Windows 7 awkward feel, missing WinXP, need advice

[severedsolo]

The right way would be using a limited user account, make sure that your limited user account can ONLY read system related files/subsystems (including registry). This way is MUCH SAFER than using that weird resource hogging UAC.

zzz2496

what do you think UAC does? exactly what i have quoted, as i understand it, (and im sure someone will correct me if i am wrong) with UAC enabled, your account is a limited user account, UAC will run programs that get elevated as the built in admin account, exactly the same as would happen if you actually set up an admin account and a limited account, it doesnt "check" anything, UAC doesnt kick in until a program, or windows asks for admin priveliges, otherwise it is dormant,

even running a limited user account, and using another admin account for "elevation" will prompt a UAC for the password of the admin account, so how exactly is it faster?

 

[zzz2496]

While I understand that sandboxing can be resource intensive, all of the testing that I have performed with a stopwatch and a controlled test build hasn't shown hardly any difference with UAC on or off. I've measured startup and shut down times and have run through a handful of tests involving a handful of apps..some of which required UAC and some which don't require UAC and the timing tests haven't shown much difference at all.

While I agree that using a standard account is a far better security setup, I think it's somewhat impractical for most people. The amount of time to log off and on as a secondary admin account will consume far more time than the UAC system is going to consume. And when people have 2 accounts (one a full admin and 1 a standard restricted user)...it's natural for them to simply use the admin account for everything. Thus, in my opinion, the UAC system provides a nice middle ground.

In short, I just don't find the actual UAC system to be very resource hogging at all. Perhaps it's because every machine that I have used with Windows 7 is simply powerful enough to mask the issue.

Woops, sorry... here's what you can try... open "Device Manager" or "Computer Management" with and without UAC (both will invoke UAC prompt). For applications that is behaving "properly", those won't slow down. I access this kind of subsystems all the time, so I benefit a lot from disabling UAC. Opening "Computer Management" never felt this fast.

As for privilege escalation needs, you can always run the right way --> "Run as" command... This is the correct way to escalate your privilege in ANY modern operating systems, let it be UNIX (SUN SOLARIS, IBM AIX, HP UX, etc) or Linux (RedHat, SuSE, Debian, etc). In Linux/UNIX world, there's the "sudo" and "su" command, equivalent to "Run as". You don't need to log off...

As for "resource hogging" comment, I see that your computer is WAY faster than mine, so maybe on your computer, the overhead can be neglected. On my computer, disabling UAC made my computer much faster, it's like night and day...

zzz2496

 

[kenC]

<<Woops, sorry... here's what you can try... open "Device Manager" or "Computer Management" with and without UAC (both will invoke UAC prompt).>>

This is way above my head (and going off topic) But can I just say that I have UAC turned on and Device manager comes up in about a second with NO UAC warning!
So, no delay there.

 

[zzz2496]

The right way would be using a limited user account, make sure that your limited user account can ONLY read system related files/subsystems (including registry). This way is MUCH SAFER than using that weird resource hogging UAC.

zzz2496

what do you think UAC does? exactly what i have quoted, as i understand it, (and im sure someone will correct me if i am wrong) with UAC enabled, your account is a limited user account, UAC will run programs that get elevated as the built in admin account, exactly the same as would happen if you actually set up an admin account and a limited account, it doesnt "check" anything, UAC doesnt kick in until a program, or windows asks for admin priveliges, otherwise it is dormant,

even running a limited user account, and using another admin account for "elevation" will prompt a UAC for the password of the admin account, so how exactly is it faster?

No, your user is still an Admin user, your "token" is not. This "token" is what UAC checks. If your "token" is limited user, then the current process (whatever it is, let it be an installer or whatever) will be limited AS IF it's running under limited user privilege, write down the giant "AS IF". This "AS IF" checks is done by UAC every time ANY program/application do ANYTHING. If it accesses an "admin area", UAC will then "bark" at the user, asking for compliance. These checks are what impacts the performance of the computer.

This is weird in my opinion, in a real multi user environment like *nix, you MUST BE root to be able to destroy the system, no other way. If you're a limited user, then you are a limited user and forever banned from admin areas. In 7/Vista, Microsoft wants to mimic this behavior but it is too "expensive" to teach Windows users to properly use "multi user" usage model, so they came up with UAC, a subsystem that can make a super user to be as if a limited user, which is just plain WRONG to begin with.... They do it all the way around, limiting a super user by doing checks everywhere and processing overheads... sigh... sandbox oh sandbox...

