Let's discuss UAC here

Nice, now we can go all out about UAC

The part where I think UAC is *weird* is the "virtualization", why virtualize if you can just tell the user to use a standard user, and upon installation, ask for "Administrator password". Everything that has to do with system maintenance should ask that password, no more checks... Like now, everything that's "super user stamped", if you want to use it, it will throw a dialog box, put in the password, that'll simplify things quite a lot... With current implementation, a super user is virtually limited by UAC to prevent bad things... why not just tell the user to create standard user...

zzz2496

zzz2496 said:

Ok, I'll clear things up...

You will need at least one "Administrator", this is according to "Control Panel -> User Accounts". Then you create one "Standard User" for day to day use. Disable UAC, restart the computer.

Note: This is for those who knows what they're doing. Regular user, stick to Microsoft way (UAC + all those overheads, slower but that's how MS created it), bad things happens when you do the right way... good things happen when you use Microsoft way.... Remember, though Windows Vista and 7 is closing the gap between a real multi user OS (*nix) and Windows, still... Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try.

zzz2496

Ok, as per your suggestions, I tried creating a standard level user account. They are simply in the Users group and not in the admins group. And UAC is disabled and the computer has been restarted.

The problem as I see it here, is that you can get into various things (like adding a new user), but it then fails to complete the step at the very end. So, it's a bit frustrating that you don't know ahead of time that what you are trying is not going to work.

In addition, you can still right click on things...like Malwarebytes for example...and choose Run as Admin. it seems to go right in, but yet features like updating the software are grayed out and cannot be used. There doesn't appear to be any "Run As" in the right click context menu which might prompt instead for a username/password combination for an admin level account. What am I missing???


Edit: Oh yeah, I'm going to time test on my Win64 Enterprise box at work tomorrow and see if I can see a noticeable difference launching some of these UAC protected areas. I'll be sure to post results in this thread.

UAC is good i think it adds a extra layer of protection but it is not for all but it is recconmended to keep it on.

pparks1 said:

zzz2496 said:

Ok, I'll clear things up...

You will need at least one "Administrator", this is according to "Control Panel -> User Accounts". Then you create one "Standard User" for day to day use. Disable UAC, restart the computer.

Note: This is for those who knows what they're doing. Regular user, stick to Microsoft way (UAC + all those overheads, slower but that's how MS created it), bad things happens when you do the right way... good things happen when you use Microsoft way.... Remember, though Windows Vista and 7 is closing the gap between a real multi user OS (*nix) and Windows, still... Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try.

zzz2496

Ok, as per your suggestions, I tried creating a standard level user account. They are simply in the Users group and not in the admins group. And UAC is disabled and the computer has been restarted.

The problem as I see it here, is that you can get into various things (like adding a new user), but it then fails to complete the step at the very end. So, it's a bit frustrating that you don't know ahead of time that what you are trying is not going to work.

In addition, you can still right click on things...like Malwarebytes for example...and choose Run as Admin. it seems to go right in, but yet features like updating the software are grayed out and cannot be used. There doesn't appear to be any "Run As" in the right click context menu which might prompt instead for a username/password combination for an admin level account. What am I missing???


Edit: Oh yeah, I'm going to time test on my Win64 Enterprise box at work tomorrow and see if I can see a noticeable difference launching some of these UAC protected areas. I'll be sure to post results in this thread.

As I said earlier, "...Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try....", even Windows 7 still have it's legacy lineage with it... In a true multi user OS, such as Linux/UNIX, regular/limited/standard user can't even invoke the "adduser" command, or open add user dialog in this case. This kind of things is what I meant, the ones that will bark at you from time to time. If you're the administrator, it will succeed normally, yet if you're a standard user, it will fail as predicted (non admins can't create users, that's a fact...).

If you want to run as a different user, hold shift then right click the program you want to run, the menu entry will show up (there's a guide in this forum for that, made by Brink). But since this is Windows we're talking about, there will be some weird/strange/stupid behavior lurking in the shadows... For instance, you can run an installer as another user, and that app will finish and installed normally, but for some weird reason... you can't run explorer as another user and have it running concurrently with your own explorer process... which is just plain dumb. But that's not what I'm trying to achieve here, by using a limited user, you your self can't deliberately destroy your system (unless you provide a password and run a 3rd party file manager). IE's bug, whatever it is, if it succeed to take over your IE process, it will still run as your limited user, thus will have limited access to the whole system, minimizing damage at cost of your ease of system administration, well worth the hassle IMHO. If you use UAC, with whatever bug it has, your user (assuming that you're an administrator that's running as a virtually limited user) is still an admin. If the malware have the ability to invoke some bug in UAC to auto elevate, there goes your UAC protection... (not to mention the processing cost of that protection...). Is it completely unsafe? No, but IMHO it doesn't "click".

Trying to limit a super user is wrong. You need to start with Limited user. If you're restricted in doing things in the system, live with it, it's limited user after all - you have to accept it and find your ways around it. This is Windows we're talking about, a single user OS trying to be a multi user OS. From a technical stand point, NT kernel is multi user aware/capable, but from usage model standpoint, Windows is still single user focused. For day to day usage, Limited user is VERY SUFFICIENT and not to mention VERY SAFE. If you want to create a user or do a quick system administration, use Fast user switching. I assume the computer administrator account will be so barren, it will load like a cat splashed with boiling water... In Linux/UNIX, you can always invoke "sudo" or "su" (and their GUI equivalent for fast administration), too bad Windows's equivalent isn't behaving as expected... I suppose it's a "security feature"...

zzz2496

zzz2496 said:

As I said earlier, "...Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try....", even Windows 7 still have it's legacy lineage with it... In a true multi user OS, such as Linux/UNIX, regular/limited/standard user can't even invoke the "adduser" command, or open add user dialog in this case. This kind of things is what I meant, the ones that will bark at you from time to time. If you're the administrator, it will succeed normally, yet if you're a standard user, it will fail as predicted (non admins can't create users, that's a fact...).

