Creating a standard user account for security purposes?

[gregrocker]

Why would you even postulate that I don't really believe what I wrote? We don't tolerate bullying behavior here, but work collegially which is how this became the top tech forums on the web with a better reputation and more traffic than all others put together.

If your position is correct then it would have shown up in reports of infection at least once from a single one of the thousands if not millions we have helped install normally with an Admin Account.

Nevertheless we are eager to consider all points of view, including yours. You only detract from your case by pompous bullying after 20 posts.

I've asked our security specialists to weigh in here because this is where cases would show up reporting infection due to installing with the Win7 default Admin account. I can't remember a single case caused by this.

Of my own installs, the few which get chronically infected disregard UAC prompts anyway, requiring only Malwarebytes Real Time protection for a performance-based solution.

 

[Jacee]

I run my computer with UAC turned on. I have an Admin (password) account and my own 'user' account.

Why is User Account Control necessary?

 

[Arc]

I have only one account. That is the account created my the windows installation itself.

As I am the only user, never felt any necessity to create more accounts. I like the way it logs on directly

About issues, never faced any issue caused by user account settings.

 

[DavidE]

We don't tolerate bullying behavior here, but work collegially which is how this became the top tech forums on the web with a better reputation and more traffic than all others put together.

Hi Greg,

I don't see where Brandon138 has been bullying in this thread.
Brandon138 started this thread to ask a question, and created a well named thread imho.
Yes, he has posted many times, asking questions, answering, and giving what ever info and links to answer questions.

Isn't that what this site is all about, to help anyone/anytime/anyway whenever possible?
Many people (including myself) posted in this thread and have different opinions, beliefs, and experience.
I think that's great and we all can learn...
I haven't seen any convincing evidence/argument to make me change how I use my PCs.

Greg, I appreciate your (and MANY others) knowledge, experience, help in SF, as that's how I learn so much.
I just hope the OP or others doesn't get the wrong message and not ask a question to try and learn/fix/understand...

How does your opinion/advice compare to the answer from a Security Expert in a post #22 ?

 

[Arc]

David I think Greg meant somebody else, not the OP.

 

[DavidE]

Oh, my mistake then - Oops

 

[Arc]

Oh, my mistake then - Oops

Dont worry, David
_________________________________________________________________________________________________
We, the people who are posting here over a reasonably long time, we know each other .... we know others modus operandy, thoughts, beliefs, logic and rational. Those may be contradictory with those of mine, ours; but as the other person/s is doing it more than successfully over a reasonably long time, we should accept their stand too. Because, if somebody is successful by going against my way, I have to accept it that there are alternative ways which are equally good.

And, while choosing one way among the alternatives, if someone choose one that is simpler, there is no wrong with it. Things must not be complex all the times. User account and UAC is such a thing .... go with what you think better. But there is a simple option which also works good and tested.

Well, I cannot write long, and my logic is not very strong, but hope my message is understandable. Expressing my sincere apology if I hurt anybody by any chance, but ..... "united we stand, divided we fall".
Diversification is most welcome, but not division.

 

[gregrocker]

I'm still trying to wrap my head around the idea of how we would go about advising users to create a separate Standard account to run with, how dramatically that would diverge from anything we've ever suggested here - or anywhere else that's popular. MS may have the suggestion buried in a help page but has never advised it actively that I've seen. It isn't suggested at all in their forums.

When I write passionately about what's worked best here and then someone replies "If you even believe what you say...." I consider that bullying behavior, that's all. All opinions are valid here, but some have the luxury of "hit and run" while we who truly care are left with trying to apply possibly major changes to what's been advised here all along.

As a first step toward this yesterday I asked Shawn to take a look at this thread and comment if he felt we needed to reconsider the install regimens recommended here. He hasn't posted yet, which tells me what priority it is.

These threads have surfaced approximately once per year and have always concerned me about whether the very way we advise installing Win7 is truly Best Practice.

 

[Bluesan]

I'm still trying to wrap my head around the idea of how we would go about advising users to create a separate Standard account to run with, how dramatically that would diverge from anything we've ever suggested here - or anywhere else that's popular. MS may have the suggestion buried in a help page but has never advised it actively that I've seen. It isn't suggested at all in their forums.

When I write passionately about what's worked best here and then someone replies "If you even believe what you say...." I consider that bullying behavior, that's all. All opinions are valid here, but some have the luxury of "hit and run" while we who truly care are left with trying to apply possibly major changes to what's been advised here all along.

As a first step toward this yesterday I asked Shawn to take a look at this thread and comment if he felt we needed to reconsider the install regimens recommended here. He hasn't posted yet, which tells me what priority it is.

These threads have surfaced approximately once per year and have always concerned me about whether the very way we advise installing Win7 is truly Best Practice.

I mentioned yesterday that I didn't have anything more to contribute to this thread, but, you just don't seem to want to let this go, so, it begs a capstone comment from me to finally end my participation in this thread.

