Why Windows 10 batch admin isn't the same as its GUI admin?

[Scott Lurndal]

Why doesn't right clicking on the batch command to select "run as admin"
work, when running the batch command in an admin window works just fine?

===== ===== ===== ===== =====
Tutorial: How to use freeopenvpn daily on Windows
(Please add improvements, e.g., how to wget the password would be nice.)

1. I assume you've already installed any decent free openvpn client.
This is the one I'd use (but I don't use their GUI).
https://openvpn.net/community-downloads/

For example, this is the most common 64-bit openvpn.exe client:
https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.3-I601-amd64.msi

2. Then download any free openvpn configuration file off the net.
You can get these free configuration files from many locations.

This is just one example that is simple & easy to explain.
https://www.freeopenvpn.org/

For example, this file changes infrequently during the year.
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn

Save this file to wherever you want to store your VPN configs.
.\USA_freeopenvpn_udp.ovpn

3. Create a freeopenvpn.txt text file for the login & daily password.
notepad.exe freeopenvpn.txt

In that file put the current login & password, each on a line.
freeopenvpn
173975185

4. Modify the downloaded config file to call that text file.
notepad.exe USA_freeopenvpn_udp.ovpn

Change this line from: auth-user-pass
Change that line to: auth-user-pass freeopenvpn.txt

5. Create a batch command to run VPN for you as administrator.
notepad.exe freeopenvpn.bat

In that file add one line to call the desired config file.
c:\path-to\openvpn\bin\openvpn.exe USA_freeopenvpn_udp.ovpn

(Please use the full path to where you installed the executable.)

6. Now you can run VPN at any time by rightclicking on the batch file

I usually run it from the command line inside an admin window:
Win+R > cmd{ctrl+shft+rtn}
C:\> .\freeopenvpn.bat

But you should be able to run it as admin via the Windows File Explorer.
{Rightclick on freeopenvpn.bat}{Select "Run as admin"}

Note that you must run openvpn.exe as admin on Windows 10.
Otherwise it won't be able to successfully modify the routing table.

You can check the routing table before and after running the command:
route print | more

7. Doublecheck that you are on VPN if you're not sure you're connected.
Win+R > cmd{Enter}
C:\> curl icanhazip.com

That should return whatever IP address you're connected as.

8. Each day you want to use VPN, check for the new password:
https://www.freeopenvpn.org/

a. Modify the password line, as needed, of the freeopenvpn.txt file.
b. Then rightclick on the batch file to get on VPN
c. Press "F4" in the resulting command window when you wish to exit.

In summary, to get on VPN, you just run the batch file as admin, and to get
off VPN, you just press F4 in the resulting command window.

Each day you have to get the latest password off the web site.
But you only need to enter that password into the text file.

Everything else stays the same day to day.

Let me know if you have ideas for improvement (e.g., to wget the password
file daily, automatically would be nice and to graphically run the batch
command as admin would also be nice).

Note: This is being sent using _that_ exact method above.

[JJ]

Post by Scott Lurndal
Why doesn't right clicking on the batch command to select "run as admin"
work, when running the batch command in an admin window works just fine?

[snip]

Define "doesn't work".

[Scott Lurndal]

Post by JJ
Define "doesn't work".

1. If I run the one-line batch command in an admin window, it works.
2. If I rightclick run as admin in a file explorer window, it fails.

I'm pretty sure it's user error in terms of the batch file syntax.
There's something I'm not understanding about how Windows works.

Everything is run from the openvpn config file directory.
Everything is being run logged in as a user (with admin privileges).

The batch freeopenvpn.bat file contains only a single line.
c:\path-to\openvpn\bin\openvpn.exe freeopenvpn.ovpn

The freeopenvpn.conf config file itself calls the login/password file.
auth-user-pass freeopenvpn.txt

The freeopenvpn.txt login/password file contains only two lines.
freeopenvpn
055254372

Where that second line, the password, changes daily at the web site.
https://www.freeopenvpn.org/index.php

And where today that 9-digit password happens to be "055254372"
https://www.freeopenvpn.org/premium.php?cntid=USA&lang=en

My simple method is these simple efficient steps.
1. I manually find the daily password (wget would be nice though)
2. In the File Explorer I doubleclick to add it to freeopenvpn.txt
3. I open an admin window & run the one line freeopenvpn.bat file

This is successful by all measures of how anyone would test VPN.
a. "curl icanhazip.com" reports the VPN connection
b. "route print|more" reports the VPN connection
c. And the command window reports a successful VPN connection

What I'd like to work is to be able to "run as admin" in the file explorer.
3. I right-click on freeopenvpn.bat & select "Run as administrator"

That flashes & then fails by all measures of how anyone would test VPN.
a. "curl icanhazip.com" reports the original (not the VPN connection)
b. "route print|more" reports the original (not the VPN connection)
c. And there is no window that reports anything after it flashes instantly

I don't know why "Run as administrator" doesn't work but it's perhaps
because I don't understand how Windows 10 batch commands work.

