Users turning off UAC put their PCs at risk, says Microsoft

[DalekOverSeer]

I use UAC and I never shut it off. .I want to be notified if my apps are doing something on my behalf and I want to run with the least amount of privilege as possible on my system while remaining as efficient as possible. I personally feel that UAC is pretty decent in this regard.

i have stated in another thread that is what a good firewall is for. i ran a test. a new install of 7, uac at default, did the windows updates, installed 20 apps in a specific order, noted the uac prompts. then for the second half of the test i wiped the drive, installed 7 again, turned uac off, installed zonealarm, winpatrol, and counterspy, did my personal setting for all 3, then did the windows updates, and the same 20 apps in the same order, noted the zonealarm prompts. i received prompts from zonealarm that match every prompt i received from uac plus a few more. unlike uac i don't get prompted 2 or more times for the same item with zonealarm, unless i deliberately set it to prompt me everytime.

 

[echrada]

I use UAC and I never shut it off. .I want to be notified if my apps are doing something on my behalf and I want to run with the least amount of privilege as possible on my system while remaining as efficient as possible. I personally feel that UAC is pretty decent in this regard.

i have stated in another thread that is what a good firewall is for. i ran a test. a new install of 7, uac at default, did the windows updates, installed 20 apps in a specific order, noted the uac prompts. then for the second half of the test i wiped the drive, installed 7 again, turned uac off, installed zonealarm, winpatrol, and counterspy, did my personal setting for all 3, then did the windows updates, and the same 20 apps in the same order, noted the zonealarm prompts. i received prompts from zonealarm that match every prompt i received from uac plus a few more. unlike uac i don't get prompted 2 or more times for the same item with zonealarm, unless i deliberately set it to prompt me everytime.

Don't you think this colour is a bit ot

 

[pparks1]

turned uac off, installed zonealarm, winpatrol, and counterspy, did my personal setting for all 3,

Seems like a lot of overhead to simply replace UAC which is there by default and enabled.

unlike uac i don't get prompted 2 or more times for the same item with zonealarm, unless i deliberately set it to prompt me everytime.

Where is the protection though?? So, 1 time IE wants to run as admin and you say "allow" and "always allow". So, next time something nasty comes through and tries to install something via IE, it's just going to be "allowed" because last time you said it was ok. Sorry, I just don't get it. So, instead UAC gets turned off and now protected mode is gone and doesn't provide sandboxing benefits to your machine.

Like I said, I rarely see a UAC prompt...so I don't find it very annoying. I click on Ok, about once per month for Malwarebytes and about once every 2-4 weeks for Acronis. Aside from that, i hardly ever see it.

 

[DalekOverSeer]

turned uac off, installed zonealarm, winpatrol, and counterspy, did my personal setting for all 3,

Seems like a lot of overhead to simply replace UAC which is there by default and enabled.

unlike uac i don't get prompted 2 or more times for the same item with zonealarm, unless i deliberately set it to prompt me everytime.

Where is the protection though?? So, 1 time IE wants to run as admin and you say "allow" and "always allow". So, next time something nasty comes through and tries to install something via IE, it's just going to be "allowed" because last time you said it was ok. Sorry, I just don't get it. So, instead UAC gets turned off and now protected mode is gone and doesn't provide sandboxing benefits to your machine.

Like I said, I rarely see a UAC prompt...so I don't find it very annoying. I click on Ok, about once per month for Malwarebytes and about once every 2-4 weeks for Acronis. Aside from that, i hardly ever see it.

actually i have seen more harmful items get through with uac that with my set up. over the last several years i have had 2 items that needed removing. 1 was because i did all my windows updates, and all my other software first before doing the security software. the second one was because i was foolhardy enough to test out something on my system that my roommate was having problems with without scanning it first. really though as far as i'm concerned if someone is more comfortable using uac when i work on their system i don't mess with their security settings unless they ask me to. i might make a suggestion for better protection, but i leave it up to them. it is really a matter of what i person feels more comfortable with.

counteryspy catches the few items zonealarm misses.
winpatrol checks to see if i gave an item to change something.

echrada nice catch i hit the wrong blue. i wasn't trying to blind people delibrately.

 

[seth500]

The way my firewall suite is setup you can't make changes to my computer without it knowing because it monitors everything. I've actually downloaded malware just to test it out and it catches it before UAC would. Also has Heuristics like most suites to get things just by the way they behave and with 6,000,000 signatures, I haven't been infected for a long time so I do run with UAC down but I don't recommend that all computer user's do this for the fact that I personally know of many people that don't understand how computers function such as my mother they just don't get it! For me though I feel comfortable without it.

 

[pparks1]

I've actually downloaded malware just to test it out and it catches it before UAC would.

UAC doesn't detect malware, and it doesn't stop it either. That's not what it does. It simply alerts you when the application attempts to gain admin access on your box.

 

[seekermeister]

If they really want people to keep it turned on, then they should get off their duffs, and design it in a fashion that if far more user friendly.

 

[pparks1]

If they really want people to keep it turned on, then they should get off their duffs, and design it in a fashion that if far more user friendly.

