| Windows 7: Putting limits on users' privileges... Windows UAC |
13 Jul 2010
|
#1 | | Win 7 Ultimate 64-bit. SP1. |
Putting limits on users' privileges... Windows UAC Quote: "Least privilege" is the No. 1 IT security mantra. It means, "Don't grant users permissions or privileges beyond the bare minimum they need to perform their assigned duties." Unfortunately, adhering to this mantra always has been easier said than done. Both Microsoft and third-party software vendors have attempted to ease the task, with some (but not complete) success.
For two decades in the Windows world, application developers were accustomed to users always being logged on as full-time administrators. Removing regular users from the built-in Administrators group proves among the most difficult tasks a security administrator can perform. Well, it's easy to do -- just remove the user from the Administrators group -- but the fallout from the operational aftermath has often forced well-meaning administrators to reverse course or to delay least-privilege implementations.
Microsoft upped the ante starting with Vista by implementing a least-privilege default process called User Account Control (UAC). When UAC is enabled and a user from one of 17 pre-defined elevated groups (such as Administrators, Domain Admins, Enterprise Admins), or one who has been assigned an elevated privilege (act as the operating system) logs on, Windows splits his or her single logon access token into two tokens: one standard and one elevated. By the default, the elevated user runs with the standard token most of the time, such as answering email and surfing the Web, and must be prompted to approve actions requiring the use of the elevated token. Although Microsoft (my full-time employer) would prefer that standard users never log on as elevated users while performing non-elevated tasks, UAC is seen as necessary evil. More... Putting limits on users' privileges | Security Central - InfoWorld | My System Specs |
| System Manufacturer/Model Number LAPTOP. HP Pavilion dv7-4010TX . OS Win 7 Ultimate 64-bit. SP1. CPU Intel i7 -720QM.[1.6GHz Turbo Boost 2.8GHz. 6MB Cache.] Memory 8 DDR 3 RAM. 1066MHZ Graphics Card ATI 1024 MB. DDR3. Radeon HD5650 Monitor(s) Displays 17.3" High Definition Brightview LCD. LED Backlit. Screen Resolution 1600 x 900. Mouse Logitech Anywhere mouse. MX. Case Laptop / notebook. Hard Drives 640GB Internet Speed ADSL [ but too slow ] |
14 Jul 2010
|
#2 | | |
Good Read,
The UAC is a necessary "evil" thats not so evil if one, Your running Windows 7 as it has many less UAC requests than its predecessor, Vista. Two, there's a neat little trick you can use on Programs and System Tasks that when normally asked for your approval from the UAC, is not needed. Found it on the web some time ago and use it for programs I trust that normally require UAC approval, and now don't. You set it up in all places, the "Task Scheduler".
See this tutorial made by Brink.
All-in-all, you have to agree that MS trying to better secure your PC cannot be looked at as a bad thing. In most cases the average user doesn't need to have an administrator account. Having said that, I do remember and know that while using Vista, as MS first introduced the UAC, it was a pain in the neck. Running safe games in a limited account was impossible b/c the game needed access to certain drivers that Vista categorized as needed to be ran under an admin account which was ridiculous.
But much of that has been worked out, and I think the UAC set at its default, is no bother at all. Rarely do I even see it anymore since Windows 7 does a better job and the trick using the Task Scheduler. Better Safe than Sorry is a good way of thinking about your PC, as for those who don't run regular back-ups, don't concern themselves with anti-virus, will be in for a treat when they have to do a full system recovery b/c they just couldn't be bothered by just that "one more click" from the UAC. I mean really, countless clicks are made all day long, but when a click is required that you didn't ask for is needed, you blow your top and say this is UAC is ridiculous and I don't want it.
My Goodness, just a few more clicks a day and you'd think it would give you carpel tunnel by the end of the day.