Is there a line or two I can add to the batch command to make it work?

[Scott Lurndal]

What it is that leads you to believe it is not working for you?

By every measure of a VPN connection, the rightclick method fails.
a. It successfully connects to VPN when I run the command in an admin window
b. It fails to connect to VPN when I rightclick "run as administrator"

Exact same one line batch file command is being run in both cases above.
freeopenvpn.bat
c:\path-to\openvpn\bin\openvpn.exe freeopenvpn.ovpn

It works here. Windows 10 version 21H1.

It fails on my version but I think I just need batch file syntax help.
C:\> ver
Microsoft Windows [Version 10.0.19042.1165]

a. When it works, I type "freeopenvpn.bat" & [Enter] in an admin window.
b. When it fails, I rightclick "freeopenvpn.bat" & run-as-administrator.

1. I log in to a non-Administrator account.
2. I right-click on a batch file and choose "Run as Administrator".

The one-line batch file I right-click on is named "freeopenvpn.bat"
It simply runs the desired command (which works in a cut and paste also).

3. At the UAC prompt, I enter the password for the Administrator
account.

For whatever reason, at my UAC prompt, I don't have to enter a password.

3. A command prompt window appears.

For whatever reason, my "command prompt" is instantaneous.
It disappears in a nanosecond so I can't tell what it's doing inside.

4. If the batch file contains the command WHOAMI then the command
prompt window displays the name of the Administrator account,
not the name of my non-Administrator account which I ran it from.
5. Task Manager 'details' tab shows the user for both conhost.exe
and cmd.exe as being the Administrator account, not my
non-Administrator account which I ran it from.

In the admin window, running the command is successful as measured by
a. "curl icanhazip.com" reports the VPN connection
b. "route print|more" reports the VPN connection
c. And the command window reports a successful VPN connection

What I'd like to work is to be able to "run as admin" in the file explorer.
3. I right-click on freeopenvpn.bat & select "Run as administrator"

That flashes & then fails by all measures of how anyone would test VPN.
a. "curl icanhazip.com" reports the original (not the VPN connection)
b. "route print|more" reports the original (not the VPN connection)
c. And there is no window that reports anything after it flashes instantly

I don't know why "Run as administrator" doesn't work but it's perhaps
because I don't understand how Windows 10 batch commands work.

Is there a line or two I can add to the batch command to make it work?

[Andy Burns]

Post by Scott Lurndal
For whatever reason, at my UAC prompt, I don't have to enter a password.

That means the user you are logged in as is an admin, generally you're
safer using a non-admin account day-to-day

[Scott Lurndal]

Post by Andy Burns

Post by Scott Lurndal
For whatever reason, at my UAC prompt, I don't have to enter a password.

That means the user you are logged in as is an admin, generally you're
safer using a non-admin account day-to-day

Thanks for explaining why I didn't have to log in as admin at the UAC box.
I think the problem is only that I need to add "something" to the bat file.
But what?

[Scott Lurndal]

Post by Scott Lurndal

Post by Andy Burns

Post by Scott Lurndal
For whatever reason, at my UAC prompt, I don't have to enter a password.

That means the user you are logged in as is an admin, generally you're
safer using a non-admin account day-to-day

Thanks for explaining why I didn't have to log in as admin at the UAC box.
I think the problem is only that I need to add "something" to the bat file.
But what?

Actually, on second thought, there must be something in between:
a. A "real" admin
b. A user with admin privileges
c. The user

I base that on the fact that if I type the command in a user cmd prompt:
c:\path-to\openvpn\bin\openvpn.exe vpnconfigfile.conf
it will fail (if I run it as the user) to set the routing table properly.

However, if I type the exact same command in an admin window, it will work.

Hence, the user (even with admin privileges) must still be only midway
toward being a "real" admin given the user (even with admin privileges)
can't successfully run the necessary route commands to get onto VPN.

[Andy Burns]

Post by Scott Lurndal
a. A "real" admin
b. A user with admin privileges
c. The user

Yes, being a member of the admin group dos not automatically mean you
are *using* all your admin rights

if you are logged in as your admin user, open a CMD window
then open another CMD window "as administrator"

look at the title of each CMD window

try out some harmless commands within each of them, e.g.

whoami /priv

arp -d *

route add

Post by Scott Lurndal
c:\path-to\openvpn\bin\openvpn.exe vpnconfigfile.conf
it will fail (if I run it as the user) to set the routing table properly.

I can't remember if openvpn calls the network APIs, or if it spawns to
the route.exe or netsh.exe commands

Post by Scott Lurndal
However, if I type the exact same command in an admin window, it will work.
Hence, the user (even with admin privileges) must still be only midway
toward being a "real" admin given the user (even with admin privileges)
can't successfully run the necessary route commands to get onto VPN.

[Herbert Kleebauer]

Post by Scott Lurndal
Exact same one line batch file command is being run in both cases above.
freeopenvpn.bat
c:\path-to\openvpn\bin\openvpn.exe freeopenvpn.ovpn
a. When it works, I type "freeopenvpn.bat" & [Enter] in an admin window.
b. When it fails, I rightclick "freeopenvpn.bat" & run-as-administrator.
For whatever reason, my "command prompt" is instantaneous.
It disappears in a nanosecond so I can't tell what it's doing inside.

