GUID Guid;
    CLSID rclsid;
    IID  riid;
    CoInitialize(0);
    HRESULT hr1=CLSIDFromProgID(L"WScript.Shell.1",&rclsid);
    HINSTANCE hdllInst =LoadLibrary("wshom.ocx");
    typedef HRESULT (__stdcall * pfnGCO) (REFCLSID, REFIID, void**);   
    pfnGCO fnGCO = NULL;  
    fnGCO = (pfnGCO)GetProcAddress(hdllInst, "DllGetClassObject");
    IClassFactory* pcf = NULL;  
    HRESULT hr=(fnGCO)(rclsid, IID_IClassFactory, (void**)&pcf); //创建工厂  
    LPVOID pvObject;
    IIDFromString(L"{F935DC21-1CF0-11D0-ADB9-00C04FD58A0B}",&riid);
//        LPCTSR2GUID("F935DC21-1CF0-11D0-ADB9-00C04FD58A0B",riid);
    pcf->CreateInstance(0,riid,&pvObject);
    CoCreateInstanceAsAdmin(NULL,rclsid,riid,&pvObject);

const wchar_t MONIKER_NAME[] = L"Elevation:Administrator!new:%s";
HRESULT CoCreateInstanceAsAdmin(HWND hwnd, REFCLSID rclsid, REFIID riid, void **ppv)
{
        BIND_OPTS3 bo;
        wchar_t wszCLSID[50];
        wchar_t wszMonikerName[300];
       
        StringFromGUID2(rclsid, wszCLSID, sizeof(wszCLSID));
        HRESULT hr = wsprintfW(wszMonikerName,  MONIKER_NAME, wszCLSID);
        if (FAILED(hr))
                return hr;
        memset(&bo, 0, sizeof(bo));
        bo.cbStruct = sizeof(bo);
        bo.hwnd = hwnd;
        bo.dwClassContext = CLSCTX_LOCAL_SERVER;
        if (IsRunningInWin64())
                bo.dwClassContext |= CLSCTX_ACTIVATE_32_BIT_SERVER;
        return CoGetObject(wszMonikerName, &bo, riid, ppv);
｝
还是不能提权，CoGetObject 返回80080017

0x80080017
CO_E_ELEVATION_DISABLED
The class is not configured to support elevated activation.