how to install certificates into a StoreName of another account from administrator context using c# desktop app?

Question

I am writing a .net desktop app called installer which needs to install two certificates into store names of different account.

Here is the situation, there is a windows device with two accounts: one is administrator and the other is called app_runner. app_runner is a limited account which is just allowed to run app and disallowed to install app. So I need to run installer in the administrator context and install a CA into store name "Root" and an client identitiy certificate into store name "My" of the account "app_runner".

I have explored X509Store for a while, however I can only access administrator's store names. So I seek for help here.

Answer 1

We found a bypass: start a process => powershell => runas other account