Privexec

baulk install wsudo
wsudo --version

{
    "alias": [
        {
            "description": "Edit Hosts",
            "name": "edit-hosts",
            "target": "Notepad %windir%\\System32\\Drivers\\etc\\hosts"
        },
        {
            "description": "Windows Debugger",
            "name": "windbg",
            "target": "\"%ProgramFiles(x86)%\\Windows Kits\\10\\Debuggers\\x64\\windbg.exe\""
        }
    ]
}

wsudo 💖 5.0 run the program with the specified permissions
usage: wsudo command args...
   -v|--version        print version and exit
   -h|--help           print help information and exit
   -V|--verbose        Make the operation more talkative
   -c|--cwd            Use a working directory to launch the process.
   -e|--env            Use specific environment variables to start child processes.
   -n|--nui            Starts a separate window to run a specified program or command.
   -H|--hide           Hide child process window. not wait. (CREATE_NO_WINDOW)
   -w|--wait           Start application and wait for it to terminate.
   -u|--user           run as user (optional), support '-uX', '-u X', '--user=X', '--user X'
                       Supported user categories (Ignore case):
                       AppContainer  MIC            Basic
                       Standard      Administrator  System
                       TrustedInstaller

   -x|--appx           AppContainer AppManifest file path
   -L|--lpac           Less Privileged AppContainer mode.
   --disable-alias     Disable Privexec alias, By default, if Privexec exists alias, use it.
   --appid             Set AppContainer ID name (compatible --appname)

Select user can use the following flags:
   -a|--appcontainer   AppContainer
   -M|--mic            Mandatory Integrity Control
   -B|--basic          Basic execution, permission inheritance mode (default)
   -U|--standard       Standard user no elevated (UAC)
   -A|--administrator  Administrator
   -S|--system         System
   -T|--ti             TrustedInstaller

Example:
   wsudo -A pwsh -NoProfile
   wsudo -T cmd
   wsudo -U -V -eCURL_SSL_BACKEND=schannel curl --verbose  -I https://nghttp2.org
   wsudo -U -V CURL_SSL_BACKEND=schannel curl --verbose  -I https://nghttp2.org

Builtin 'alias' command:
   wsudo alias add ehs "notepad %SYSTEMROOT%/System32/drivers/etc/hosts" "Edit Hosts"
   wsudo alias delete ehs

::curl must enabled multiple SSL backends.
wsudo  -U -V --env CURL_SSL_BACKEND=schannel curl --verbose  -I https://nghttp2.org

# powershell
.\bin\wsudo.exe -n -e 'PATH=%PATH%;%TEMP%' -U cmd

::cmd
wsudo -e "PATH=%PATH%;%TEMP%" -n -U cmd