Exactly what I said above - the shell expands the environment variable before it calls settargetroot. You need to provide a level of indirection.
use settargetroot to launch a batch file. The batch file will then have access to the TARGET_ROOT variable which will then be able to launch runscanner using the TARGET_ROOT.
To check if settargetroot worked look in the PE registry at:
Alright! Here is a new modified reply
Now my config looks like this:
I have one script that copies Runscanner.exe and Runscannerdll.dll to the system32 folder, so the command can be used anywere.
I have one script for settargetroot.exe that has this files:
The script for settargetroot launches StartRunscanner1,cmd, which looks like this:
SetTargetRoot.exe /s /w StartRunScanner2.cmd
It executes StartRunscanner2.cmd, which looks like this:
Runscanner.exe /t 0 %TARGET_ROOT%\Regedit.exe
Once Runscanner2 is running, you can actually see that the command executes CORRECTLY, the resulting line becomes:
Runscanner.exe /t 0 C:\WINDOWS\Regedit.exe
So now Settargetroot has worked, and the command point to the correct location, but what happends now?
Suprise, the same error as I got with Jaclaz idea, I get a popup saying:
"The ordinal 365 could not be located in the dynamic library COMCTL32.dll"
As I said before, I have not changed or touched this file, called COMCTL32.dll, it's from
the original installation that is 100% from Windows 7 RTM.
And thank you again, Paraglider and Jaclaz, for helping!