Let's discuss UAC here

[whs]

Space for UAC discussions.

 

[zzz2496]

Nice, now we can go all out about UAC

The part where I think UAC is *weird* is the "virtualization", why virtualize if you can just tell the user to use a standard user, and upon installation, ask for "Administrator password". Everything that has to do with system maintenance should ask that password, no more checks... Like now, everything that's "super user stamped", if you want to use it, it will throw a dialog box, put in the password, that'll simplify things quite a lot... With current implementation, a super user is virtually limited by UAC to prevent bad things... why not just tell the user to create standard user...

zzz2496

 

[pparks1]

Ok, I'll clear things up...

You will need at least one "Administrator", this is according to "Control Panel -> User Accounts". Then you create one "Standard User" for day to day use. Disable UAC, restart the computer.

Note: This is for those who knows what they're doing. Regular user, stick to Microsoft way (UAC + all those overheads, slower but that's how MS created it), bad things happens when you do the right way... good things happen when you use Microsoft way.... Remember, though Windows Vista and 7 is closing the gap between a real multi user OS (*nix) and Windows, still... Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try.

zzz2496

Ok, as per your suggestions, I tried creating a standard level user account. They are simply in the Users group and not in the admins group. And UAC is disabled and the computer has been restarted.

The problem as I see it here, is that you can get into various things (like adding a new user), but it then fails to complete the step at the very end. So, it's a bit frustrating that you don't know ahead of time that what you are trying is not going to work.

In addition, you can still right click on things...like Malwarebytes for example...and choose Run as Admin. it seems to go right in, but yet features like updating the software are grayed out and cannot be used. There doesn't appear to be any "Run As" in the right click context menu which might prompt instead for a username/password combination for an admin level account. What am I missing???


Edit: Oh yeah, I'm going to time test on my Win64 Enterprise box at work tomorrow and see if I can see a noticeable difference launching some of these UAC protected areas. I'll be sure to post results in this thread.

 

[AussieGuy92]

UAC is good i think it adds a extra layer of protection but it is not for all but it is recconmended to keep it on.

 

[zzz2496]

Ok, I'll clear things up...

You will need at least one "Administrator", this is according to "Control Panel -> User Accounts". Then you create one "Standard User" for day to day use. Disable UAC, restart the computer.

Note: This is for those who knows what they're doing. Regular user, stick to Microsoft way (UAC + all those overheads, slower but that's how MS created it), bad things happens when you do the right way... good things happen when you use Microsoft way.... Remember, though Windows Vista and 7 is closing the gap between a real multi user OS (*nix) and Windows, still... Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try.

zzz2496

Ok, as per your suggestions, I tried creating a standard level user account. They are simply in the Users group and not in the admins group. And UAC is disabled and the computer has been restarted.

The problem as I see it here, is that you can get into various things (like adding a new user), but it then fails to complete the step at the very end. So, it's a bit frustrating that you don't know ahead of time that what you are trying is not going to work.

In addition, you can still right click on things...like Malwarebytes for example...and choose Run as Admin. it seems to go right in, but yet features like updating the software are grayed out and cannot be used. There doesn't appear to be any "Run As" in the right click context menu which might prompt instead for a username/password combination for an admin level account. What am I missing???


Edit: Oh yeah, I'm going to time test on my Win64 Enterprise box at work tomorrow and see if I can see a noticeable difference launching some of these UAC protected areas. I'll be sure to post results in this thread.

As I said earlier, "...Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try....", even Windows 7 still have it's legacy lineage with it... In a true multi user OS, such as Linux/UNIX, regular/limited/standard user can't even invoke the "adduser" command, or open add user dialog in this case. This kind of things is what I meant, the ones that will bark at you from time to time. If you're the administrator, it will succeed normally, yet if you're a standard user, it will fail as predicted (non admins can't create users, that's a fact...).