-OEM | My System Specs | | System Manufacturer/Model Number POS OS OS3.5 CPU celery Motherboard Good Question ...Unknown Memory memory never forgets Graphics Card OB Sound Card OB Monitor(s) Displays HUGE Screen Resolution 168000000x105000000 Keyboard OB Mouse mouse PSU OEM 65watt Case N/A Cooling OB Hard Drives full Internet Speed 1 Trillion MBps Other Info Still An Awesome Forum! |
15 Jul 2010
|
#3 | | Windows XP-Pro-SP3, Windows 7 Central Florida, USA |
For the home computer user who started out with their first computer ten to fifteen years ago (Windows 95 or 98) the UAC is a waking nightmare.
I remember the very first Vista PC that I was called out to install. I'd never seen UAC yet at that time. The new PC owner was watching me (trying) to set up their new computer. Every time I'd try to do anything, UAC would pop up on the screen.
The old gentleman finally said to me "am I going to have to put up with that CRAP all the time?"
That's the attitude I see for all new Vista or Win-7 users. They bought the #%$@ computer....they are the owners and only users and yet they don't have permission to access files and folders, delete files, etc. It's an understatement to say that they are VERY angry about that. I know I am too.
I know I'll get flamed for this, but when I set up any new PC for one of my home computer customers (I don't do commercial systems) I first shut off UAC with a little script I carry on my Utilities disk. Then I run the "Take Ownership" script and take ownership of all pertinent folders.
Then I shut down a gaggle of services, with another script.
And then tweak and tune Windows for more efficient use of RAM and HD.
The biggest problem I have is setting up eMail for people used to running Outlook Express.  (but that's another whole topic)
When Windows 7 is first being installed on a PC, there should be a box that could be checked for "Home Use ONLY". That could give the owner/user full permission to do what they want with 'Their' computer.
A home PC user doesn't want to be told that they have to contact their IT specialist in order to do something. That's BS!
Cheers mates! | My System Specs | | System Manufacturer/Model Number Home Made OS Windows XP-Pro-SP3, Windows 7 CPU AMD, 2X, Dual Core 5200+ Motherboard MSI K9N Platinum Memory 6 gig DDR2, Super Talent Graphics Card Winfast Sound Card On Board AC97 Monitor(s) Displays 19" Envision LCD Screen Resolution 1024x768 Keyboard Generic Mouse MS digital PSU Antec Earthwatts 650 Case Pac Man Mid-Tower Cooling 11 fans Hard Drives 3x , Maxtor/Seagate SATA2 (160, 160, 200gig) Internet Speed 5 Meg Cable |
15 Jul 2010
|
#4 | | Windows 7 Ultimate SP1 32 bit/Windows 8 64bit Pembrokeshire, South Wales, UK |
I don't see any problem with UAC, in fact I think it was a good move by Microsoft, as OEM stated it's only another click, how hard can that be.
OK yes it's my computer and it's just me using it but that doesn't mean to say that I wont try to do something stupid and try to download something that could harm my machine or not concentrate when doing something and not having UAC turned on could prove to be damaging to my machine and my pocket.
I'm pleased that Microsoft came up with this feature and are trying to protect users from their mishaps. | My System Specs | | Computer type PC/Desktop System Manufacturer/Model Number Zoostorm Desktop/ Asus K55A Notebook PC OS Windows 7 Ultimate SP1 32 bit/Windows 8 64bit CPU Intel Core 2 Duo E4600 @ 2400 MHz/Intel B820,1.7GHz Motherboard Foxconn 45CMX/45GMX/45CMX-K/Asus Memory 2048 MB (2 x 1024 DDR2-SDRAM)/8GB 2 x 4GB DDR3 Graphics Card Intel Corp 82945G Integrated Graphics Controller/Intel Sound Card Onboard Realtek/Onboard Monitor(s) Displays Hanns.G HH221 22" inches Widescreen/Asus 15.6 Screen Resolution 1920 x 1080/1366 x 768 Keyboard Microsoft Natural Ergonomic Keyboard 4000 (UK)/Inbuilt Mouse Microsoft Optical Wheel Mouse/Touchpad Hard Drives ExcelStor (250GB)/Asus Internet Speed Just under 4MB download it's ADSL. Antivirus MSE/MSE Browser IE10/IE10 Other Info Epson Stylus SX415 All-in-one Printer,
Seagate Expansion 500GB External Desktop Drive
USB2 HDD Enclosure |
16 Jul 2010
|
#5 | | Windows XP-Pro-SP3, Windows 7 Central Florida, USA |
OK, try this scenario on for size:
(forget for a minute that you're already a computer Guru )
You're 65 and getting cranky. Your ten year old PC just shot craps and you went out and spent nearly a thousand dollars on a whole new system. The high pressure salesman at Best Buy convinced you that you needed a new monitor and printer too.