Read this and this about "tokens"...

zzz2496

 

[zzz2496]

<<Woops, sorry... here's what you can try... open "Device Manager" or "Computer Management" with and without UAC (both will invoke UAC prompt).>>

This is way above my head (and going off topic) But can I just say that I have UAC turned on and Device manager comes up in about a second with NO UAC warning!
So, no delay there.

That is weird, in my system, "Device Manager" and "Computer Management" icon have little yellow/blue shield on it, thus the UAC confirmation...

zzz2496

 

[severedsolo]

fair enough my understanding was a bit off, but the basic principle is the same, by the way, i just disabled UAC and ran a few random apps to test your theory, including disk management, computer management, and device manager like you recommended, there was no noticable improvement in speeds, and my computer is slower than yours....

as to the "shield" that simply means that it needs to run as "full admin" but windows processes automatically elevate themselves without prompting

but eh, im backing out of this thread, its going way OT and im not going to be dragged into a pointless argument

 

[pparks1]

Woops, sorry... here's what you can try... open "Device Manager" or "Computer Management" with and without UAC (both will invoke UAC prompt). For applications that is behaving "properly", those won't slow down. I access this kind of subsystems all the time, so I benefit a lot from disabling UAC. Opening "Computer Management" never felt this fast.

Thanks for giving me something tangible that I could test.

Here was the test that I performed. On my laptop (Dell E6400 with Intel Core 2 Duo P8600 at 2.40Ghz with 4GB of RAM running Windows 32-bit Enterprise), I turned off the machine. I started my stop watch from the time that I hit the power button. I waited until exactly 2 minutes before I clicked on the Start Orb, then right clicked on My Computer and choose Manage. This gave the machine time to boot and get services started etc. I then ran the test 3 times with UAC on and 3 times with it off. Here are the results averaged.

Avg time with UAC enabled : 2:14.43
Avg time with UAC turned off: 2:13.85

So, there was a difference...albeit small.

 

[zzz2496]

fair enough my understanding was a bit off, but the basic principle is the same, by the way, i just disabled UAC and ran a few random apps to test your theory, including disk management, computer management, and device manager like you recommended, there was no noticable improvement in speeds, and my computer is slower than yours....

as to the "shield" that simply means that it needs to run as "full admin" but windows processes automatically elevate themselves without prompting

but eh, im backing out of this thread, its going way OT and im not going to be dragged into a pointless argument

Very true

Woops, sorry... here's what you can try... open "Device Manager" or "Computer Management" with and without UAC (both will invoke UAC prompt). For applications that is behaving "properly", those won't slow down. I access this kind of subsystems all the time, so I benefit a lot from disabling UAC. Opening "Computer Management" never felt this fast.

Thanks for giving me something tangible that I could test.

Here was the test that I performed. On my laptop (Dell E6400 with Intel Core 2 Duo P8600 at 2.40Ghz with 4GB of RAM running Windows 32-bit Enterprise), I turned off the machine. I started my stop watch from the time that I hit the power button. I waited until exactly 2 minutes before I clicked on the Start Orb, then right clicked on My Computer and choose Manage. This gave the machine time to boot and get services started etc. I then ran the test 3 times with UAC on and 3 times with it off. Here are the results averaged.

Avg time with UAC enabled : 2:14.43
Avg time with UAC turned off: 2:13.85

So, there was a difference...albeit small.

Err.. I forgot to mention, the 64bit version... I use the 64bit. The 32bit version is somewhat faster, I don't know what MS did in the 64bit, but it's slower in 64 than 32. By the way, we should stop before OT warning...

zzz2496

 

[pparks1]

Err.. I forgot to mention, the 64bit version... I use the 64bit. The 32bit version is somewhat faster, I don't know what MS did in the 64bit, but it's slower in 64 than 32. By the way, we should stop before OT warning...

zzz2496

I'll try the tests again on my 64-bit machine later...it's just more powerful and I was trying to eliminate a powerful machine from masking the problem.

I don't really think we are that far off topic. The discussion was to make Windows 7 more like Windows XP...thus disabling this UAC system is going to be a discussion point if this topic is to be complete. There are 2 schools of thought on UAC...those who see benefit and those who don't. This commentary (as long as it remains civil) should prove valuable to others who are also considering making changes such as these to improve performance. It's quite possible that our work and effort could save them some trouble.

 

[CarlTR6]

I intend to keep UAC enabled even if it costs me a whole second or two. The added layer of protection is worth it since, like many others, I run with an admin account - not the hidden admin account.

