What are the implications of disabling the UAC

[spiderplant0]

Hi, I'm getting sick and tired of the User Access Control popping up every time I launch some particular programs (plus its restrictions on editing of files). So I'm thinking of turning it off permanently.
I read Microsofts explanation of what the UAC does but I'm still unclear on the implications of turning it off. E.g. is it just a warning to the user or does it also protect you from programs doing things silently in the background. Also if I disable it will the equivalent of Windows XP protection on what programs are allowed to run still exist?
I'm not worried about the chance of me inadvertently corrupting my Windows installation (as I'll just restore if from a disk image). All I care about is a malicious program stealing my data or bank password.
Thanks.

 

[Darician]

Well UAC in tehory is supposed to protect you from programs running with full rights without your permissions and really, it does just that. If you disable it, it is sort of like a return to XP protection, which in reality isn't much and leaves you wide open to anything. Personally speaking, if I was going to disable UAC on all my Vista and 7 machines, I would have just stuck to XP because it wouldn't have been that much better.

But I have seen people running withou UAC and their machines are fine. If you know what you're doing, then you should have no issues.

 

[Petey7]

Is UAC really that annoying? It's just the need to click "yes" once in a while. Turning it off would allow you to change stuff you have no business messing with and allow programs to do what they want without permission. In some cases that won't happen. Instead, absolutely nothing will happen you will have no clue why when you try to do something, it just doesn't happen.

A little story from personal experience. One time a few months ago I was sitting near my computer while watching TV. A UAC warning popped up asking about some program I had never heard of. I click know and ran a scan with MSE. Sure enough it found a keylogger. If UAC is off, such a warning will not appear.

 

[DirtRider]

If you run a good AV it should pick this us anyway

 

[pparks1]

does it also protect you from programs doing things silently in the background.

Yes it does and is the primary reason that I leave it enabled. if an applications needs to escalate up to admin credentials, I want to know about it.

Also if I disable it will the equivalent of Windows XP protection on what programs are allowed to run still exist?

Yes, but Windows XP was terrible as far as security was concerned. Everything was done as an admin and hence the reason so many machines were compromised.

I'm not worried about the chance of me inadvertently corrupting my Windows installation (as I'll just restore if from a disk image). All I care about is a malicious program stealing my data or bank password.
Thanks.

Sounds like a good reason to keep running as many of the security features as you can.

 

[Darician]

I like to think of UAC as a safety net. Recently, I had a colleague who hated UAC and always disabled it. I actually explained to him the benefits and if it annoys him so much, to put it on "auto-pilot" though I didn't recommend it but to at least keep the protections on. Sure, for the most part most of us will not download a malicious program intentionally but there will always be that one time one will sneak past us and UAC is there to catch it.

 

[Borg 386]

Having the UAC enabled could save you some problems down the road. Yes it's annoying, but it's a minefield out there on the net, not all AV's catch everything.

It's added protection, and as Petey7 said, it can let you know if somethings trying to launch that you have no idea about. Same for what pparks1 said.

I would keep it on. PIA? Yes. Every layer of protection you can run on your PC? Well worth it.

 

[cluberti]

Not only that, but if you are getting constant UAC prompts (and running as an administrative account) in Win7, then I would have to ask what you are running that would be causing it. The only things that should trigger it are applications needing to write to protected registry locations like HKLM or HKCR, or protected folder locations like the Program Files or Windows directories - these sorts of things are considered "OK" by installers (which you would expect would trigger UAC, as they need the highest access possible), but if programs running everyday need these sorts of accesses, the problem is not UAC, it's the poorly-designed program itself. Only specific OS binaries for administration and installation or removal of apps should be triggering UAC, so if it's going off constantly I would perhaps consider the apps you're running might be due for replacement. You can disable it if you wish, as it's more a part of defense-in-depth rather than a true security mechanism in and of itself, but it *does* provide a (very good) layer of security. The choice is yours, but I would choose to leave it on if I were in your shoes.

 

[Petey7]

Another thing, I'm 99% sure, you will still have to run some programs as administrator even without UAC on.

 

[Barman58]

One other thing with UAC it is intrinsically linked with protected mode in IE8 - switching off UAC also removes a lot of the more advanced protection from Internet explorer.

IE may not be your 1st choice browser but almost everyone will find themselves reverting for particular sites

I'd rather have the better protection working on what is probably the most targeted browser for the malware writers

 

[MrBrian]

Also see http://www.sevenforums.com/system-security/92159-bad-turn-off-user-account-control.html.