So you get the new PC out of the box and all connected up and start through the half hour long installation procedure. After registering and making your own backup disks, (that's usually another hour or so) you finally get to settle down to actually running your new PC.
To see just what you've got, you open up Windows Explorer and click on "Documents and Settings" and you get a message telling you that you don't have permission to look at that. If you, the owner of the PC, doesn't have permission to look at it, who in heck does?
Arggggggggggggggg!
So this doesn't become a rant.....I rest my case!
If you like UAC and all those permissions, then by all means KEEP THEM!
For me and mine.....they're HISTORY! | My System Specs | | System Manufacturer/Model Number Home Made OS Windows XP-Pro-SP3, Windows 7 CPU AMD, 2X, Dual Core 5200+ Motherboard MSI K9N Platinum Memory 6 gig DDR2, Super Talent Graphics Card Winfast Sound Card On Board AC97 Monitor(s) Displays 19" Envision LCD Screen Resolution 1024x768 Keyboard Generic Mouse MS digital PSU Antec Earthwatts 650 Case Pac Man Mid-Tower Cooling 11 fans Hard Drives 3x , Maxtor/Seagate SATA2 (160, 160, 200gig) Internet Speed 5 Meg Cable |
16 Jul 2010
|
#6 | | Windows 7 Professional x64 |
If people hate UAC because they have to click on a button, then they're gonna hate Macs and Linux when they ask you to type in your root password. | My System Specs | | OS Windows 7 Professional x64 CPU AMD A8-3870K Motherboard ECS A75F-M2 Memory 8GB DDR3 Graphics Card Radeon HD 6550D, Radeon HD 5850 PSU 750W Hard Drives 1TB |
16 Jul 2010
|
#7 | | Windows 7 x64 Professional SP1 Geordieland, Tyne and Wear |
@DrWho
I concur with your piece/rant sir, 100%
Sometimes Windows needs to be reminded of who's the boss. Turn off that persistent mothering/nanny tool and be the boss of your own PC today! First thing i did when i install a brand new Windows 7 system too. All is well after that
And don't tell me I don't know what I am doing, because I do. All arguments for UAC in a standalone, non networked PC running only trusted apps are null and void. | My System Specs | | System Manufacturer/Model Number DELL SXPS 1640 OS Windows 7 x64 Professional SP1 CPU Intel C2D T9550 2.66 GHz @ 2.793 GHz (Thanks ThrottleStop!!) Motherboard Intel PM45 Memory 8 GB DDR3 Graphics Card ATI MOBILITY RADEON 4670 Sound Card CREATIVE XFI AUDIO NOTEBOOK Monitor(s) Displays 16.1 WLED Screen Resolution 1920x1080 Keyboard Built-in backlighted Keyboard Mouse Logitech Wireless Mini Mouse PSU 90W Dell Power Brick Case Dell Chassis Cooling Coolermaster Cooling Pad Hard Drives Seagate ST9500420AS 500GB (465GiBi) 7200 RPM Drive
External Drives:-
2 TB WD Essentials x 3
1 TB WD Mybook Gen 1
1 TB WD Mybook Gen 2
1 TB Seagate
1 TB Seagate
320 GB WD Scorpio Black (enclosed)
320 GB WD Scorpio Black (enclosed) Internet Speed 4/0.5 |
16 Jul 2010
|
#8 | | |
Yeah, gotta love how not secure Win XP was and all the complaints about that.