 

[severedsolo]

Woops, sorry... here's what you can try... open "Device Manager" or "Computer Management" with and without UAC (both will invoke UAC prompt). For applications that is behaving "properly", those won't slow down. I access this kind of subsystems all the time, so I benefit a lot from disabling UAC. Opening "Computer Management" never felt this fast.

Thanks for giving me something tangible that I could test.

Here was the test that I performed. On my laptop (Dell E6400 with Intel Core 2 Duo P8600 at 2.40Ghz with 4GB of RAM running Windows 32-bit Enterprise), I turned off the machine. I started my stop watch from the time that I hit the power button. I waited until exactly 2 minutes before I clicked on the Start Orb, then right clicked on My Computer and choose Manage. This gave the machine time to boot and get services started etc. I then ran the test 3 times with UAC on and 3 times with it off. Here are the results averaged.

Avg time with UAC enabled : 2:14.43
Avg time with UAC turned off: 2:13.85

So, there was a difference...albeit small.

Err.. I forgot to mention, the 64bit version... I use the 64bit. The 32bit version is somewhat faster, I don't know what MS did in the 64bit, but it's slower in 64 than 32. By the way, we should stop before OT warning...

zzz2496

im using Win 7 Ultimate X64, as i said no noticable difference, slow machine (compared to yours) admittedly i didnt use a stopwatch, but then honestly who sits there with a stopwatch in front of their pc constantly? i think it would point to the problem being with your PC and not UAC

 

[pparks1]

i didnt use a stopwatch, but then honestly who sits there with a stopwatch in front of their pc constantly? i think it would point to the problem being with your PC and not UAC

HaHa....that's me. The one with the stopwatch. While I don't have it there constantly, whenever I try out tweaks or otherwise intended to improve performance I put them through a timing test to see if it's really all that different or not. You would be surprised how many people "feel" a difference but when under a stopwatch cannot "prove" that improvement that they are certain that is there.

This practice comes from a force of habit out of work experiences. I came from a software company that had developers and then everybody else. When people would whine and complain about new machines versus old machines and who should get what...I often just time tested everything and benchmarked it all to show what was and wasn't happening. It proved quite valuable to me. Pretty much whenever we got a new machine in, it came to me and I ran it through the test platform and made the baseline report for the machine.

 

[whs]

Here is an interesting article on UAC virtualization. There is a Part2 link on the bottom of the page. Protecting System Files with UAC Virtualization (Part 1)

 

[zzz2496]

Thanks for giving me something tangible that I could test.

Here was the test that I performed. On my laptop (Dell E6400 with Intel Core 2 Duo P8600 at 2.40Ghz with 4GB of RAM running Windows 32-bit Enterprise), I turned off the machine. I started my stop watch from the time that I hit the power button. I waited until exactly 2 minutes before I clicked on the Start Orb, then right clicked on My Computer and choose Manage. This gave the machine time to boot and get services started etc. I then ran the test 3 times with UAC on and 3 times with it off. Here are the results averaged.

Avg time with UAC enabled : 2:14.43
Avg time with UAC turned off: 2:13.85

So, there was a difference...albeit small.

Err.. I forgot to mention, the 64bit version... I use the 64bit. The 32bit version is somewhat faster, I don't know what MS did in the 64bit, but it's slower in 64 than 32. By the way, we should stop before OT warning...

zzz2496

im using Win 7 Ultimate X64, as i said no noticable difference, slow machine (compared to yours) admittedly i didnt use a stopwatch, but then honestly who sits there with a stopwatch in front of their pc constantly? i think it would point to the problem being with your PC and not UAC

Well, we all use our machine differently. Mine is running almost like a server load, with around 90 processes started upon start up. This is not regular workload. Several of them are Apache web server, several database servers, and 2 virtual machines running on idle. When I work, around 140 processes registered in Task Manager, 30 - 40 windows open at any given time and connection from many hosts over several VPN connections querying my database servers... So I need every bit of performance I can get from this old machine... I prefer to give the performance to my server processes than to UAC

i didnt use a stopwatch, but then honestly who sits there with a stopwatch in front of their pc constantly? i think it would point to the problem being with your PC and not UAC

HaHa....that's me. The one with the stopwatch. While I don't have it there constantly, whenever I try out tweaks or otherwise intended to improve performance I put them through a timing test to see if it's really all that different or not. You would be surprised how many people "feel" a difference but when under a stopwatch cannot "prove" that improvement that they are certain that is there.