If you want to run as a different user, hold shift then right click the program you want to run, the menu entry will show up (there's a guide in this forum for that, made by Brink). But since this is Windows we're talking about, there will be some weird/strange/stupid behavior lurking in the shadows... For instance, you can run an installer as another user, and that app will finish and installed normally, but for some weird reason... you can't run explorer as another user and have it running concurrently with your own explorer process... which is just plain dumb. But that's not what I'm trying to achieve here, by using a limited user, you your self can't deliberately destroy your system (unless you provide a password and run a 3rd party file manager). IE's bug, whatever it is, if it succeed to take over your IE process, it will still run as your limited user, thus will have limited access to the whole system, minimizing damage at cost of your ease of system administration, well worth the hassle IMHO. If you use UAC, with whatever bug it has, your user (assuming that you're an administrator that's running as a virtually limited user) is still an admin. If the malware have the ability to invoke some bug in UAC to auto elevate, there goes your UAC protection... (not to mention the processing cost of that protection...). Is it completely unsafe? No, but IMHO it doesn't "click".

Trying to limit a super user is wrong. You need to start with Limited user. If you're restricted in doing things in the system, live with it, it's limited user after all - you have to accept it and find your ways around it. This is Windows we're talking about, a single user OS trying to be a multi user OS. From a technical stand point, NT kernel is multi user aware/capable, but from usage model standpoint, Windows is still single user focused. For day to day usage, Limited user is VERY SUFFICIENT and not to mention VERY SAFE. If you want to create a user or do a quick system administration, use Fast user switching. I assume the computer administrator account will be so barren, it will load like a cat splashed with boiling water... In Linux/UNIX, you can always invoke "sudo" or "su" (and their GUI equivalent for fast administration), too bad Windows's equivalent isn't behaving as expected... I suppose it's a "security feature"...

zzz2496

 

[pparks1]

As I said earlier, "...Windows still have it's bad legacy with it, it will "bark" at you from time to time. If you know your ways around Windows, feel free to try....", even Windows 7 still have it's legacy lineage with it... In a true multi user OS, such as Linux/UNIX, regular/limited/standard user can't even invoke the "adduser" command, or open add user dialog in this case. This kind of things is what I meant, the ones that will bark at you from time to time. If you're the administrator, it will succeed normally, yet if you're a standard user, it will fail as predicted (non admins can't create users, that's a fact...).

In a case such as Adding a User...I would much prefer that Windows bark a lot louder when I'm a standard user and make it very obvious that I won't be able to perform that task without having admin access. I'm an admin for a living, so I understand that you cannot do this...but it really stinks to go through all of the dialog boxes and get to the end only to have the system say "access is denied".

If you want to run as a different user, hold shift then right click the program you want to run, the menu entry will show up (there's a guide in this forum for that, made by Brink).

Thanks...that was the point that I was missing. Holding the shift key.

Trying to limit a super user is wrong. You need to start with Limited user. If you're restricted in doing things in the system, live with it, it's limited user after all - you have to accept it and find your ways around it. This is Windows we're talking about, a single user OS trying to be a multi user OS.

I agree. With my Linux boxes, I typically never log on with root..but rather with my everyday account and su only when necessary. For everything else, I set up the sudo system. And I'm a Ubuntu desktop user..so I'm quite used to the sudo way of doing things. I often shake my head when the new users of Ubuntu want to immediately get rid of sudo and instead setup and use a root account.

If you want to create a user or do a quick system administration, use Fast user switching.

Never really been able to utilize this as my Windows boxes are all on domains. Being an admin for a living, means that I usually run a domain at home as well for experimenting and testing.

 

[CarlTR6]

I am one of those users for whom MS came up with this system. I run routinely in an administrator account. I like this level of protection that UAC offers. I am also careful and pay attention to what I am doing. In all my years with XP, I never had a virus nor any kind of malware.

UAC can be annoying especially if you are used to a true administrator level account. However, I don't see any difference in time spent dealing with the UAC pop up versus a pop up prompt to enter a password. In fact, for me, UAC is quicker to deal with.

In these days of drive by downloads and identity theft, I think the UAC is good thing especially for less informed users. Could I get by without it? Sure I did so for years using Win 98 and XP with no ill effects. But I like to think I am an informed user who avoids questionable sites and is careful about clicking on links and opening email.

 

[zzz2496]

Let's make a list and give it to Microsoft, shall we? Tell them to make a "real" multi user OS and have the usage model reflect it as such, and tell them to dump UAC, it's expensive, complicated, and IMHO close to useless if the concept of multi user executed properly.