If you had bothered to notice, you would have seen that I've been a member of these forums for over three years. I visit often, but, don't have a lot to say in the form of comments. I only say something when I have something to say - post counts mean nothing to me, nor do I believe that they contribute to a perceived indication to others, that if I have a lot of posts, I must be an "expert".

It should be apparent to you, and others reading here, that I know my stuff when it comes to Windows security, and the funny thing is, Windows isn't even my primary operating system. That has been Linux for the past ten years.

I normally dual boot Linux and Windows operating systems, and regularly visit both partitions because I have interest in all things computers (and am truly a fan of Windows 7). I participant in several Windows and Linux forums, using a different name in each.

So this is very clear to you, please allow me to tell you, that I couldn't care less about how you set up your computers.

In your first post you said:

Others may have a different view which is equally as compelling.

I have a "different view", and I commented. Unfortunately, you seemed to have taken offense to that view because it was different than yours, and you fought it at every turn. Until I finally ran of out patience (and had something else to do), I answered all of your questions, and provided links in support of my comments, but, that still didn't seem to be enough.

So now, I'm a bully. OK, well, to that I simply say:

meh

 

[Arc]

No offense Bluesen, but what I notice that gregrocker's point against you is your comment in post #20. This one hurt him as I found, as it was going to be as a technical debate only.

if you really believe this to be true, you might want to petition Brink to modify his tutorial.

Expertise or otherwise cannot be judged on the basis of postcount, that is true. But, the question of postcount or expertise was not the point of the debate, the focus is a practice, and a debate about the viability of it.

Let us conclude that both the views are viable, and you have the liberty to choose your way? It is a fact that users use both the settings.

About expertise, some of us consider gregrocker as an expert, that is not for his postcount, but for what he have done and what he does. On the contrary, we are not aware of you, so have no idea about you. Please dont take it as our fault.

And now please close the case.

 

[LMiller7]

I don't think that Microsoft has ever changed their recommendation that running under a limited account is still the "best" security policy. But Microsoft also recognizes reality. They know from past experience that most home users do not use a limited account for general use and this is unlikely to change. Rightly or wrongly, most users perceived this as being too inconvenient.

When Vista was in the planning stages security was a growing problem. Microsoft knew that their best practice of using a limited account would improve security, but had been rejected my most users. So they devised a compromise. By default an admin account (which most people were using) had only the limited privileges of a standard account. But when needed the user could grand himself the full rights of an admin account. This provides most of the benefits of using a standard account but with less inconvenience. This feature is known as UAC and is the default configuration in Vista and later. It is not an ideal solution but that is the nature of a compromise.

For those individuals who do not find using a standard account as being too inconvenient, great.

But for the rest of us their is UAC which is almost as good. This is what Microsoft actively recommends, as opposed to the "best" policy of using a standard account.

 

[severedsolo]

So why does the Win7 installer install an Admin account for the assumed PC owner, without any choice or warning that this is not the Best Practice (if it is)?

Not really a valid argument... Why did XP let you run as an admin without ever warning you that you shouldn't do this other than a small note in the help file?

On the other hand, I am quite amazed that UAC isn't attacked more often. As turning off UAC doesn't trigger a UAC prompt it seems to me this would be a good attack vector for malware, as the user would be no idea they were no longer being protected and it could gain full admin rights? Or is this only when the user does it?

 

[Barman58]

The Windows Vista/7/8 Dual Token system is a microsoft compromise to increase security over the totally open and compromised system used with XP. XP was essentially a single desktop operating system, in an era when few home systems were attached to a network permanently. Network systems even in the XP era had standard user security but this was set-up and controlled by the server or a network admin.

Due to the virtualisation and permissions levels set up in a fresh install of Windows 7 running as a standard user is inherently safer for the system, than running as a XP style Admin account. A standard user account cannot action changes to system files or applications - therefore if and when a piece of malware takes control of a standard account it is only capable of limited damage.

As a system admin I always ran two accounts and would need to log-out of one account and back in as another to perform any critical system tasks, this of course then required logging out of the admin account and back in as a standard user after the changes

Using the dual token system gives the best of both worlds - you run as a standard user and when a call for an admin token is received the system isolates the critical systems, and prompts for a password in a separate process. on completion of the task the token is automatically reset, to a secure level

 

[LMiller7]

On the other hand, I am quite amazed that UAC isn't attacked more often. As turning off UAC doesn't trigger a UAC prompt it seems to me this would be a good attack vector for malware, as the user would be no idea they were no longer being protected and it could gain full admin rights? Or is this only when the user does it?

The registry values controlling UAC are in HKEY_LOCAL_MACHINE and require full admin rights to change. Any software having access to this key can already do anything it wants without further user permission. If that software is malicious you are already infected. Most malware likes to keep a low profile (at least initially) and doesn't wish to do anything to tip off the user that anything has changed.

Turning off UAC might have been useful for early types of malware. But modern varieties have no need for anything that crude.