM registry keys. If that is the problem, fix the application or grant narrowly scoped permissions to the specific files, folders, or registry keys rather than elevating the entire process. Be careful, since writable locations can create privilege-escalation risks.

In this case, the issue turned out not to be Windows elevation at all. Granting the users the required DB2 database permissions resolved the missing login and connection behavior. The better long-term approach is to identify the exact database permissions the application needs and grant only those, rather than giving broad operating-system administrator rights.

Endpoint privilege-management products can approve a specific executable without giving the user permanent administrator access. They can restrict the allowed application, verify its publisher or hash, and provide temporary elevation. This is safer than storing administrator credentials in a batch file or creating an unrestricted scheduled task.

A scheduled task or saved-credential shortcut may launch the program under an administrator account, but it can expose the machine if the executable, shortcut, script, or working directory is modified. It also may run in a separate session where the user cannot interact with the application. I would avoid this unless the task is tightly secured and thoroughly tested.

Those compatibility commands do not grant administrator privileges. They mainly tell Windows to launch the program without requesting elevation, so the process still has the user’s existing permissions. They can help when an application only incorrectly detects that it needs admin access, but they cannot provide privileges the user does not have.