UAC. Have you turned your's off?

vram said:

I would never suggest relying on UAC to keep a system clean. UAC is just an added layer of security that is used along with AV and a Firewall.

Argghh.....UAC was never designed to keep a system clean. It's effective purpose is to notify you, the admin, when something is happening which is effectively increasing your priviledge level to administrator. In and of itself, it does nothing to prevent something bad from happening. But if I happen to be using my computer, and some random program informs me that it wants to become admin and I'm not running that app...then I click on No to escalation and investigate what is going on. Other applications like AV, malware checkers and the like do not perform this function.

R A said:

I didn't need it with XP and I don't need it with Win 7 or Vista (at this time).

Yeah, but the majority of other users of Windows XP whose systems have been completely compromised (sometimes without the end-user having any idea)....probably do need this extra level of protection.

People yammer on and on about how much more secure that Linux and OSX is....and both of these systems have a security system similar to UAC. Of course, in both those cases, the user is not an admin and has to provide a password to go further. Microsoft started to implement these changes in their own systems after XP after getting so much egg on their face with all users having to be admins on the box. Whether so called "power users" want to believe it, steps like this are in the right direction to the overall security of the platform as a whole.

Argghh.....UAC was never designed to keep a system clean. It's effective purpose is to notify you, the admin, when something is happening which is effectively increasing your priviledge level to administrator. In and of itself, it does nothing to prevent something bad from happening. But if I happen to be using my computer, and some random program informs me that it wants to become admin and I'm not running that app...then I click on No to escalation and investigate what is going on. Other applications like AV, malware checkers and the like do not perform this function.

I think we have a bit of a misunderstanding here. I'm not saying that UAC by itself was designed to keep a system clean but is designed to keep the user informed and notify the user if a program tries to makes changes to your system, which too me places UAC in the security category. I agree with what you're saying and I apologize if my wording wasn't exactly as I intended however if I receive a UAC prompt and I click "No", am I not preventing the application from making changes?

pparks1 said:

People yammer on and on about how much more secure that Linux and OSX is....and both of these systems have a security system similar to UAC. Of course, in both those cases, the user is not an admin and has to provide a password to go further. Microsoft started to implement these changes in their own systems after XP after getting so much egg on their face with all users having to be admins on the box. Whether so called "power users" want to believe it, steps like this are in the right direction to the overall security of the platform as a whole.

The difference with Linux's "UAC" is that even when you create the first account at installation, you're not root. You're an admin, but admin isn't the highest class. Windows doesn't do this. If I login/operate as root, I can do whatever the hell I want; with Windows and UAC, even as an admin, I would still get prompts. Also, I feel like Linux prompts me for the root password less frequently than Windows does/would, and picks its prompting situations a little better.

esteban said:

The difference with Linux's "UAC" is that even when you create the first account at installation, you're not root. You're an admin, but admin isn't the highest class. Windows doesn't do this. If I login/operate as root, I can do whatever the hell I want; with Windows and UAC, even as an admin, I would still get prompts.

All of that is configurable (UAC policy settings). It's actually far preferable to set UAC to "always allow" (and thus be invisible) than to disable the UAC. Both are bad news from a security standpoint, but the former less so.

esteban said:

Also, I feel like Linux prompts me for the root password less frequently than Windows does/would, and picks its prompting situations a little better.

It's because Windows has 47 billion times more apps and they're not all particularly well written w.r.t. security, which means they more frequently attempt to rummage round areas of the file system and registry which they have no business inspecting and modifying, which in turn means the user gets prompted for elevation.

The user is the biggest difference between NIX and Windows in this instance. Most NIX users tend to be relatively knowledgeable folk, by definition (the platform itself repels a55-hattery). They wouldn't dream of browsing the web and doing all those daily tasks while logged on as root, and yet that's exactly what many of the Windows "experts" do all day every day.

Microsoft's main security problem is their heterogeneous userbase. It's difficult to convince the "experts" who always use admin accounts - frequently with UAC disabled - that they're not actually being all that clever.

From a security perspective, advising someone to turn UAC off is just plain dumb. It disables IE protected mode, and that is a big loss.

I've kept it, unless you want your pc to be about as secure as XP. Most users never implement proper security practices anyway, and thus rubbishware continues.