Then insert a "pause" command at the end of the batch file so the
window stays open.

And don't forget, when you run the batch by a right click, there is a
different working directory as when run in a command window. Insert
a cd command at the beginning of the batch to have the same working
directory as with you command window.

[Andy Burns]

Post by Herbert Kleebauer

Post by Scott Lurndal
For whatever reason, my "command prompt" is instantaneous.
It disappears in a nanosecond so I can't tell what it's doing inside.

Then insert a "pause" command at the end of the batch file so the
window stays open.

or REM out any EXIT command in the batch file

[Scott Lurndal]

Post by Herbert Kleebauer
And don't forget, when you run the batch by a right click, there is a
different working directory as when run in a command window. Insert
a cd command at the beginning of the batch to have the same working
directory as with you command window.

SUCCESS AT LAST!
THE FULL PATH AT ALL TIMES (for the Windows FE) WAS THE PROBLEM!

a. When I ran in the command window, I didn't need to "cd"
b. But when I ran in the Windows File Explorer, I needed to "cd"
c. (or, in either case, I should have specified the full path in the ovpn).

Thank you for helping me solve the problem by identifying the error!

The full path was the problem, which was resolved in two completely
different ways (both of which worked just now in my tests!).
1. I could add the "cd" to the batch file, or,
2. I could add the full path to the login/password file in the ovpn file!

Either way worked!

A. Adding the "cd" to the batch file worked!
freeopenvpn.bat
cd C:\full-path-to\configs\
c:\path-to\openvpn.exe C:\full-path-to\configs\freeopenvpn.ovpn

B. But adding the full path to the login/password file also worked!
freeopenvpn.ovpn
auth-user-pass C:\\full-path-to\\configs\\freeopenvpn.txt

Who knew that the full path to the freeopenvpn.txt login/password file was
the problem all along? I only found that out when I added the pause to the
batch file, where that pause allowed me to finally see the error.

Post by Herbert Kleebauer
Then insert a "pause" command at the end of the batch file so the
window stays open.

Exactly as you suggested, the "pause" command helped point out the problem!

When I appended the "pause" command to the "freeopenvpn.bat" batch file:
c:\path-to\openvpn\bin\openvpn.exe C:\path-to\freeopenvpn.ovpn
pause
Which contained the openvpn config file from here:
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn
The results were
a. When run in the admin command window, VPN connected fine.
And, in fact, the pause never ran until AFTER I disconnected with F4.
b. But when I rightclicked the bat file to "Run as administrator",
After I hit "OK" to the UAC prompt, the error showed in the cmd window
Options error: --auth-user-pass fails with 'freeopenvpn.txt':
No such file or directory (errno=2)
c. I immediately realized from that error that I needed to change this
auth-user-pass freeopenvpn.txt
to this inside the freeopenvpn configuration file!
auth-user-pass C:\\full-path-to\\configs\\freeopenvpn.txt

As you had suggested, the problem was that the Windows File Explorer
needed me to "cd" to that directory, so that test you suggested also worked!

The reason that the _other_ VPN configuration file worked is simply that it
didn't make use of a login/password file (so it bypassed this "cd" problem).
https://vanwa.tech/download-free-openvpn-config

[Zaidy036]

Post by Herbert Kleebauer

Post by Scott Lurndal
Exact same one line batch file command is being run in both cases above.
   freeopenvpn.bat
   c:\path-to\openvpn\bin\openvpn.exe freeopenvpn.ovpn
a. When it works, I type "freeopenvpn.bat" & [Enter] in an admin window.
b. When it fails, I rightclick "freeopenvpn.bat" & run-as-administrator.
For whatever reason, my "command prompt" is instantaneous.
It disappears in a nanosecond so I can't tell what it's doing inside.

Then insert a "pause" command at the end of the batch file so the
window stays open.
And don't forget, when you run the batch by a right click, there is a
different working directory as when run in a command window. Insert
a cd command at the beginning of the batch to have the same working
directory as with you command window.

easier to use "CMD /K" so batch ends but leaves window open and usable

[Scott Lurndal]

Post by Zaidy036
easier to use "CMD /K" so batch ends but leaves window open and usable

Done.
Please see improvements to the tutorial for all to test, below.

Tutorial: How to use freeopenvpn on Windows 10 from the command line
(Please add improvements, e.g., how to wget the password would be nice.)
(Also how to doubleclick on the OVPN files & bypass UAC would be nice.)

1. I assume you've already installed any decent free openvpn client.
This is the one I'd use (but I don't use the GUI that most would use).
https://openvpn.net/community-downloads/

For example, this is the most common 64-bit openvpn.exe client:
https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.3-I601-amd64.msi

2. Then download any free openvpn configuration file off the net.
You can get these free configuration files from many locations.

