The Windows NT scheduler uses the drive mapping of the interactive user who is currently logged onto the system, which allows the local user to gain privileges by providing a Trojan horse batch file in place of the original batch file.
From 神龙GPT (AIGC)
Windows NT 调度程序使用了当前登录系统的交互式用户的路径映射，这使本地用户可以通过提供一个恶意的批处理文件替换原始批处理文件来获得权限。