In "Domain Enabled" network situation, things go VERY DIFFERENTLY than in single host mode. I assume the "Domain" doesn't change much since W2K/3 (I have MCP for MS Server products, so I more or less know my way around). In a Domain situation, the host will ask everything concerning security to the Domain controller, and that results in fast user switching service-related disablement. Maybe MS thinks that in a Domain situation, one host = one user... I never had this limitation on Linux/AIX . If only Linux in Desktop world is as good as Linux in Server world... :'(

zzz2496

Edit: woops, looks like I was a little bit too late in posting...

 

[zzz2496]

I am one of those users for whom MS came up with this system. I run routinely in an administrator account. I like this level of protection that UAC offers. I am also careful and pay attention to what I am doing. In all my years with XP, I never had a virus nor any kind of malware.

UAC can be annoying especially if you are used to a true administrator level account. However, I don't see any difference in time spent dealing with the UAC pop up versus a pop up prompt to enter a password. In fact, for me, UAC is quicker to deal with.

In these days of drive by downloads and identity theft, I think the UAC is good thing especially for less informed users. Could I get by without it? Sure I did so for years using Win 98 and XP with no ill effects. But I like to think I am an informed user who avoids questionable sites and is careful about clicking on links and opening email.

Agreed. But I still stand by my opinion... Microsoft should just use similar model what Ubuntu/MacOS X/Linux in general use. Everything that's system related should pop up a username/password dialog. A malware can easily fill those boxes, but it's much harder to exploit than say, a bug in UAC subsystem (UAC is complex, complex software tend to have bugs) that will invoke auto elevate which is VERY DANGEROUS, since you are an Admin that's "shrouded" by UAC... And I just tried re-enabling UAC just now... Maybe it's related to I don't know how many Windows updates occurred in several months, UAC dim screen shows up a bit faster this time, but still no where near no UAC performance.

zzz2496

 

[pparks1]

Ok, after running through a test in our last thread ( the one we hijacked), it was noted that I was using Windows 7 32-bit before and Windows 7 64-bit would tell a different story.

Here was the test that I performed. On my desktop (Intel Core 2 Duo E8400 at 3.00Ghz with 4GB of RAM running Windows 64-bit Ultimate), I turned off the machine. I started my stop watch from the time that I hit the power button. I waited until exactly 2 minutes before I clicked on the Start Orb, then right clicked on My Computer and choose Manage. This gave the machine time to boot and get services started etc. I then ran the test 3 times with UAC on and 3 times with it off. Here are the results averaged.

Avg time with UAC enabled : 2:08.16
Avg time with UAC turned off: 2:07.33

So, while there is a small difference (less than 1 hundredth of 1%)..this could come from my inability to start instantly at the 2:00 mark and navigate perfectly with my mouse to perform exactly the same steps. Either way, I cannot classify what I am seeing as "night and day difference".

So, I stand by my original opinion that while the UAC system might not be perfect in it's design, it's not likely adding any additional overhead that a typical system is not able to overcome.

 

[CarlTR6]

That certainly is not enough difference to convince me to disable UAC.

 

[zzz2496]

Ok, after running through a test in our last thread ( the one we hijacked), it was noted that I was using Windows 7 32-bit before and Windows 7 64-bit would tell a different story.

Here was the test that I performed. On my desktop (Intel Core 2 Duo E8400 at 3.00Ghz with 4GB of RAM running Windows 64-bit Ultimate), I turned off the machine. I started my stop watch from the time that I hit the power button. I waited until exactly 2 minutes before I clicked on the Start Orb, then right clicked on My Computer and choose Manage. This gave the machine time to boot and get services started etc. I then ran the test 3 times with UAC on and 3 times with it off. Here are the results averaged.

Avg time with UAC enabled : 2:08.16
Avg time with UAC turned off: 2:07.33

So, while there is a small difference (less than 1 hundredth of 1%)..this could come from my inability to start instantly at the 2:00 mark and navigate perfectly with my mouse to perform exactly the same steps. Either way, I cannot classify what I am seeing as "night and day difference".

So, I stand by my original opinion that while the UAC system might not be perfect in it's design, it's not likely adding any additional overhead that a typical system is not able to overcome.