This is just one common free example (password changes daily):
https://www.freeopenvpn.org/
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn

Here is another common free set of openvpn configuration files:
https://vanwa.tech/vpn
https://vanwa.tech/free-openvpn-service
https://vanwa.tech/download-free-openvpn-config

And others which don't even require a change of login/password:
https://www.vpngate.net/en/

For example, this file changes infrequently during the year.
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn

Save that file to wherever you want to store your VPN configs.
c:\pathto\configs\freeopenvpn.ovpn

3. Create a freeopenvpn.txt text file for the login & daily password.
notepad.exe freeopenvpn.txt

Each OpenVPN config file can authenticate differently.
Adjust what you do based on their authentication method.
For example, for freeopenvpn.org, I'd create a login/password file.

In that file I'd put the current login & password, each on a line.
freeopenvpn
173975185

Note that the freeopenvpn.org password changes frequently.

4. Then I'd modify the config file to find the login/password.
C:\> notepad.exe USA_freeopenvpn_udp.ovpn

Change this line from:
auth-user-pass
Change that line to the full path to the login/password file:
auth-user-pass c:\\pathto\\configs\\freeopenvpn.txt

5. Create a batch command to run VPN for you as administrator.
notepad.exe freeopenvpn.bat

In that file you can add one line to call the desired config file.
c:\pathto\openvpn\bin\openvpn.exe c:\pathto\configs\freeopenvpn.ovpn

If desired, add paths, variables and/or a pause in case of error.

REM freeopenvpn.bat
cd c:\pathto\configs\
c:\pathto\openvpn\bin\openvpn.exe c:\pathto\configs\freeopenvpn.ovpn
pause

Or, if you want to use variables, something like this would be ok:
REM freeopenvpn.bat
REM https://www.freeopenvpn.org/premium.php?cntid=USA&lang=en
set configdir=c:\pathto\configs\
set configcmd=c:\pathto\openvpn\bin\openvpn.exe
set configfile=freeopenvpn.ovpn
cd $configdir
%configcmd% %configdir%%configfile%
pause

6. Now you can get on that free VPN by any of a few efficient methods:

I usually run it from the command line inside an administrator window:
Win+R > cmd{ctrl+shft+rtn}
C:\> .\freeopenvpn.bat

But you can also run it as admin via the Windows File Explorer.
{Rightclick on freeopenvpn.bat}{Select "Run as administrator"}

Or, in an administrator window, you can directly run the commands:
c:\pathto\openvpn\bin\openvpn.exe c:\pathto\configs\freeopenvpn.ovpn

Note that you must run openvpn.exe as admin on Windows 10.
Otherwise it won't be able to successfully modify the routing table.

You can check the routing table before and after running the command:
route print | more

7. Doublecheck that you are on VPN if you're not sure you're connected.
Win+R > cmd{Enter}
C:\> curl icanhazip.com
That should return whatever IP address you're connected as.

You can create a command to run in the Run box if you like.
REM curlit.bat
%comspec% /k curl icanhazip.com

8. Each day you want to use VPN, check for the new password:
https://www.freeopenvpn.org/

a. Modify the password line, as needed, of the freeopenvpn.txt file.
b. Press "F4" in the resulting command window when you wish to exit.

9. Steps are similar for https://vanwa.tech and in some ways even simpler:
REM vanwa.bat
REM https://vanwa.tech/download-free-openvpn-config
set configfile=vanwa.ovpn
set configcmd=c:\pathto\openvpn\bin\openvpn.exe
set configdir=c:\pathto\configs\
cd $configdir
%configcmd% %configdir%%configfile%
pause

10. Steps are similar but with different proclivities for vpngate.net:
REM vpngate.net
set configfile=vpngate.ovpn
set configcmd=c:\pathto\openvpn\bin\openvpn.exe
set configdir=c:\pathto\configs\
cd $configdir
%configcmd% %configdir%%configfile%
pause

In summary, this tutorial provides a step by step tested sequence
that allows you efficiently to be on any one set of free public VPNs
using the Windows 10 command line or Windows 10 File Explorer.

Let me know if you have further improvements for all to benefit from
(e.g., to wget the password file daily automatically would be nice,
and it would be nice to set up Windows 10 so as to run openvpn.exe as
admin when any ovpn file is doubleclicked on in the Windows File Explorer.)

[Scott Lurndal]

Post by Scott Lurndal
Please see improvements to the tutorial for all to test, below.

I just remembered I may have skipped a step which was done years ago.

Rightclick on openvpn.exe > Properties > Compatibility >
[x]Run this program as an administrator
[Change settings for all users]
[x]Run this program as an administrator
[OK][OK]

[Scott Lurndal]

Partial success!
I figured out WHERE the problem lies (but not WHAT the problem is).

A. For whatever reason, this configuration file won't "run as admin"
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn
B. But, for whatever reason, this configuration file does "run as admin"
https://vanwa.tech/download-free-openvpn-config

That means there's likely nothing wrong with Windows after all.
The problem is (somewhere) inside the VPN configuration file.

