This seems to be an old topic, so I am making a new post. I found the following statement in another thread:
"In Windows 7, even when you are logged in as administrator, UAC no longer gives you “Full” administrator rights."
I have been frustrated by this quite often, as I have administrator privileges, but I frequently have to run as administrator to get past this restriction. Can anybody give a rational explanation for why this change was made?
Hello ejdpop, :)
Basically, an administrator account behaves the same way as a standard user except for when a program requires elevated rights to run.
An administrator will just need to approve running the program elevated (aka: "Run as administrator") by clicking on Yes in the UAC prompt.
A standard user will have to provide an administrator's password to approve.
The while point of UAC is for better security by preventing anything from running elevated without first being approved by an administrator.
Why? Anything that runs elevated will have full unrestricted access to everything on the computer, so you don't want something (ex: malware) running elevated without knowing and approving first.
There is the built-in elevated "Administrator" account that has full unrestricted access. It can be used as needed, but it is not recommended for everyday usage for the above reasons.
Hope this helps some.
the simple reason is that any process including malware runs with the rights of the user that the process is called by.
When the NT range of operating systems was introduced it was decided to make the first user created an administrator account by default.
This did not cause any issues in the original professional market demographic for the OS range The system administrators simply created standard users for all users and kept the administrator for it's intended user, indeed it was normal for admin users to have a standard user account for day to day use and only swap to an administrative user when needed.
Then XP was released and aimed at the home and enthusiast market as well as the existing market, For simplicity it was decided to continue the procedure with the first user being an administrator, (to be honest it has to be that way or the user would be locked out of the system). Unfortunately just at the time that malware got serious, not melting letters in your word processor but emptying your bank account, the were many millions of computer system where if the malware got in it had full rights to do what it needed to do to steal things etc.
Microsoft looked at the issue and came up with a token system where the first user was a hybrid user, it had standard user rights until administrator rights were needed and then could be elevated to admin using UAC, for each operation so that malware was not likely to gain access other than as a standard user so that damage potential is minimised. The dimmed screen you get when elevating to admin lever is running in a separate secure process that is almost impossible for malware to spoof or defeat.
When running as a tokenised administrator you have full administrator rights, Almost, there is a fallback to the old way with the hidden administrator which may be used in emergency situations.
There is also one further anti malware system is use - the program and certain system areas are owned by a special admin user - Trusted Installer , which is positioned above the regular elevated admin level but below that of the Hidden administrator. This user is there to prevent malware that gets invoked by an elevated standard admin user from causing damage.
Basically UAC protects users from common errors that especially these days can cause serious issues
Three characters.
Quote