UAC. Have you turned your's off?

[Creer]

.. No AV, Firewall or UAC will protect them.

That's the reason for ..
Complete hard disk recovery solution, backup, drive copy, clone and image computer software ..

Nothing tunes up a computer or fixes what may have corrupted it better than a fast fresh install.

Sometimes .. The Cure is easier than the Prevention.

Yup, that's why security/protection based on layers is far much better than when we trust in only one app.

Here are the layers:
1. Prevention (HIPS, sandboxes, one session virtualization software, VM)
2. Detection (AV/AM/AS, Behavior Blockers, etc)
3. Cure (image backup software and data backup plan)

Of course no one tell you that you have to use eg. second layer in realtime, you can run it as on-demand scanner as well, only when you need it.

 

[pparks1]

I would never suggest relying on UAC to keep a system clean. UAC is just an added layer of security that is used along with AV and a Firewall.

Argghh.....UAC was never designed to keep a system clean. It's effective purpose is to notify you, the admin, when something is happening which is effectively increasing your priviledge level to administrator. In and of itself, it does nothing to prevent something bad from happening. But if I happen to be using my computer, and some random program informs me that it wants to become admin and I'm not running that app...then I click on No to escalation and investigate what is going on. Other applications like AV, malware checkers and the like do not perform this function.

I didn't need it with XP and I don't need it with Win 7 or Vista (at this time).

Yeah, but the majority of other users of Windows XP whose systems have been completely compromised (sometimes without the end-user having any idea)....probably do need this extra level of protection.

People yammer on and on about how much more secure that Linux and OSX is....and both of these systems have a security system similar to UAC. Of course, in both those cases, the user is not an admin and has to provide a password to go further. Microsoft started to implement these changes in their own systems after XP after getting so much egg on their face with all users having to be admins on the box. Whether so called "power users" want to believe it, steps like this are in the right direction to the overall security of the platform as a whole.

 

[Jacee]

I have not turned UAC off. If I happen to land on a page that was injected with a 'drive-by', I'd kinda' like to know beforehand

 

[vram]

Argghh.....UAC was never designed to keep a system clean. It's effective purpose is to notify you, the admin, when something is happening which is effectively increasing your priviledge level to administrator. In and of itself, it does nothing to prevent something bad from happening. But if I happen to be using my computer, and some random program informs me that it wants to become admin and I'm not running that app...then I click on No to escalation and investigate what is going on. Other applications like AV, malware checkers and the like do not perform this function.

I think we have a bit of a misunderstanding here. I'm not saying that UAC by itself was designed to keep a system clean but is designed to keep the user informed and notify the user if a program tries to makes changes to your system, which too me places UAC in the security category. I agree with what you're saying and I apologize if my wording wasn't exactly as I intended however if I receive a UAC prompt and I click "No", am I not preventing the application from making changes?

 

[esteban]

People yammer on and on about how much more secure that Linux and OSX is....and both of these systems have a security system similar to UAC. Of course, in both those cases, the user is not an admin and has to provide a password to go further. Microsoft started to implement these changes in their own systems after XP after getting so much egg on their face with all users having to be admins on the box. Whether so called "power users" want to believe it, steps like this are in the right direction to the overall security of the platform as a whole.

The difference with Linux's "UAC" is that even when you create the first account at installation, you're not root. You're an admin, but admin isn't the highest class. Windows doesn't do this. If I login/operate as root, I can do whatever the hell I want; with Windows and UAC, even as an admin, I would still get prompts. Also, I feel like Linux prompts me for the root password less frequently than Windows does/would, and picks its prompting situations a little better.

 

[H2SO4]

The difference with Linux's "UAC" is that even when you create the first account at installation, you're not root. You're an admin, but admin isn't the highest class. Windows doesn't do this. If I login/operate as root, I can do whatever the hell I want; with Windows and UAC, even as an admin, I would still get prompts.

All of that is configurable (UAC policy settings). It's actually far preferable to set UAC to "always allow" (and thus be invisible) than to disable the UAC. Both are bad news from a security standpoint, but the former less so.

Also, I feel like Linux prompts me for the root password less frequently than Windows does/would, and picks its prompting situations a little better.

It's because Windows has 47 billion times more apps and they're not all particularly well written w.r.t. security, which means they more frequently attempt to rummage round areas of the file system and registry which they have no business inspecting and modifying, which in turn means the user gets prompted for elevation.

The user is the biggest difference between NIX and Windows in this instance. Most NIX users tend to be relatively knowledgeable folk, by definition (the platform itself repels a55-hattery). They wouldn't dream of browsing the web and doing all those daily tasks while logged on as root, and yet that's exactly what many of the Windows "experts" do all day every day.

Microsoft's main security problem is their heterogeneous userbase. It's difficult to convince the "experts" who always use admin accounts - frequently with UAC disabled - that they're not actually being all that clever.

 

[zteardrop]

From a security perspective, advising someone to turn UAC off is just plain dumb. It disables IE protected mode, and that is a big loss.

 

[pakZ]

i shortly disabled it when my pc shipped and i first installed win7 and all those programms.

after the initial setup i'm rather getting into contact at all. i got my couple of tools i'm used to use over the years and have no real need to install/test out more.
so, it's on, now and it doesn't bug me at all.

 

[Uber Philf]

I don't like its harrasiveness, although i can tell if something isnt right, just one of those things after uve worked with computers for over 8 years.

 

[Frostmourne]

I've kept it, unless you want your pc to be about as secure as XP. Most users never implement proper security practices anyway, and thus rubbishware continues.

