is it bad to turn off user account control?

[Chris K]

Best security is a tip i picked up for any version Windows

Most people make themselves Administrator with full privileges and consequently most vulnerable people on the internet - that falls into the realm of totally obvious (and bit stupid) and so you've prolly just realised whats coming

Create Administrator account for installations only

Create Your own account as 'user' only - you can play anywhere you like with full knowledge that your PC is pretty bulletproof - nothing can be installed on your PC in the background - to install anything you will have to switch accounts

Dont need no UAC - never have done

 

[CarlTR6]

The simple fact is,, UAC can and does prevent programs from running that require Admin rights.
Plain and simple,, stupid idea or not, it's a fact. You have said it yourself that, that is what it does.

So, to get back on full topic of,,,,
Should anyone turn off UAC or not?

As it works the way it is intended and it does work.
The answer is No, you should not.

What one does in reality is their own business. And not my problem, till they start complaining about getting infected or having other issues and you find out that it might have been preventable, but they disabled a tool that could have saved them the grief in the long run. My answer will always be,, plain and simple, because it does what it is supposed to do,, run as standard user with UAC enabled. Is it the best perfect all around wonderful god like utility that we hope and wish it would be? No. But, it's not a useless tool either as long as people pay attention to why it is popping.

This is a controversy that will go down in the annals of all that is MS, just as activating XP did back in the day, just as Run with no page file or what, still is today (even though it's has been proven time and again that it is best to run with MS recommended page file sizes regardless of how much ram you have installed).

So, why do I say run with UAC is my standard answer?

Because, I know people, and the largest majority of people asking this question, do not know what they are really doing, are not really all that safe of surfers or stewards of their own security. I also am not here to tell anyone how to run their own system or protect them from themselves. That's not my intention, nor my job, and frankly speaking, I don't want anyone forcing it on me. But, we also all (as techs, or more experienced users) provide the (not sure how to put this) ,, best answers, not always as we ourselves run our system but how a system is intended to run, to the best of our knowledge. Giving security advice that works for us, is not something that always works for everyone else. Spitting out some of the answers I have seen in this thread, many are well, irresponsible. Bad Advice.

Putting even more simply, and which may become my standard answer to this particular question is...

Q. Should one turn off UAC or not?

A. If you have to ask that question, then No, you Should not turn off UAC.

Actually, I'll make that part of my sig.

Excellent post; well stated.

 

[windows7theme]

You know. One of the things that people complained about the most was how Not Secure XP was.
Then they (MS) implement something that actually does make the OS more secure, and be more like linux in how is handles the way applications run, and people turn it off. It's not a smart move.

No, UAC should not be turned off
Yes, you should run as a user and not as an admin

Turning off UAC and running as admin are just not a smart thing to do.
Regardless of how safe you think you are when running Your system, blah blah blah.

It's just my opinion, yeah, but it's the right one.

++

I would also agree. Why would you remove UAC when it makes the system so secure. I personally believe that if you have UAC on then even a normal security suite like MSE is more than enough. Anyways if a person in running in admin mode then it takes just a second to click on the ok and that too for programs which gets access to core Windows files. I personally would also not recommend turning off UAC. A second used in clicking ok is not a big sacrifice for security. Windows tried to make nearly a complete operating system in all aspects with looks, features and security all included in Windows 7. But I still see a lot of people who are ready to change core system files and to to turn off safety features for small things. And when there are any security problems the people who mess up the system the most are normally the ones who makes the most noises too later on.

 

[malexous]

Create Your own account as 'user' only - you can play anywhere you like with full knowledge that your PC is pretty bulletproof - nothing can be installed on your PC in the background - to install anything you will have to switch accounts

LUA doesn't stop malware from running and stealing your data. It just prevents them from embedding into your system.

 

[Chris K]

Create Your own account as 'user' only - you can play anywhere you like with full knowledge that your PC is pretty bulletproof - nothing can be installed on your PC in the background - to install anything you will have to switch accounts

LUA doesn't stop malware from running and stealing your data. It just prevents them from embedding into your system.

If you use it as I suggested then malware (or anything) cant install if you're using Standard User Account

It can only run if you've already installed it (via Admin account) - but UAC wont plug that either

 

[Tepid]

but UAC wont plug that either

Not completely, no, but it can help. Again, UAC is not an end all be all security measure, but it is a layer.
Not a perfect layer, but, but it is a layer that does work.

Is it going to fully prevent everything from getting in? No.
But it is an early warning system in many cases. Which is what it was designed for.

 

[malexous]

Re: LUA. What about exploits and drive-by downloads?

Drive-By Download Attacks NOT Deterred by Limited User Account (LUA)

 

[Chris K]

but UAC wont plug that either

Not completely, no, but it can help. .