Yeah, screw security, it's such a pain in the arse. Why would anyone want to have a more secure system?
I mean, come on, it's my system, it's not like I am going to get hit by some drive-by download, and hey I am running Norton or McAfee, it's not like viruses target those apps anymore to shut them down and take em out.
Yeah, that nasty UAC and admin rights on all those pesky files and folders that I should be able to do what I want with.
I can't be bothered saving my info to the Documents folder or and external drive,, I have to save them to C: drive and my profile folder, cause dammit, it's my PC.
I digress,,, sarcasm is a wonderful thing ya know! | My System Specs | | System Manufacturer/Model Number Self Built OS Win 7 Ultimate 32bit CPU C2D E6600 2.4Ghz Motherboard Intel D965WH Memory 4G Kingston KHX5400D2 Graphics Card EVGA GTX 570 HD SC (012-P3-1573-KR) Sound Card On-Board Monitor(s) Displays Samsung 226BW Screen Resolution 1680 x 1050 PSU Corsair TX750W Case In-Win C589 Cooling Stock Intel Cooling Hard Drives 2 x 250 Seagate Barracuda
2 x 500 Seagate Barracuda (Raid1) |
16 Jul 2010
|
#9 | | Windows 7 Professional SP1 64-bit Virginia |
I will never turn off the UAC after a certain event that happened back in November. I was visiting a site that had quite a few ads for the first time. Suddenly the UAC thing popped up asking if I wanted a program to be able to make changes to my computer. I can't remember the name of the program, but I had never seen it before. I clicked no, closed Chrome, updated then ran MSE and it found a virus and promptly removed it. I'm not sure if MSE would have nipped it in the butt before it did what ever it was designed to do if it wasn't for the UAC stopping it. It slows me down, but it has it's place. I can't blame MS for trying and at least I don't have to put in my password constantly like in Ubuntu and Knoppix.
Not saying UAC will help even half the time, but it helping once is good enough reason for me to waste two seconds every once in a while. It's better than wasting two hours removing a virus or reinstalling Windows. | My System Specs | | System Manufacturer/Model Number Toshiba P775-S7100 OS Windows 7 Professional SP1 64-bit CPU Intel Core i5-2450M @2.5 GHz Memory 6 GB DDR3 1333MHz Graphics Card Intel HD 3000 Monitor(s) Displays Built-in 17.3" LED; 22" Insignia NS-L22Q-10A Screen Resolution 1600x900; 1360x768 Hard Drives 750 GB Hitachi
1TB Seagate FreeAgent External Internet Speed Verizon DSL Speed(Down/Up): 3360 Kbps / 800 Kbps Antivirus MSE and MBAM Pro Browser IE10 RP |
16 Jul 2010
|
#10 | | Windows 7 Ultimate x64 Norway |
Well I'm found of my system these days.
It's ultimately tweaked from annoying shit like UAC and all the other stuff you don't need.
It was such a relief for me upgrading to 7, Vista killed me with bad performance and all these security settings popping up all the time. Maybe this occurs on 7 too, but at least not on mine | My System Specs | | System Manufacturer/Model Number Self Built OS Windows 7 Ultimate x64 CPU i7-2600k@4.4GHz Motherboard MSI P67A-GD80 B3 Memory Corsair Vengeance 1600MHz 16GB Graphics Card MSI Geforce 580 Twin Frozr II @ SLI Sound Card Creative Sound Blaster Pro (USB) Monitor(s) Displays Dell Ultrasharp 27" Screen Resolution 2560x1440 Keyboard Mionix Cibal 60 Mouse CM Storm SENTINEL PSU Corsair AX 1200W Case Corsair Obsidian 800D Cooling Antec Kuhler H2O 920 & 3x Scythe Gentle Typhoon AP-15 Hard Drives Intel 510 Series 250GB SSD
Corsair Reactor Series 120GB SSD
WD Caviar Black 1TB
3x External HDD's. Internet Speed Pretty Fast Putting limits on users' privileges... Windows UAC problems? All times are GMT -5. The time now is 04:32 AM. | |