But where?

I ran a test changing _only_ the VPN service configuration file.

That test worked in both cases (which means it's the config file!).
A. When I run the one-line batch command in an admin window, it works.
B. When I rightclick run as admin in a file explorer window, it works.

Here is how I successfully ran that test just moments ago.
1. I went to VanWa to pick up a different free openvpn config file
https://vanwa.tech/free-openvpn-service

2. I downloaded that free VPN config as "VanwaTech-Free-OpenVPN.ovpn"
https://vanwa.tech/download-free-openvpn-config

3. I created a vanwa.bat file containing the one line
C:\path-to\openvpn\bin\openvpn.exe VanwaTech-Free-OpenVPN.ovpn

This bat file connected to VPN using every method but one (which is ok).
a. It connected to VPN when I ran the bat file in an admin window
b. It connected to VPN when I pasted the command into an admin window
c. It connected to VPN when I rightclicked the bat file & "run as admin"
d. It failed to connect to VPN when I ran the bat command in a user window

That last failure is to be expected since the route commands require admin.

When I tested the results, the curl worked for all but (d) above.
C:\> curl icanhazip.com
(This outputs the VPN server connection IP address.)

This success with a different config file indicates Windows 10 is fine.
The problem is seemingly in how the VPN configuration files are configured.

A. For whatever reason, a one-line batch file containing the config file
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn
In this simple one-line command in that batch file
C:\path-to\openvpn\bin\openvpn.exe USA_freeopenvpn_udp.ovpn
won't work in the File Explorer when I rightclick "Run as Administrator"

B. But for whatever reason, a one-line batch file containing the config file
https://vanwa.tech/download-free-openvpn-config
In this simple one-line command in that batch file
C:\path-to\openvpn\bin\openvpn.exe VanwaTech-Free-OpenVPN.ovpn
does work in the File Explorer when I rightclick "Run as Administrator"

This indicates the problem isn't Windows 10 after all.
This indicates the problem is (somehow) in how a VPN config file is written.

Does anyone here know VPN well enough to tell us why that's the case?

[Andy Burns]

Post by Scott Lurndal
Partial success!
A. For whatever reason, this configuration file won't "run as admin"
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn
B. But, for whatever reason, this configuration file does "run as admin"
https://vanwa.tech/download-free-openvpn-config

I'm surprised windows follows the .ovpn file association to even do that

I'd "run as admin" a .cmd batch file that calls openvpn.exe with the
.ovpn file as a parameter?

[Scott Lurndal]

Post by Andy Burns
I'd "run as admin" a .cmd batch file that calls openvpn.exe with the
.ovpn file as a parameter?

While setting up the file association of *.ovpn to run the OpenVPN GUI is
likely what most people do, I can't doubleclick on the ovpn file because
that would run it as the user, who doesn't have the necessary permissions to
change the routing table. (Somehow, the OpenVPN GUI gets around that Windows
10 restriction, which didn't exist in Windows 7, by the way, AFAIR.)

But now, thanks to Herbert Kleebauer, the problem is forever resolved.

What I didn't realize was that the command window assumes different paths
than does the Windows File Explorer. Once Herbert Kleebauer explained the
Windows File Explorer works differently from the command line, the pieces
fell into place almost instantly thereafter...

1. In an administrator command window, I paste these commands to start VPN
REM freeopenvpn.bat
cd C:\pathto\configs\
c:\pathto\openvpn\bin\openvpn.exe C:\pathto\configs\freeopenvpn.ovpn

2. Or, in an administrator window, I run _that_ set as a single batch file
C:\pathto\configs\freeopenvpn.bat

3. Or, in the Windows File Explorer, I right click to run as administrator
{Rightclick on freeopenvpn.bat}{Run as administrator}

Post by Andy Burns
I'm surprised windows follows the .ovpn file association to even do that

I think most people who install the openvpn GUI use its GUI to get on VPN.
https://openvpn.net/community-downloads/

But the only thing I use in the openvpn package is the client itself.
https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.3-I601-amd64.msi

I believe the Windows OpenVPN GUI has some magic to get around the fact the
Windows 10 routing table has to be managed as administrator (but I don't use
the OpenVPN GUI so I don't know how it tricks Windows into thinking its an
admin when it's being run as the user).

[Andy Burns]

Post by Scott Lurndal
I believe the Windows OpenVPN GUI has some magic to get around the fact the
Windows 10 routing table has to be managed as administrator (but I don't use
the OpenVPN GUI so I don't know how it tricks Windows into thinking its an
admin when it's being run as the user).

It's been a while since I used openVPN, and I used to mainly use the
GUI, the trick to running it automatically "as admin" involved running
it as a triggered task scheduler job, based on the "user logged in" event.

[Scott Lurndal]

Post by Andy Burns
I'm surprised windows follows the .ovpn file association to even do that

To better help others...

And to Andy's point that we "could" also use a different ovpn-association
use model, below is documentred a _different_ tutorial, showing how to open
any number of free openvpn config files previously downloaded off the
Internet and then to select a score of them to doubleclick on them en masse,
where only the first working one will connect you to an openvpn server (the
rest drop off).