In a case such as Adding a User...I would much prefer that Windows bark a lot louder when I'm a standard user and make it very obvious that I won't be able to perform that task without having admin access. I'm an admin for a living, so I understand that you cannot do this...but it really stinks to go through all of the dialog boxes and get to the end only to have the system say "access is denied".

zzz2496 said:

If you want to run as a different user, hold shift then right click the program you want to run, the menu entry will show up (there's a guide in this forum for that, made by Brink).

Thanks...that was the point that I was missing. Holding the shift key.

zzz2496 said:

Trying to limit a super user is wrong. You need to start with Limited user. If you're restricted in doing things in the system, live with it, it's limited user after all - you have to accept it and find your ways around it. This is Windows we're talking about, a single user OS trying to be a multi user OS.

I agree. With my Linux boxes, I typically never log on with root..but rather with my everyday account and su only when necessary. For everything else, I set up the sudo system. And I'm a Ubuntu desktop user..so I'm quite used to the sudo way of doing things. I often shake my head when the new users of Ubuntu want to immediately get rid of sudo and instead setup and use a root account.

zzz2496 said:

If you want to create a user or do a quick system administration, use Fast user switching.

Never really been able to utilize this as my Windows boxes are all on domains. Being an admin for a living, means that I usually run a domain at home as well for experimenting and testing.

I am one of those users for whom MS came up with this system. I run routinely in an administrator account. I like this level of protection that UAC offers. I am also careful and pay attention to what I am doing. In all my years with XP, I never had a virus nor any kind of malware.

UAC can be annoying especially if you are used to a true administrator level account. However, I don't see any difference in time spent dealing with the UAC pop up versus a pop up prompt to enter a password. In fact, for me, UAC is quicker to deal with.

In these days of drive by downloads and identity theft, I think the UAC is good thing especially for less informed users. Could I get by without it? Sure I did so for years using Win 98 and XP with no ill effects. But I like to think I am an informed user who avoids questionable sites and is careful about clicking on links and opening email.

Let's make a list and give it to Microsoft, shall we? :) Tell them to make a "real" multi user OS and have the usage model reflect it as such, and tell them to dump UAC, it's expensive, complicated, and IMHO close to useless if the concept of multi user executed properly.

In "Domain Enabled" network situation, things go VERY DIFFERENTLY than in single host mode. I assume the "Domain" doesn't change much since W2K/3 (I have MCP for MS Server products, so I more or less know my way around). In a Domain situation, the host will ask everything concerning security to the Domain controller, and that results in fast user switching service-related disablement. Maybe MS thinks that in a Domain situation, one host = one user... I never had this limitation on Linux/AIX . If only Linux in Desktop world is as good as Linux in Server world... :'(

zzz2496

Edit: woops, looks like I was a little bit too late in posting...

CarlTR6 said:

I am one of those users for whom MS came up with this system. I run routinely in an administrator account. I like this level of protection that UAC offers. I am also careful and pay attention to what I am doing. In all my years with XP, I never had a virus nor any kind of malware.

UAC can be annoying especially if you are used to a true administrator level account. However, I don't see any difference in time spent dealing with the UAC pop up versus a pop up prompt to enter a password. In fact, for me, UAC is quicker to deal with.

In these days of drive by downloads and identity theft, I think the UAC is good thing especially for less informed users. Could I get by without it? Sure I did so for years using Win 98 and XP with no ill effects. But I like to think I am an informed user who avoids questionable sites and is careful about clicking on links and opening email.

Agreed. But I still stand by my opinion... Microsoft should just use similar model what Ubuntu/MacOS X/Linux in general use. Everything that's system related should pop up a username/password dialog. A malware can easily fill those boxes, but it's much harder to exploit than say, a bug in UAC subsystem (UAC is complex, complex software tend to have bugs) that will invoke auto elevate which is VERY DANGEROUS, since you are an Admin that's "shrouded" by UAC... And I just tried re-enabling UAC just now... Maybe it's related to I don't know how many Windows updates occurred in several months, UAC dim screen shows up a bit faster this time, but still no where near no UAC performance.

zzz2496

Ok, after running through a test in our last thread ( the one we hijacked), it was noted that I was using Windows 7 32-bit before and Windows 7 64-bit would tell a different story.

Here was the test that I performed. On my desktop (Intel Core 2 Duo E8400 at 3.00Ghz with 4GB of RAM running Windows 64-bit Ultimate), I turned off the machine. I started my stop watch from the time that I hit the power button. I waited until exactly 2 minutes before I clicked on the Start Orb, then right clicked on My Computer and choose Manage. This gave the machine time to boot and get services started etc. I then ran the test 3 times with UAC on and 3 times with it off. Here are the results averaged.

Avg time with UAC enabled : 2:08.16
Avg time with UAC turned off: 2:07.33

So, while there is a small difference (less than 1 hundredth of 1%)..this could come from my inability to start instantly at the 2:00 mark and navigate perfectly with my mouse to perform exactly the same steps. Either way, I cannot classify what I am seeing as "night and day difference".

So, I stand by my original opinion that while the UAC system might not be perfect in it's design, it's not likely adding any additional overhead that a typical system is not able to overcome.