 

[yowanvista]

Completely turned it off
It was preventing some apps from installing
Too much annoying messages

 

[esteban]

All of that is configurable (UAC policy settings). It's actually far preferable to set UAC to "always allow" (and thus be invisible) than to disable the UAC. Both are bad news from a security standpoint, but the former less so.

I know that's configurable. My point is that Linux has a built-in superuser above the initial account. Windows' lack of this feature is what allows apps to run with admin privileges, and thus Windows demands UAC. If I want to prevent/restrict a regular user from system modification in Windows by using UAC, those settings also apply to me, and that's what is annoying.

You kind of said this in the second part of your post, but I wanted to clarify.

 

[logicearth]

I know that's configurable. My point is that Linux has a built-in superuser above the initial account. Windows' lack of this feature is what allows apps to run with admin privileges, and thus Windows demands UAC.

No, Windows does not lack that feature. You can have a single power user, aka., root. Howevr, by default it is configurd with an inclusive of all that are part of the administrators group. You are able to change that!

UAC is not required for that. What UAC is is but a convenience to run as a standard user but be able to get administrative power when required, without switching accounts. It is also part of the Mandatory Integrity Control. Mandatory Integrity Control - Wikipedia, the free encyclopedia

Those that are part of the Administrators group get a UAC prompt with an OK or Cancel choice. Those part of the User group must enter in the credentials of a Administrative user or Cancel.

 

[macgyver2]

There are many ways to protect a computers security and the biggest problems is always the USER. Now I run my computer as an admin account 100% of the time, I visit sites that would be considered HIGH risk(security testing), I have UAC turned off, I have NIS 2009 installed and I don't have any issues with the security of my laptop. The single time I did was when I was setting up my router security and had someone access my router which then gave them access to my laptop, which as far as I know I have all sharing turned off ( that guy was stealing info from anyone he could and is currently in jail waiting for his court case, he was moving from Apt to Apt stealing anything he could access wirelessly) I have not had a virus or other threat on my computer unless I put it there in the 20+ years I have been a computer user. the only secure computer is a 100% no external access either network or via any type of external media.

I test demo software and other stuff basic users like to install and am able to monitor my system and the affect it has without UAC telling me. So for basic users yes UAC is great, but for techs or people like me who want to find out what will happen to a system it can become a problem. for example networking sites have ads for making a cartoon of your photo, my sister in law installed it and months later had a Trojan her UAC isn't disabled. I disabled mine and installed the same program (we have the same laptop) I was able to find the issue with the software without UAC and when I had UAC running at high it didn't do anything to prevent that software from compromising the system. So I don't see that its any better then other firewall type software that offer the same feature. The only difference I see is its basiclly free but I think it still needs a lot more work.

Security is always going to be an issue no matter how a computer is used because there will always be someone who thinks they want access to something that isn't their own for many different reason. All software that guards the computer will have flaws and I can't wait for the day that we put AI into our security and it determines that the user is the security risk and wants to delete that risk.

 

[H2SO4]

...the biggest problems is always the USER. Now I run my computer as an admin account 100% of the time...

Mistakes

 

[pparks1]

when I had UAC running at high it didn't do anything to prevent that software from compromising the system.

Of course it didn't. That's not what it is supposed to do. The UAC system does NOT prevent a machine from being infected. The UAC system does not stop a virus. The UAC system does NOT prevent malware from being installed. You might was well have said, after running the UAC system my computer's hard drive still became fragmented over time.

The UAC system informs you, the admin, when an application is trying to elevate itself to have admin rights. If you have the slider bar all the way to the top, the UAC system will inform you, the admin, when you do something that needs to elevate to admin status. Either way, if you say yes, it elevates and does WHATEVER it was going to do. The UAC system does not step in and further try to prevent anything from happening.

I still cannot believe how many people think that UAC is supposed to stop these types of problems. It's a notification system, it allows you to escalate to an admin without switching user accounts. It does not provide the functionality of an AV application or an anti-malware application.

 

[esteban]

I know that's configurable. My point is that Linux has a built-in superuser above the initial account. Windows' lack of this feature is what allows apps to run with admin privileges, and thus Windows demands UAC.

No, Windows does not lack that feature. You can have a single power user, aka., root.

Single power user = nothing above initial account.

 

[logicearth]

...my sister in law installed it and months later had a Trojan her UAC isn't disabled... I had UAC running at high it didn't do anything to prevent that software from compromising the system.

Because UAC is not a security boundary. UAC does not stop the user from clicking allow and running whatever they want with administrative powers. It is not some anti-malware that scans applications, as far as it is concern malware is the same as Firefox or any other application. I do not understand why that is so hard to understand.

UAC is a convenience for not running as admin only when it is required to do so WITHOUT switching accounts.

 

[pparks1]

UAC is a convenience for not running as admin only when it is required to do so WITHOUT switching accounts.

I hear ya. Everytime I see these posts, I just shake my head. I try to ignore them and do something else...but I just cannot keep myself from posting.

 

[logicearth]

Single power user = nothing above initial account.

Yes there is. First of all the all powerful user on Windows is SYSTEM. It has even more power then the Administrator account. The Administrator account has more power then those accounts that are part of the Administrators group. And the permissions that are applied to the Administrators group can be revoked very easily because everything in Windows is governed by ACLs and those ACLs are configurable to micro levels.

I do not expect you to know the how deep ACLs really go in Windows or how user accounts are handled.