It's an efficient use model when you simply want to randomly change your IP
address, for example.

Here's how to set that up if anyone is interested in that use model.
a. Clicking on *.ovpn files opens them in the OpenVPN Daemon.
b. Turn off the UAC nag screen that pops up every time an *ovpn is opened.
c. Set OpenVPN Daemon running-log files to open up in the same spot.
d. Add a 32-bit registry DWORD to open more than 15 files at a time.

A. Set the Windows 10 file association for *.ovpn to open in the daemon
Right click on any *.ovpn text configuration file in Windows 10
Select "Open with" and then "Choose another app".
Click the [x] checkbox for "Always use this app to open *.ovpn files".
Change from: *.ovpn starts with the OpenVPN GUI (openvpnserv.exe)
Change to: *.ovpn starts with the OpenVPN Daemon (openvpn.exe)

B. Set the executable permissions for OpenVPN/bin/*.exe
Rightclick on openvpn.exe > Properties > Compatibility >
[x]Run this program as an administrator
[Change settings for all users]
[x]Run this program as an administrator
[OK][OK]

C. Set OpenVPN Daemon running logs to open up in the same spot!
Doubleclick on an *.ovpn file to open up the OpenVPN Daemon log
Right click in the top bar of that running log file
Select "Properties" & go to the "Layout" tab
Position the window as you want all of the windows to appear
Uncheck the checkbox for "[ ]Let system position window"
Press OK

Be careful if that spot is a second screen as you won't be able
to see open VPN windows when/if you disconnect that second screen.

D. Add a Windows 10 32-bit DWORD to open more than 15 files at a time.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
Name : MultipleInvokePromptMinimum
Type : DWORD
Default : 15 (decimal)
Change to: 200 (decimal)

In summary, another use model is to download many openvpn free configuration
files from the Internet, to select a few at a time, to randomly connect to
the first that works using this sequence after the setup performed above:
1. Download the openvpn config files
2. Rightclick select a handful of openvpn config files in Windows FE
3. Hit "Open" from the Windows File Explorer pop-up menu.

Any openvpn config files that work after the first will just die, and any
files that fail will remain in a hung window. Close the hung windows by
clicking on the [x] box, all of which are lined up for efficiency.

To gracefully close the one working window, press "F4" in that window.
HTH (and, as always, please improve so all benefit from your suggestions.)

[Scott Lurndal]

Post by Scott Lurndal
Why doesn't right clicking on the batch command to select "run as admin"
work, when running the batch command in an admin window works just fine?

It works here. Windows 10 version 21H1.
1. I log in to a non-Administrator account.
2. I right-click on a batch file and choose "Run as Administrator".
3. At the UAC prompt, I enter the password for the Administrator
account.
3. A command prompt window appears.
4. If the batch file contains the command WHOAMI then the command
prompt window displays the name of the Administrator account,
not the name of my non-Administrator account which I ran it from.
5. Task Manager 'details' tab shows the user for both conhost.exe
and cmd.exe as being the Administrator account, not my
non-Administrator account which I ran it from.
What it is that leads you to believe it is not working for you?

An example of a command and .bat file might be
whoami /user /priv
pause
This will show differences between an elevated attempt and
one which is not elevated.

That confirms it is elevated when I right-click on a batch file
and choose "Run as Administrator". The same as when I run the batch
command in an 'Administrator' Command Prompt window.
I also confirmed it is elevated by having the batch run a command
('openfiles') which requires elevation, and checking %ERRORLEVEL%.
So the OP's problem does not look to be related to elevation.

The problem was that I didn't realize that the Windows File Explorer uses a
completely different path than does the elevated Windows command line.

Thanks for testing elevation permissions on the one-line batch file:
REM freeopenvpn.bat
c:\path-to\openvpn.exe C:\full-path-to\configs\freeopenvpn.ovpn

That command above worked when run inside an administrator command window.
But it had failed when right clicked to "Run as administrator" in the FE.

The problem turned out to be exactly what Herbert Kleebauer suggested I test
by adding a trailing "pause" to the one-line batch file as shown below.

REM freeopenvpn.bat
c:\path-to\openvpn.exe C:\full-path-to\configs\freeopenvpn.ovpn
pause

That pause allowed the OpenVPN error message to show up, which was:
Options error: --auth-user-pass fails with 'freeopenvpn.txt':
No such file or directory (errno=2)

Herbert Kleebauer was right that the problem was Windows File Explorer used
a different set of paths than did the Windows administrator command window.

I needed to force Windows File Explorer to "see" the full path to the
"freeopenvpn.txt" login/password file (which is a different use model than
the freeopenvpn.org web site espouses, so I was breaking the ovpn file).
https://www.freeopenvpn.org/premium.php?cntid=USA&lang=en

I first tried modifying freeopenvpn.ovpn with only single backslashes:
auth-user-pass C:\full-path-to\configs\freeopenvpn.txt

But that gave a readable error that I should use double backslashes:
auth-user-pass C:\\full-path-to\\configs\\freeopenvpn.txt

As a separate solution, adding the "cd" to the batch file also worked:

REM freeopenvpn.bat
cd c:\full-path-to\configs\
c:\path-to\openvpn.exe C:\full-path-to\configs\freeopenvpn.ovpn
pause

Now no matter what I do, the openvpn.bat works correctly when elevated.

