I believe that runas
always launches programs with their working directory set to C:\Windows\System32
(or moral equivalent) rather than whatever your current working directory is when you invoke runas
.
If User1
has permissions to write to that directory, that's where the file will be. If they don't have such a permission, then the program will fail.