Nirth: Yes but you can always keep the original file name, verify it and then after it's valid, you rename it to something else to break through the admin requirements.
I lost you there. My reply is about why renaming a file clears its compatibility flags.
So, let's take Reus for example.
Reus.exe is set up by the installer to be run elevated. That flag has to be set somewhere. If the flag is set on Reus.exe, that executable will be different from one without the flag, simply due to the extra flag. Reus.exe may not give a damn if it's modified or not, but if support asks you for the MD5 hash of Reus.exe along with its last modification date, that could lead to problems.
Thus the flags are set in the registry, not on the file itself. The hash of a file remains intact, and it's the same no matter the filename. The registry check though is simple a location\filename check, and it doesn't care about the rest of the file. If you copy cmd.exe to a file that has compatibility flags set, (again, for example Reus.exe), the cmd will be run with those flags.
P.S. There are some executables that have the elevated privileges requirement coded into them, such as the GOG installers and a few more. I'm not sure what triggers that requirement though, or when it was introduced.