Customizing User Account Control

ahstanford

New member
Local time
11:50 PM
Messages
32
Hello everyone,

I just purchased my first Windows 7 machine. I've got a few questions as to how I can customize UAC to perform as I need.

First, is there any way to disable User Account Control for a specific user (like myself) but leave it enabled for the other users (like my girlfriend and my mother)?

Also, is there any way to disable User Account Control for all users on specific applications? For example, I've got a few startup applications that require UAC approval - so I'm required to enter my password at startup for every standard user on the PC. I'd like to add an exemption for these applications, and a few others, to limit the unnecessary UAC prompts.

Thanks in advance,
Alex
 

My Computer

Computer Manufacturer/Model Number
Asus Essentio CM5571-BR003
OS
Windows 7 Home Premium
CPU
Intel Pentium Dual E5400 @ 2.7Ghz
Memory
6GB DDR3
Graphics Card(s)
Onboard Video
Monitor(s) Displays
24" Asus LCD
No, UAC is an all or nothing setting.

You should at minimum, leave it running at the default setting.
 

My Computer

Computer Manufacturer/Model Number
Self Built
OS
Win 7 Ultimate 32bit
CPU
C2D E6600 2.4Ghz
Motherboard
Intel D965WH
Memory
4G Kingston KHX5400D2
Graphics Card(s)
EVGA GTX 570 HD SC (012-P3-1573-KR)
Sound Card
On-Board
Monitor(s) Displays
Samsung 226BW
Screen Resolution
1680 x 1050
Hard Drives
2 x 250 Seagate Barracuda
2 x 500 Seagate Barracuda (Raid1)
PSU
Corsair TX750W
Case
In-Win C589
Cooling
Stock Intel Cooling
No, UAC is an all or nothing setting.

You should at minimum, leave it running at the default setting.

Actually in a way you are wrong.

First, is there any way to disable User Account Control for a specific user (like myself) but leave it enabled for the other users (like my girlfriend and my mother)?
Fortunately to you, Yes there is :)
http://www.sevenforums.com/tutorials/299-user-account-control-uac-change-notification-settings.html

Also, is there any way to disable User Account Control for all users on specific applications? For example, I've got a few startup applications that require UAC approval - so I'm required to enter my password at startup for every standard user on the PC. I'd like to add an exemption for these applications, and a few others, to limit the unnecessary UAC prompts.
Yes, it is possible aswell. :)
http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

Hope it will help you.
Enjoy ;)
 

My Computer

OS
Windows 7 Ultimate x86 SP1
Ok,, I forgot about the Scheduled Tasks trick.... but

UAC is not a per-user setting. It is set the same for all users.
 

My Computer

Computer Manufacturer/Model Number
Self Built
OS
Win 7 Ultimate 32bit
CPU
C2D E6600 2.4Ghz
Motherboard
Intel D965WH
Memory
4G Kingston KHX5400D2
Graphics Card(s)
EVGA GTX 570 HD SC (012-P3-1573-KR)
Sound Card
On-Board
Monitor(s) Displays
Samsung 226BW
Screen Resolution
1680 x 1050
Hard Drives
2 x 250 Seagate Barracuda
2 x 500 Seagate Barracuda (Raid1)
PSU
Corsair TX750W
Case
In-Win C589
Cooling
Stock Intel Cooling
No, UAC is an all or nothing setting.

You should at minimum, leave it running at the default setting.

Actually in a way you are wrong.

First, is there any way to disable User Account Control for a specific user (like myself) but leave it enabled for the other users (like my girlfriend and my mother)?
Fortunately to you, Yes there is :)
http://www.sevenforums.com/tutorials/299-user-account-control-uac-change-notification-settings.html

Also, is there any way to disable User Account Control for all users on specific applications? For example, I've got a few startup applications that require UAC approval - so I'm required to enter my password at startup for every standard user on the PC. I'd like to add an exemption for these applications, and a few others, to limit the unnecessary UAC prompts.
Yes, it is possible aswell. :)
http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

Hope it will help you.
Enjoy ;)

Jav,

Thanks for the help. I will be looking through these two links today, and will post back to let you know how they work for me.

Thanks again,
Alex
 

My Computer

Computer Manufacturer/Model Number
Asus Essentio CM5571-BR003
OS
Windows 7 Home Premium
CPU
Intel Pentium Dual E5400 @ 2.7Ghz
Memory
6GB DDR3
Graphics Card(s)
Onboard Video
Monitor(s) Displays
24" Asus LCD

My Computer

Computer Manufacturer/Model Number
Asus Essentio CM5571-BR003
OS
Windows 7 Home Premium
CPU
Intel Pentium Dual E5400 @ 2.7Ghz
Memory
6GB DDR3
Graphics Card(s)
Onboard Video
Monitor(s) Displays
24" Asus LCD
Also, is there any way to disable User Account Control for all users on specific applications? For example, I've got a few startup applications that require UAC approval - so I'm required to enter my password at startup for every standard user on the PC. I'd like to add an exemption for these applications, and a few others, to limit the unnecessary UAC prompts.
Yes, it is possible aswell. :)
http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

This seems to do what I need, but it uses a shortcut? You see, the particular task that I'm trying to allow access without interruption from UAC is set to startup at the logon of any user - not through the click of a Shortcut. I guess there is no way to achieve this?
 