A. In File Explorer, I right click freeopenvpn.bat & run as administrator
B. In an administrator command windows I run "freeopenvpn.bat"
C. In an administrator command window I cut and paste the full command
c:\path-to\openvpn.exe C:\full-path-to\configs\freeopenvpn.ovpn

The first problem was that I wasn't using the freeopenvpn.ovpn file the way
the freeopenvpn.org web site had assumed I would (where you type in the
login and password manually when prompted - which I am doing automatically).

The second problem was that I couldn't get the error message out of the
Windows File Explorer method, which the added "pause" allowed me to see.

The third problem (and the only real problem) was that I didn't realize that
the elevated Windows command line used a different path than the Windows
File Explorer elevated action.

Once I realized that the openvpn.exe client didn't know the full path to the
login/password file in the Windows File Explorer (thanks to Herbert's
suggestions), the only minor remaining problem was figuring out that batch &
ovpn syntax to specify a full path to the "freeopenvpn.txt" freeopenvpn.org
daily login/password file.

Now it's all automatic with a simple right click run-as-admin in Windows FE!

[Brian Gregory]

Post by Scott Lurndal
Why doesn't right clicking on the batch command to select "run as admin"
work, when running the batch command in an admin window works just fine?
...

I think right clicking and running as administrator tends to change the
current directory to your user directory. Could that be the problem?

[Scott Lurndal]

Post by Brian Gregory
I think right clicking and running as administrator tends to change the
current directory to your user directory. Could that be the problem?

Yes. The problem was explained first by Herbert Kleebauer.

So that everyone always benefits, here is the latest tutorial update, with many improvements using Windows tricks.

Tutorial: How to _efficiently_ set up free openvpn on Windows 10

Note this is not the default documented openvpn GUI installation setup method. If you want to use the default openvpn GUI, follow instructions at the site you obtained the OpenVPN client software.

This is how I set up openvpn to work efficiently with _many_ ovpn files.

1. Download and install a free open source Windows "openvpn" client.
This is the one I'd use: https://openvpn.net/community-downloads/
https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.3-I601-amd64.msi

Note the default use model is the OpenVPN client GUI.
I use the OpenVPN client executable instead, for more direct control.

After installation, I change a few things to garner more control:
a. I change the *.ovpn file association from the GUI to the client.
b. I set permissions for OpenVPN/bin/*.exe to run as administrator.
c. I add a 32-bit registry DWORD to open more than 15 files.
d. I set OpenVPN Daemon to open logs in the same spot.
e. Optionally, I bypass the UAC nag screen (or change the sound).

A. Set the Windows 10 file association for *.ovpn to open in the daemon
Right click on any *.ovpn file in the Windows 10 File Explorer.
Select "Open with" and then "Choose another app".
Select [x] Always use this app to open *.ovpn files
Change from: *.ovpn starts with the OpenVPN GUI (openvpnserv.exe)
Change to: *.ovpn starts with the OpenVPN Daemon (openvpn.exe)

B. Set the executable permissions for OpenVPN/bin/*.exe to run as admin.
Rightclick on openvpn.exe > Properties > Compatibility >
[x]Run this program as an administrator
[Change settings for all users]
[x]Run this program as an administrator
[OK][OK]

C. Add a Windows 10 32-bit DWORD to open more than 15 files at a time.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
Name : MultipleInvokePromptMinimum
Type : DWORD
Default : 15 (decimal)
Change to: 200 (decimal)

D. Set OpenVPN Daemon running logs to open up in the same spot!
Doubleclick on an *.ovpn file to open up the OpenVPN Daemon log
Right click in the top bar of that running log file
Select "Properties" & go to the "Layout" tab
Position the window as you want all of the windows to appear
Uncheck the checkbox for "[ ]Let system position window"
Press OK

Be careful if that spot is a second screen as you won't be able
to see open VPN windows when/if you disconnect that second screen.

E. Optionally bypass UAC which otherwise pop up when an *ovpn is run
by adding a shortcut that calls the task scheduler which calls the
executable "with highest privileges".

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vpnopen.exe
This allows "Win+R > vpnopen" to work.

C:\pathto\link\vpnopen.lnk
TARGET=C:\Windows\System32\schtasks.exe /run /TN "task:vpnopen"
STARTIN=%windir%\system32
COMMENT=taskschd.msc > Task Scheduler Library > task:vpnopen>
General > [x]Run with highest privileges
Actions > Start a program > Program/script > %comspec%
Add arguments > /c start "" c:\pathto\openvpn.exe c:\pathto\configs\openvpn.ovpn

Optionally, if you keep UAC, you could change the sound (if desired):
From: C:\Windows\Media\Windows User Account Control.wav
To: C:\Windows\Media\ding.wav
Control Panel -> Hardware and Sound -> Sound -> Change system sounds
Sounds -> Windows User Account Control ->
Browse -> C:\Windows\Media\ding.wav -> Test -> Apply -> OK

2. Download any number of free openvpn configuration files off the net.
You can get these free configuration files from many locations.