Hmm... I can't say anything, on my computer (with my workload) enabling UAC does slow things down somewhat... I mean, it's not slow - slow... it's just if I hit [windows+e] to open explorer, without UAC it just springs out, no delays. With UAC on, it took maybe around a second, maybe less, but there's a slight delay. When I work, I tend to click explorer jump start list like crazy, so having a slight delay and no delay really means something to me. It's like those who're accustomed with gaming mouse (very sensitive in sense of tracking, not pointer speed) will almost always curse like crazy when forced to use an el cheapo wireless mouse (which both have a slight delay on slight movement, and overall "smoothness" of the pointer motion).

zzz2496

 

[pparks1]

On my computer, disabling UAC made my computer much faster, it's like night and day...

Hmm... I can't say anything, on my computer (with my workload) enabling UAC does slow things down somewhat... I mean, it's not slow - slow... it's just if I hit [windows+e] to open explorer, without UAC it just springs out, no delays. With UAC on, it took maybe around a second, maybe less, but there's a slight delay.

This is EXACTLY the reason that i like to put a stopwatch against these types of claims. For somebody reading the original post, they are expecting a massive Night to Day difference when they disable UAC. However, now that night and day difference is only a "slight delay" from the same poster.

zzz2496: I truly think your perceived performance issues are the result of system load and other factors impacting your launch speeds. I don't believe it's the UAC system hogging resources whatsoever. My launch speeds of Windows Explorer using WinKey+E on my 32 and 64 bit versions of Windows 7 appear to be identical with or without UAC.

 

[zzz2496]

Just restarted, I re-enabled UAC back to default settings (for the second time today), I absolutely notice the slight delay upon opening explorer, and there's a delay from my computer-> manage -----14.6 seconds -----> Computer management window showed up. Device manager took approximately same time ~15secs, Resource Monitor also took more or less the same time. Everything that needs elevation will have a standard delay of around 15 seconds, may it be an elevated command prompt, device manager, computer management, resource monitor, show processes from all users in task manager, everything... sigh...

For now, I only see that "consent.exe" is the one that holds the whole loading process down... I don't know, and I don't like it, thus another restart to disable UAC after this...

zzz2496

edit: Thank god I didn't imagine things...

 

[pparks1]

Just restarted, I re-enabled UAC back to default settings (for the second time today), I absolutely notice the slight delay upon opening explorer, and there's a delay from my computer-> manage -----14.6 seconds -----> Computer management window showed up. Device manager took approximately same time ~15secs, Resource Monitor also took more or less the same time. Everything that needs elevation will have a standard delay of around 15 seconds, may it be an elevated command prompt, device manager, computer management, resource monitor, show processes from all users in task manager, everything... sigh...

But what level of delay are you seeing doing these exact same things without UAC enabled?

On my work computer, the E6400 running 64-bit...here are my measured times for these tasks with UAC enabled at default level, doing all of these in this order from a fresh reboot

1). Winkey+E: 0.85 seconds
2). Right Click My Computer, Manage: 5.31 seconds
3). From Control Panel, Systems and Security, Device Manager: 2.62 seconds for all hardware to show up
4). From Task Manager, Performance, Resource Monitor: 2.52 seconds for all processes to appear
5). From Task Manager, Processes, Show Processes from All Users: 0.85 seconds
6). Elevated command prompt: Right click, run as admin: 1.5 seconds with me clicking on OK.
7). Winkey+E: Fastest I have been able to stop stopwatch is 0.22 seconds. It's pretty much instant.

So, I cannot explain why you are seeing 15 second delays in these tasks. As you can see, I'm only seeing 5 seconds at most and often less then 3 seconds for any of those tasks with the UAC system on.

 

[zzz2496]

Just logged in, UAC disabled, everything that needs elevation starts at less than 3 secs. Even clicking the "Speaker" icon in taskbar shows without any delay when UAC disabled, when UAC enabled, it took a slight delay, not very long, but there's a delay there. Does it conflict with any of my drivers? or with some service I have up and running? I don't know, I don't care, all I care is when UAC on, it's delaying things... I don't like delays, so I killed UAC, simple.

zzz2496

 

[zzz2496]

Just restarted, I re-enabled UAC back to default settings (for the second time today), I absolutely notice the slight delay upon opening explorer, and there's a delay from my computer-> manage -----14.6 seconds -----> Computer management window showed up. Device manager took approximately same time ~15secs, Resource Monitor also took more or less the same time. Everything that needs elevation will have a standard delay of around 15 seconds, may it be an elevated command prompt, device manager, computer management, resource monitor, show processes from all users in task manager, everything... sigh...