What parts do you find so irritating? It seems pretty darn simple. I mean in a Linux/Unix world, you run everything with a standard user account. When you click something in the GUI that needs to elevate credentials, you are asked for your password. If you are at the command line, you preface your command with (sudo command), and then are prompted for your password. All you have to do within the Windows world is simply click on a "yes", allow this.

And thus far in the poll that started here on this forum, it seems 3/4 people leave UAC on..so it seems lots of people do use it.
http://www.sevenforums.com/system-security/179593-do-you-have-uac-off.html

 

[legacy7955]

I ALWAYS leave it on in the default position.

The fact is I'm willing to get a few prompts if it can save me from the occasional error in judgement or slip.
It happens to all of us, including the "savvy" folks here.

I think the most danagerous thing for users is to become too complacent when using the OS. You get really comfortable and feel you know things well enough and that is the perfect time to be infected.

I agree with others here that say education and surfing and downloading prudently is the best security.

I like MS windows and always have BUT I don't think they do enough to PUBLICALLY get the word out about safe surfing and dowloading,ect.

That being said they are light years ahead of Apple OSX. Who basically tell you there is almost nothing to worry about . You know what they say when you're told "not to worry!

 

[seekermeister]

If they really want people to keep it turned on, then they should get off their duffs, and design it in a fashion that if far more user friendly.

What parts do you find so irritating? It seems pretty darn simple. I mean in a Linux/Unix world, you run everything with a standard user account. When you click something in the GUI that needs to elevate credentials, you are asked for your password. If you are at the command line, you preface your command with (sudo command), and then are prompted for your password. All you have to do within the Windows world is simply click on a "yes", allow this.

And thus far in the poll that started here on this forum, it seems 3/4 people leave UAC on..so it seems lots of people do use it.
http://www.sevenforums.com/system-security/179593-do-you-have-uac-off.html

User friendly doesn't necessarily mean simple. As others have mentioned, it is very irritating to have it continually pop up for exactly the same function over and over.

BTW, your statement about Linux is not true. Instead of an Admin account, it has a root account that serves the same purpose. Even in the user account, one doesn't get as many prompts as with Windows UAC, unless they are trying to use administrative functions.

EDIT: As far as that poll goes, 24 people hardly counts as a lot. Consider just the number of members that there are, much less the lurkers.

EDIT: I just checked on the main index, and there is just shy of 154,000 members. Even the number of active members at any one time is usually considerably higher in number than those that took part in that poll.

 

[pparks1]

BTW, your statement about Linux is not true. Instead of an Admin account, it has a root account that serves the same purpose. Even in the user account, one doesn't get as many prompts as with Windows UAC, unless they are trying to use administrative functions.

I'm a Linux systems admin for a living....and I've even got the credentials to back it up. I have the RHCE (Red Hat Certified Engineer). Been managing Linux systems since around 1999. Linux does have a root account, but very few Unix/Linux admis actually log in and use that account on a day to day basis. We might when we are first installing our server and setting up software, but after that we all use a standard account and either (su to root) or (sudo command) to get admin level privs. I probably have close to 150 linux boxes where I work, almost all of them are remote, and we access them with SSH. They have no GUI installed whatsoever. And as part of our standard setup, we actually disable root account logins via SSH. Even if you happen to know the root username/password, you aren't allowed to connect remotely. You have to login with a standard account. Using the root account in a day-to-day fashion is simply a dangerous practice. On simple (rm -rf /) and it's over.

I often run CentOS/RedHat on servers (which does have a working root account by default) and I usually use Ubuntu for desktops (and by default, it doesn't even have the root account enabled). You have to take a few steps, including setting a root passwd to even use it within Ubuntu. Running as root, is highly discouraged. Just hit the Ubuntu forums and ask how to enable your root account and the community will do just about anything to talk you out of it, short of telling you what you need to do.

Now, back to Windows...you don't get UAC prompts unless doing some administrative functions either. By default, when you login, you get 2 tokens. 1 for standard user stuff and 1 for admin level things. When you launch an app that triggers UAC, you are being asked to elevate and switch to using privs from that 2nd token. Thus, allowing you the administrative access to the machine that the particular application requires.

You don't get UAC prompts when you launch games, notepad, calculator, paint, photoshop, word, excel, powerpoint, etc. And if for some strange reason, you are being asked when launching these apps, it's going to be advantageous to look into that application and try to find out why.

My statements for Linux were to demonstrate that in this environment, you don't get the convenience of a "yes/no" checkbox, but rather have to either specify the command using sudo or you have to provide a username/password combo or at least a password to execute that command. That's the preferred and normal way of doing things. While you could login as root and not get prompts, it's not a wise practice at all...and very few Linux users would actually do things that way. So for us, the way UAC does it, seems really simply and non intrusive..compared to our normal.

 

[vaidas3]

I think the problem lies not in windows.. its in software that were coded for windows.
in windows xp it was almost impossible to work without administrative account. in windows 7 many things changed but still many programers make their programs old style to require administrative privileges to run.. when it can be made to run on standart user.

although there is system tools that may require administrator to work. there is many software that requires administrator, but can be made to work without it.