My Computer

Computer Manufacturer/Model Number
Asus Essentio CM5571-BR003
OS
Windows 7 Home Premium
CPU
Intel Pentium Dual E5400 @ 2.7Ghz
Memory
6GB DDR3
Graphics Card(s)
Onboard Video
Monitor(s) Displays
24" Asus LCD
Setting a scheduled task should/may work
But you should be sure it is what you really want to do.

Any app that requires you to run it as an admin, should be fixed by the author.
No application should require admin rights to run on a daily basis.

I am sure there are a few, depending on what exactly the application does, but the largest majority should not.

And any app that specifically requires you to disable UAC to work, should never be used or purchased.
It means the company and programmers are too lazy to fix their software.
 

My Computer

Computer Manufacturer/Model Number
Self Built
OS
Win 7 Ultimate 32bit
CPU
C2D E6600 2.4Ghz
Motherboard
Intel D965WH
Memory
4G Kingston KHX5400D2
Graphics Card(s)
EVGA GTX 570 HD SC (012-P3-1573-KR)
Sound Card
On-Board
Monitor(s) Displays
Samsung 226BW
Screen Resolution
1680 x 1050
Hard Drives
2 x 250 Seagate Barracuda
2 x 500 Seagate Barracuda (Raid1)
PSU
Corsair TX750W
Case
In-Win C589
Cooling
Stock Intel Cooling
Setting a scheduled task should/may work
But you should be sure it is what you really want to do.

Any app that requires you to run it as an admin, should be fixed by the author.
No application should require admin rights to run on a daily basis.

I am sure there are a few, depending on what exactly the application does, but the largest majority should not.

And any app that specifically requires you to disable UAC to work, should never be used or purchased.
It means the company and programmers are too lazy to fix their software.

Tepid,

The software is a for power management, called EPU-4 Engine. It came with my computer, made by Asus.

I solved this be removing those application from startup on all of the standard user profiles.

Though I would still like to disable UAC for my user account (administrator account) and leave it enabled on the standard user accounts (my mother and my girlfriend). It seems this can't be done, so I suppose I'm going to stick with my current settings.

Alex
 

My Computer

Computer Manufacturer/Model Number
Asus Essentio CM5571-BR003
OS
Windows 7 Home Premium
CPU
Intel Pentium Dual E5400 @ 2.7Ghz
Memory
6GB DDR3
Graphics Card(s)
Onboard Video
Monitor(s) Displays
24" Asus LCD
Once the shortcut with Admin rights is created, you can put it in the Startup folder under All Programs and it will run at startup....
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ASUS G60-RBBX05
OS
Win7 Home Premium 64x
CPU
Intel Core 2 Duo P7450 / 2.13 GHz (2.29 with Extreme Turbo)
Memory
4 GB PC-6400 Hyundai (2X2) at 800Mhz
Graphics Card(s)
NVIDIA GeForce GTX 260M 1GB DDR3 VRAM
Monitor(s) Displays
16" LED Backlit
Screen Resolution
1366 x 768 on laptop 1600x1050 max res on 22" external mon
Hard Drives
OCZ Agility 3 60GB SSD / 320 GB - Serial ATA-150 - 7200 rpm
PSU
6-cell Lithium ion { lasts 1.5 hours }
Case
ASUS G60 Laptop
Keyboard
Chicklet type back-lit (white light) keyboard
Mouse
Logitech G9 Laser Mouse 3200dpi and 1000 reports per minute
Internet Speed
Comcast 8.60mb/s up - 3.11mb/s down
Antivirus
MSE
Browser
Firefox
Other Info
General mid-budget gaming Comp. Low batterylife - High FrameRates - currently overheating problems :(

2nd Rig: Case: Rosewill BLACKHAWK Gaming ATX Mid Tower Computer Case

Mobo: GIGABYTE GA-990FXA-UD3
CPU: AMD FX-6200 Zambezi 3.8GHz (4.1GHz Turbo)
Heatsink: COOLER MASTER V8 CPU Cooler
RAM: Patriot Viper 3 8GB (2 x 4GB) 240-Pin DDR3 SDRAM 1866 (PC3 15000)
GPU: SAPPHIRE Radeon HD 6850 1GB 2
I don't think this link shows anything about user-specific UAC settings.
Though I would still like to disable UAC for my user account (administrator account) and leave it enabled on the standard user accounts (my mother and my girlfriend). It seems this can't be done, so I suppose I'm going to stick with my current settings.