This practice comes from a force of habit out of work experiences. I came from a software company that had developers and then everybody else. When people would whine and complain about new machines versus old machines and who should get what...I often just time tested everything and benchmarked it all to show what was and wasn't happening. It proved quite valuable to me. Pretty much whenever we got a new machine in, it came to me and I ran it through the test platform and made the baseline report for the machine.

Have to agree on the stopwatch comment

 

[Corrine]

Whew! Nick2, your head must be spinning with all this information. I'm going to add another bit of reading for you -- something I think will help you in the transition from XP to Windows 7. Andre DaCosta, recently awarded Microsoft MVP, prepared a quick guide with side-by-side image comparisons to help new Windows 7 users become familiar with some of the changes and benefits of Windows 7. See Andre's article in For the 'former' Windows XP User - Welcome to Windows 7!

I'm certain between the tutorials here and all the Windows 7 converts, you will get any questions answered -- and then some!

Good luck and enjoy your new computer.

 

[zzz2496]

Anyway, rather than relying on UAC (which then involves sandboxing, virtualization, and god knows what other checking in place), I prefer (and I recommend to all of my friends and clients) to use the "proper" way of using multi user OS, which is "Just use the darn limited user" advice. Since Vista and 7 is built with limited user in mind, both products are behaving accordingly, which is not the case with Windows XP (and Windows 2000 Pro). By using true Limited user and disable UAC, the system will then check ONLY by ACL, no more virtualization, no more cr*p, just plain old Windows, VERY fast and efficient.

Imagine if you want to start an application, with UAC it will initialize the Virtualization engine, preparing the Virtualized environment, doing the Mandatory Integrity Check, preparing the sandbox, all that - and then prepare for ASLR, DEP, etc... My god, that's a lot of overhead... By using Limited user, disable UAC, when you start an app, it will just start the app, no virtualization initialization, no token check, no cr*p. If the app accesses, say "Program Files\[app folder]" and that folder is in "read only" for the current user, then the app will simply throw an error of unable to write, or something... No other checks than ACL.

In short, simpler, faster, smiley face all day, every day

zzz2496

 

[SIW2]

This may be of interest .

You can choose during install to have either the start menu, or the Explorer enhancements, or both.

Classic Shell: Features

 

[pparks1]

I prefer (and I recommend to all of my friends and clients) to use the "proper" way of using multi user OS, which is "Just use the darn limited user" advice. Since Vista and 7 is built with limited user in mind, both products are behaving accordingly, which is not the case with Windows XP (and Windows 2000 Pro). By using true Limited user and disable UAC, the system will then check ONLY by ACL, no more virtualization, no more cr*p, just plain old Windows, VERY fast and efficient.

What are you suggesting here? I want to make sure that I fully understand the advice.

Are you saying to use an account that is simply in Users....or to use an account that is in the admins group and simply run with UAC disabled as this initial account is a limited user by default.

 

[zzz2496]

I prefer (and I recommend to all of my friends and clients) to use the "proper" way of using multi user OS, which is "Just use the darn limited user" advice. Since Vista and 7 is built with limited user in mind, both products are behaving accordingly, which is not the case with Windows XP (and Windows 2000 Pro). By using true Limited user and disable UAC, the system will then check ONLY by ACL, no more virtualization, no more cr*p, just plain old Windows, VERY fast and efficient.

What are you suggesting here? I want to make sure that I fully understand the advice.

Are you saying to use an account that is simply in Users....or to use an account that is in the admins group and simply run with UAC disabled as this initial account is a limited user by default.

Ok, I'll clear things up...

You will need at least one "Administrator", this is according to "Control Panel -> User Accounts". Then you create one "Standard User" for day to day use. Disable UAC, restart the computer.

Note: This is for those who knows what they're doing. Regular user, stick to Microsoft way (UAC + all those overheads, slower but that's how MS created it), bad things happens when you do the right way... good things happen when you use Microsoft way.... Remember, though Windows Vista and 7 is closing the gap between a real multi user OS (*nix) and Windows, still... Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try.

zzz2496

 

[whs]

Hey, Hey - we are all guilty for highjacking this poor OPs thread for UAC discussions. He must be totally confused and does not seem to dare sticking his head out - LOL.
I have started a new thread where we can discuss UAC. Maybe you please to migrate further UAC discussion to that thread. http://www.sevenforums.com/system-security/77736-lets-discuss-uac-here.html#post679883