But what level of delay are you seeing doing these exact same things without UAC enabled?

On my work computer, the E6400 running 64-bit...here are my measured times for these tasks with UAC enabled at default level, doing all of these in this order from a fresh reboot

1). Winkey+E: 0.85 seconds
2). Right Click My Computer, Manage: 5.31 seconds
3). From Control Panel, Systems and Security, Task Manager: 2.62 seconds for all hardware to show up
4). From Task Manager, Performance, Resource Monitor: 2.52 seconds for all processes to appear
5). From Task Manager, Processes, Show Processes from All Users: 0.85 seconds
6). Elevated command prompt: Right click, run as admin: 1.5 seconds with me clicking on OK.
7). Winkey+E: Fastest I have been able to stop stopwatch is 0.22 seconds. It's pretty much instant.

So, I cannot explain why you are seeing 15 second delays in these tasks. As you can see, I'm only seeing 5 seconds at most and often less then 3 seconds for any of those tasks with the UAC system on.

Probably consent.exe dislikes some of my services/drivers/whatever, I don't know. Everything that needs elevation will consume almost flat 15 secs (give or take one second).

Edit: confirmed, without UAC:
1. right click my comp -> manage ---- 2.3 secs ---> window showed up
2. Resource monitor --> 1.7 secs
3. Device manager --> 1.3 secs

 

[pparks1]

Does it conflict with any of my drivers? or with some service I have up and running? I don't know, I don't care, all I care is when UAC on, it's delaying things... I don't like delays, so I killed UAC, simple.

That is fair enough, if it's better for you without it...by all means...turn it off. But I don't recommend to most others that this will improve their performance as it's nill for me and many other users.

Edit: confirmed, without UAC:
1. right click my comp -> manage ---- 2.3 secs ---> window showed up
2. Resource monitor --> 1.7 secs
3. Device manager --> 1.3 secs

I went in on my E8400 64-bit desktop, turned off UAC and tried all 3 things that you list
1). Right click My Computer, manage: 4.80 seconds --> window showed up
2). Resource monitor: 1.24 seconds for window, 3.1 seconds for processees
3). Device Manager: 1.6 seconds

So, your box is even faster than mine for all 3 tasks with UAC disabled. For reference with UAC enabled, timing again I get
1). Right click My Computer, manage: 4.87 seconds --> window showed up
2). Resource monitor: 1.20 seconds for window, 3.08 seconds for processees
3). Device Manager: 1.78 seconds

 

[zzz2496]

Yeah, well... disabling UAC made everything fast again. Note: there was no "slow down" per-se, but whenever I start anything that needs UAC confirmation, or UAC check (everything with yellow/blue shield) will delay quite a somewhat (~15 secs for crying out loud). I use the admin user for day-to-day use, and use "run as" for "suspicious" apps. Sometimes if I really concerned, I logged in (using fast user switching) to a standard user, and do whatever I need to do there, while my admin user still logged in...

zzz2496

Edit: There's a reason for people to generate MD5/SHA1 hashes for their installer/apps... So that you can trust it...

 

[pparks1]

whenever I start anything that needs UAC confirmation, or UAC check (everything with yellow/blue shield) will delay quite a somewhat (~15 secs for crying out loud).

Well, in your case there is clearly an issue somewhere. I'm not seeing 15 second delays clicking on anything which has a shield attached to to it. I've worked with numerous computers in our office which I have put Windows 7 onto and they don't see long delays launching things noted by the blue and yellow shield.

I personally hate it when I have problems like this, I drive myself nuts trying to figure out why it is happening. Had a peculiar problem when I built my machine and my Seagate 7200.12 hard drive would benchmark on all apps in the 25-40ms range in my new box. However, other hard drives scored just fine in my new box....(12-15ms). And the Seagate 7200.12 scored just fine (12.3ms) on my other machine/motherboard. I tried everything (BIOS updates, new cables, different drivers, different ports, different BIOS settings, different OS's, etc). No matter what I did, the 7200.12 was slow in my new box. So, I just upgraded my Linux machine to the 7200.12 and put a WD Caviar Black into my new box.