Does your mother or girlfriend have your password?
If they don't have your password and they don't use any tasks/programs which need Administrator privileges, then they don't really benefit from UAC at all.
In this case benefit from UAC is only for you.

before anybody starts to say something about last statement, let me explain UAC basics.. :sarc:

UAC (User Account Control) is just feature that controls user privilege tokens (what user can do).
Situation when is UAC on:
1. You log in with your Administrator account.
While logging in UAC gives you 2 user tokens (one administrative and one standard user) and makes standard user privilege as main token.
You see this (UAC) was one of the cleverest things Microsoft came up for Windows security.
The problem with windows is that almost EVERYBODY runs it as administarator (any other OS takes away that privilege from user)
Microsoft tried to encourage it's users to use Standard account, but there were only handful people who did. (and funny thing is that those people who haven't even considered Microsoft's advice, blamed the company for not doing anything for Windows security :sarc: )

So, Microsoft had to came up with something new and take away administrative privileges from average users. They created UAC.

If you remember I said that when you logged in with administrator account UAC gave you standard user privilege token as your main.
So basically, even if you are logged in with administrator account, you are using it as if you were standard user and have it's privileges.
And according to privilege inheritation, any process inheritates privileges of parent process, so everything you open will run as standard user.

But theoretically there will be problem when you try to do something which requires administrative privileges.
There comes UAC again :) when you try to do something that requires Administrative privileges UAC will come up and after getting confirmation from you (the user who has admin privileges), gives Administrative privilege token to that process.
So as you can see, from security point of view UAC was genius thing. It made administrator account into standard account and this way blocked lots of security flaws.

But UAC isn't perfect and Microsoft still encourages and wants average users to run as standard users.
But the probem is that many users don't want log off and log in to administrator account to do anything that requires administrative privileges.
So they creates fast switch, but even then people were lazy to do this.
2. So after this they implemented UAC into standard user aswell.
It works the same way as it does in Administor account.

But in this case it doesn't give you 2 tokens at the start as you don't have (you have only standard user privileges)
So you will work as standard user and if you need something that requires administrative privileges, It asks from users who has it (administrators). After confirmation from administrator (after you writing admin password) it "borrows" this admin privileges from that user and does that specific task from the name of the administrator who was confirmed with password.
So now, Standart user dosen't even need to log off to do administrative tasks... :party:

now, back to your topic.
1. If you family members don't use anything that requires administrative privilegs, or even when they want they can't use it (as they don't your password or any other admin password).
If this is your situation, as I already mentioned they don't benifit from UAC.
Why? because UAC for standard user is just to give Standard user to give fast way to get ("borrow") administrative privileges.
If you turn off UAC. They will be automatically denied from task that require admin privileges (task which will be asked by UAC if it was on)
So, from this point of view you can turn off UAC.

But then you (Administrator) will have administrator privileges token always!
So, just read through how UAC works again, and decide if it's worth it...

But if your family members know your password and do tasks which require admin privilegs then you can't turn off UAC. (if your turn offf it they will have to switch user/log off and log in with admin account to do those tasks.)
Hope it will help you! ;)

EDIT:
This is the right solution for your second problem
Once the shortcut with Admin rights is created, you can put it in the Startup folder under All Programs and it will run at startup....
 

My Computer

OS
Windows 7 Ultimate x86 SP1
Some things that I didn't mention, and/or forgot about.
That and I didn't grasp that you had them setup as a standard user,, that was my fault and I apologize.

If they are setup with an Admin account, and not a standard user account,,

when you turn off UAC, you are effectively an admin, not a standard user.
You are only a standard user when setup as a standard user.


So, you could actually set them up with Standard User Accounts, not admin accounts and then turn off UAC
They will still need Admin Rights to install or do many things that require admin rights.
When running as a Standard User, with UAC Disabled, No prompt will be given, you will need to Right Click the App or shortcut and select Run As and provide Admin Credentials, to run or install that particular app.

However, setup that way, with UAC enabled, you would have more control and be able to turn on Parental Controls, which provide a great deal of control over what can and can not be done on the system.

Additionally, you could also take advantage of AppLocker

AppLocker is a flexible, easily administered mechanism that enables IT professionals to specify exactly what is allowed to run on user desktops. It provides the flexibility to allow users to run the applications, installation programs, and scripts they need to be productive. Learn how you can realize the security, operational, and compliance benefits of application standardization by using AppLocker

And see this http://thelazyadmin.com/blogs/thelazyadmin/archive/2009/05/21/windows-7-app-locker.aspx

Either way,, it is not advised to disable UAC, due to it being able to warn you when anything is requiring admin rights to do anything. This is still a hot debate with positives and negatives on both sides. I advise leaving it on though.
 

My Computer

Computer Manufacturer/Model Number
Self Built
OS
Win 7 Ultimate 32bit
CPU
C2D E6600 2.4Ghz
Motherboard
Intel D965WH
Memory
4G Kingston KHX5400D2
Graphics Card(s)
EVGA GTX 570 HD SC (012-P3-1573-KR)
Sound Card
On-Board
Monitor(s) Displays
Samsung 226BW
Screen Resolution
1680 x 1050
Hard Drives
2 x 250 Seagate Barracuda
2 x 500 Seagate Barracuda (Raid1)
PSU
Corsair TX750W
Case
In-Win C589
Cooling
Stock Intel Cooling
Back
Top