This is just one common free example (password changes daily):
https://www.freeopenvpn.org/
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn
(other countries and protocols exist at that web site)

Here is another common free set of openvpn configuration files
(where the login/password credentials are embedded in the file):
https://vanwa.tech/vpn
https://vanwa.tech/free-openvpn-service
https://vanwa.tech/download-free-openvpn-config

And many others (many don't even require a change of login/password):
https://www.vpngate.net/en/

For our example, we'll use this particular free openvpn config file:
https://www.freeopenvpn.org/ovpn/USA_freeopenvpn_udp.ovpn

Save that file to wherever you want to store your VPN configs.
c:\pathto\configs\freeopenvpn.ovpn

3. Create a freeopenvpn.txt text file for the login & daily password.
notepad.exe freeopenvpn.txt

Each OpenVPN config file can authenticate differently.
Adjust each approach based on the specific authentication method.
For example, for freeopenvpn.org, I'd create a login/password file.

In that file I'd put the current login & password, each on a line.
freeopenvpn
173975185

Note that the freeopenvpn.org password changes frequently where
you will need to update that password file when it changes.

4. Then I'd modify the config file to find that login/password file:
C:\> notepad.exe USA_freeopenvpn_udp.ovpn

Change this line from:
auth-user-pass
Change that line to the full path to the login/password file:
auth-user-pass c:\\pathto\\configs\\freeopenvpn.txt

5. Create a batch command to run VPN for you as administrator.
notepad.exe freeopenvpn.bat

In that file you can add one line to call the desired config file.
c:\pathto\openvpn\bin\openvpn.exe c:\pathto\configs\freeopenvpn.ovpn

If desired, add paths, variables and/or a pause in case of error.

REM freeopenvpn.bat
cd c:\pathto\configs\
c:\pathto\openvpn\bin\openvpn.exe c:\pathto\configs\freeopenvpn.ovpn
pause

Or, if you want to use variables, something like this would be ok:
REM freeopenvpn.bat
REM https://www.freeopenvpn.org/premium.php?cntid=USA&lang=en
set configdir=c:\pathto\configs\
set configcmd=c:\pathto\openvpn\bin\openvpn.exe
set configfile=freeopenvpn.ovpn
cd $configdir
%configcmd% %configdir%%configfile%
pause

6. Now you can get on that free VPN by any of a few efficient methods:

I usually run it at the command line inside an administrator window:
Win+R > cmd{ctrl+shft+rtn}
C:\> .\freeopenvpn.bat

But you can also run it as admin via the Windows File Explorer.
{Rightclick on freeopenvpn.bat}{Select "Run as administrator"}

Or, in an administrator window, you can directly run the commands:
c:\pathto\openvpn\bin\openvpn.exe c:\pathto\configs\freeopenvpn.ovpn

Or, you can just doubleclick on the freeopenvpn.config file if you've
set up the "ovpn" file associations to run the openvpn client daemon
(openvpn.exe) instead of the openvpn client GUI (abc).

Note that you must run openvpn.exe as admin on Windows 10.
Otherwise it won't be able to successfully modify the routing table.

You can check the routing table before and after running the command:
route print | more

7. Doublecheck that you are on VPN if you're not sure you're connected.
Win+R > cmd{Enter}
C:\> curl icanhazip.com
That should return whatever IP address you're connected as.

You can create a command to run in the Run box if you like.
REM curlit.bat
%comspec% /k curl icanhazip.com

8. Each day you want to use VPN, check for the new password:
https://www.freeopenvpn.org/

a. Modify the password line, as needed, of the freeopenvpn.txt file.
b. Press "F4" in the resulting command window when you wish to exit.

9. The steps are similar for vanwa.tech (but even simpler):
REM vanwa.bat
REM https://vanwa.tech/download-free-openvpn-config
set configfile=vanwa.ovpn
set configcmd=c:\pathto\openvpn\bin\openvpn.exe
set configdir=c:\pathto\configs\
cd $configdir
%configcmd% %configdir%%configfile%
pause

10. Steps are similar (but with different proclivities) for vpngate.net:
REM vpngate.net
set configfile=vpngate.ovpn
set configcmd=c:\pathto\openvpn\bin\openvpn.exe
set configdir=c:\pathto\configs\
cd $configdir
%configcmd% %configdir%%configfile%
pause

In summary, there are many freely available openvpn configuration files
on the net, all of which work with the FOSS openvpn client. Each works
slightly differently though in what they require for authentication.

And that is what we're dealing with here, in addition to being
able to run any number of these files at will.

As always, please improve.
(for example if you know of other free openvpn config file repos)