|15 Feb 2010||#11|
Though I would still like to disable UAC for my user account (administrator account) and leave it enabled on the standard user accounts (my mother and my girlfriend). It seems this can't be done, so I suppose I'm going to stick with my current settings.
If they don't have your password and they don't use any tasks/programs which need Administrator privileges, then they don't really benefit from UAC at all.
In this case benefit from UAC is only for you.
before anybody starts to say something about last statement, let me explain UAC basics..
UAC (User Account Control) is just feature that controls user privilege tokens (what user can do).
Situation when is UAC on:
1. You log in with your Administrator account.
While logging in UAC gives you 2 user tokens (one administrative and one standard user) and makes standard user privilege as main token.
You see this (UAC) was one of the cleverest things Microsoft came up for Windows security.
The problem with windows is that almost EVERYBODY runs it as administarator (any other OS takes away that privilege from user)
Microsoft tried to encourage it's users to use Standard account, but there were only handful people who did. (and funny thing is that those people who haven't even considered Microsoft's advice, blamed the company for not doing anything for Windows security )
So, Microsoft had to came up with something new and take away administrative privileges from average users. They created UAC.
If you remember I said that when you logged in with administrator account UAC gave you standard user privilege token as your main.
So basically, even if you are logged in with administrator account, you are using it as if you were standard user and have it's privileges.
And according to privilege inheritation, any process inheritates privileges of parent process, so everything you open will run as standard user.
But theoretically there will be problem when you try to do something which requires administrative privileges.
There comes UAC again when you try to do something that requires Administrative privileges UAC will come up and after getting confirmation from you (the user who has admin privileges), gives Administrative privilege token to that process.
So as you can see, from security point of view UAC was genius thing. It made administrator account into standard account and this way blocked lots of security flaws.
But UAC isn't perfect and Microsoft still encourages and wants average users to run as standard users.
But the probem is that many users don't want log off and log in to administrator account to do anything that requires administrative privileges.
So they creates fast switch, but even then people were lazy to do this.
2. So after this they implemented UAC into standard user aswell.
It works the same way as it does in Administor account.
But in this case it doesn't give you 2 tokens at the start as you don't have (you have only standard user privileges)
So you will work as standard user and if you need something that requires administrative privileges, It asks from users who has it (administrators). After confirmation from administrator (after you writing admin password) it "borrows" this admin privileges from that user and does that specific task from the name of the administrator who was confirmed with password.
So now, Standart user dosen't even need to log off to do administrative tasks...
now, back to your topic.
1. If you family members don't use anything that requires administrative privilegs, or even when they want they can't use it (as they don't your password or any other admin password).
If this is your situation, as I already mentioned they don't benifit from UAC.
Why? because UAC for standard user is just to give Standard user to give fast way to get ("borrow") administrative privileges.
If you turn off UAC. They will be automatically denied from task that require admin privileges (task which will be asked by UAC if it was on)
So, from this point of view you can turn off UAC.
But then you (Administrator) will have administrator privileges token always!
So, just read through how UAC works again, and decide if it's worth it...
But if your family members know your password and do tasks which require admin privilegs then you can't turn off UAC. (if your turn offf it they will have to switch user/log off and log in with admin account to do those tasks.)
Hope it will help you!
This is the right solution for your second problem
|My System Specs|
|15 Feb 2010||#12|
Some things that I didn't mention, and/or forgot about.
That and I didn't grasp that you had them setup as a standard user,, that was my fault and I apologize.
If they are setup with an Admin account, and not a standard user account,,
when you turn off UAC, you are effectively an admin, not a standard user.
You are only a standard user when setup as a standard user.
So, you could actually set them up with Standard User Accounts, not admin accounts and then turn off UAC
They will still need Admin Rights to install or do many things that require admin rights.
When running as a Standard User, with UAC Disabled, No prompt will be given, you will need to Right Click the App or shortcut and select Run As and provide Admin Credentials, to run or install that particular app.
However, setup that way, with UAC enabled, you would have more control and be able to turn on Parental Controls, which provide a great deal of control over what can and can not be done on the system.
Additionally, you could also take advantage of AppLocker
AppLocker is a flexible, easily administered mechanism that enables IT professionals to specify exactly what is allowed to run on user desktops. It provides the flexibility to allow users to run the applications, installation programs, and scripts they need to be productive. Learn how you can realize the security, operational, and compliance benefits of application standardization by using AppLocker
Either way,, it is not advised to disable UAC, due to it being able to warn you when anything is requiring admin rights to do anything. This is still a hot debate with positives and negatives on both sides. I advise leaving it on though.
|My System Specs|
|Thread Tools||Search this Thread|
|Similar help and support threads|
Do you use UAC (User Account Control)?
I notice that a lot of newcommers to this Forum seem to turn off UAC as that get annoyed with it keep asking for confirmation of an action. Do you run it and if so why?
User Account Control
I regularly get fed up with the User Account Control intrusiveness, but I do not want to do away with its good work. It does not appear for every application or .exe file I run, just some. So - is there a master list somewhere of 'acceptable' applications it will allow me to run with no question,...
How do i control a user account?
Hi, I have many people using my computer and I want to stop them from being on my account. What I mean by this is,that I want to set up an account for everyone else to use with the following control: 1. I (as an administrator) get to control password creation, account pictures and all...
user account control
hey guys, everytime i try to open a application called steam this appears... http://img163.imageshack.us/img163/8574/werid.png i know this appears when something is going to install or change something but is there any way the user account control can still work but steam is an exception? thank...
User Account Control
Can I Disable User Account Control (UAC) for one Windows 7 application or program?
User Account Control
I just got this from this article ... http://www.winsupersite.com/faq/windows_7.asp User Account Control improvements. Windows Vista's most reviled feature is being completely overhauled to be more customizable. Four settings will be available: 1. Never notify (least secure). The user is...
© Designer Media Ltd
All times are GMT -5. The time now is 09:17.