ok, i re-read your great post again - and realized that we may need more than just simple exe path substitution here .... like you said, if you have a commmand like like this:

<server1>\kix32.exe <server2>\script.kix

you would want to be able to override <server1> and <server2> (not just the executable path) ... can think of two options ...

1) Encode the command line using custom %environment% variables, then (kinda like SU used to do) you set the variables at runtime ...

SET "path1=\\whatever"
SET "path2=\\whatever"

SHELL "runnas file.tok"

2) You encode the command line using (like you said) special "tokens", like this:

runnas "<path1>\kix32.exe <path2>\myscript"

then, at runtime, fill-in the tokens with command-line switches:

runnas file.tok /path1:\\whatever /path2:\\whatever