 

[Petey7]

Also see http://www.sevenforums.com/system-security/92159-bad-turn-off-user-account-control.html.

Good God. I didn't think we had one that long, but the first page sums it up pretty well. People were complaining all the time that XP wasn't secure enough. MS adds something to make it more secure, and now everyone hates that. I've worked on a couple Vista machines, and I gotta say, even Vista's UAC does not annoy me, and almost everything causes it to pop up.

 

[FerchogtX]

Well... I have a particular view on UAC...

First of all, UAC is intended for "unexperienced users" that use windows... you know, the typical guy that just chats, check emails and post things on facebook... and does some stuff on office... this kind of user is not aware about system security or how to "keep himself secure" from attacks, so, to avoid that kind of infections -wich, at least in my country, are the MAIN reason why everyone has virus in their PC's- Microsoft decided to add this control... if you see this closely, is similar to the Linux kernel protections... when you run stuff with your own user, but you always need to invoke the "super user" to add programs, updates and stuff, so you need to give permission to Linux to contiue... UAC is based on that... Is new for many users because they were always on windows and never had to test a Linux enviornment... basically now you need to give permission to windows for doing "X" action, if you are unsure or you know that is not trusable, you can cancel any action before it harms your system.

If you think you have good protection (good anti-malware) and the sites you visit are secure, and you dont instal anything what you see... you can turn UAC off... anyway, I only recommend this for experienced users... you must know what you are doing.

Personally, I know what I do, but it doesn't botter me to have UAC on... if you think UAC is annoying, you never used Vista then... there IT WAS a pain in the a**... at least in 7 is quire reasonable how it works.

See ya!!

 

[MrBrian]

For those who don't want to read the large thread that I mentioned, here's my answer from that thread: http://www.sevenforums.com/system-security/92159-bad-turn-off-user-account-control-7.html#post800206.

 

[karlsnooks]

Spiderplant,

If you aren't connected to the Internet, then run that slider all of the way down.

If you are connected to the internet, then one step down from the top.

Reason being that sometimes the bad guys get a jump ahead of the anti-virus/anti-malware boys and the consequences could be very undesirable. It's a gamble. There are people who go up in an airplane just to jump out knowing full well that sometimes things go astray and they become only a memory.

 

[Barman58]

Anyone who thinks UAC is a lot of hassle should try working with systems, that require a 20+ character, random Generated, Strong Password, to access admin/root commands.

If you are running as a standard user as default and not using IE then I would accept that running without UAC is acceptable, but with reasonable password rules running this way would be likely to be more hassle, than the UAC prompts

No one will ever be advised by me to revert to the way the majority of home users ran XP, as a full admin with no other control.

 

[Borg 386]

Good God. I didn't think we had one that long, but the first page sums it up pretty well. People were complaining all the time that XP wasn't secure enough. MS adds something to make it more secure, and now everyone hates that. I've worked on a couple Vista machines, and I gotta say, even Vista's UAC does not annoy me, and almost everything causes it to pop up.

Don't you know Petey7.....no ones EVER satisfied...with anything...:roflmao:

 

[spiderplant0]

Hi, Thanks for all the replies. Sounds like I'll be reasonabley safe with UAC off (I'll turn it on again once I've figured out how to solve all the glitches).
In reply to cluberti, an example of the problems I'm having with the UAC: Using a program called gMapCreator, I get the error "java.io.FileOutputStream.open" when trying to save. Running as administrator doesnt help. Maybe its poor design that causing it to do this but I still need to use it. (I'll open another thread if I cant figure out how to eliminate this problem with the UAC on).
Thanks

 

[Wicca]

lets virus control your computer if infected

 

[pparks1]

First of all, UAC is intended for "unexperienced users" that use windows...

Well, I cannot say that I agree with this. I put myself far from the level of "unexperienced user" and I leave my UAC enabled. In fact, I configured my box using a limited user access account with UAC...so not only do I have to click ok, I also have to type in a username and password each time. Honestly, this only happens to me 2 or 3 times in any given day at work.

If you think you have good protection (good anti-malware) and the sites you visit are secure, and you dont instal anything what you see... you can turn UAC off... anyway, I only recommend this for experienced users... you must know what you are doing.

Sites that I visit on the web could be compromised, and a DNS attack could lead me to a bogus site. How could I ever be absolutely sure...even as a knowledgeable user. Same goes for the applications that I use, I do understand their intended purpose...but if I have an app that somehow wants escalated permissions, I certainly want to know about it.