As can using "User account" not Admin account - so we're back where i started - you dont need UAC at all - you just need User Account for day-2-day use and Admin account for installing ONLY

 

[zzz2496]

Whew, this thread is getting quite complicated...

LUA won't save you from infection, just like UAC. UAC will prompt you if something wants to install and appropriately an install will need administrative privilege, in a sense UAC will help you NOT get the infection... but by using LUA, you WON'T even be able to install... in a way it's MUCH SAFER than UAC. For those virus/malware that doesn't need "installation" process, if it successfully install it self to the computer, it will only be able to wreak havoc in the current user's files. It can't go deep into Windows's core system per-say (like to install a service, install rootkit, or anything needing admin privilege), so a quick scan from a separate account (preferably with admin privilege) will suffice.

All in all, LUA in a way is MUCH SAFER than UAC, IMHO. How many of Windows users do use LUA? UAC + LUA is moot (most of the time), since UAC strips admin off it's admin powers, LUA is not admin, so UAC isn't exactly working in LUA.

Short summary: LUA is better than UAC, UAC + LUA = moot.

zzz2496

 

[Tepid]

but UAC wont plug that either

Not completely, no, but it can help. .

As can using "User account" not Admin account - so we're back where i started - you dont need UAC at all - you just need User Account for day-2-day use and Admin account for installing ONLY

Don't get me wrong, I do agree with that. Could UAC be disabled if you are using a LUA? Technically, Yes.

But,, keep in mind that LUA with UAC provides for Credentials prompting.
You must provide an admin password before the action that requires it will actually install or execute. This is a much more desirable action in all situations.

This is the exact reason why I state, use Standard User with UAC enabled.
Far better protection in my opinion. And the way Win 7 is meant to be used.

 

[Chris K]

.....UAC will prompt you if something wants to install and appropriately an install will need administrative privilege, in a sense UAC will help you NOT get the infection... but by using LUA, you WON'T even be able to install... in a way it's MUCH SAFER than UAC. ....

Indeed - my point in nut shell

I'm not suggesting switching off UAC (i think it's redundant) - just saying that ever since XP, all you need to do is run day-2-day on a 'user only account' and you wont/cant have problem - you haven't given yourself enough permission

 

[malexous]

you can play anywhere you like with full knowledge that your PC is pretty bulletproof

At least, you didn't claim it is completely bulletproof.

It's not and you shouldn't just play anywhere.

 

[Chris K]

you can play anywhere you like with full knowledge that your PC is pretty bulletproof

At least, you didn't claim it is completely bulletproof.

It's not and you shouldn't just play anywhere.

It is pretty bullet proof, and you can play anywhere whilst you're logged in as user only

Only thing you are suseptable to is what is already installed/infested your PC (you have executed as administrator)

 

[zzz2496]

**Sigh**... This is going too far, for those who want complete bulletproof computing, go use the "Guest" account, that will give you complete bulletproof computing.

zzz2496

 

[malexous]

**Sigh**... This is going too far, for those who want complete bulletproof computing, go use the "Guest" account, that will give you complete bulletproof computing.

zzz2496

Not according to Marco Giuliani. Is Limited User Account enough? Not really...

This dirty job can be done even from a guest account; even from there it is possible to intercept and log keystrokes.

 

[Faladu]

UAC and the 7 Firewall were 2 things I toasted immediately.
I use Winpatrol, Avast! Internet Security Suite (firewall/antivirus/malware/etc), and Boostspeed all the time.

Secondary apps used as needed, almost never: Spybot, Hijackthis (only as last resort, very dangerous app), Spyware Blaster, and Malwarebyte's Anti-Malware.

Other things to consider: HOSTS file manipulation (search on it)
Try this safer search page: startpage.com (you go through it when you click results, but can go direct if you want too)
WOT is a good add-on for site ratings/warnings.
I use Firefox primarily, with Opera as backup, have tried others, I always wind up back at Firefox, user since beta v.92 several years ago.

 

[pparks1]

It's better to use a real limited user account than to use a crippled admin account with lots and lots of UAC checkpoints.

It's just too bad that the average user is never going to go through that hassle. Thus, we have UAC which is a nice medium to fit a more typical Windows user.

The simple fact is,, UAC can and does prevent programs from running that require Admin rights.
Plain and simple,, stupid idea or not, it's a fact. You have said it yourself that, that is what it does.

So, to get back on full topic of,,,,
Should anyone turn off UAC or not?

As it works the way it is intended and it does work.
The answer is No, you should not.

What one does in reality is their own business. And not my problem, till they start complaining about getting infected or having other issues and you find out that it might have been preventable, but they disabled a tool that could have saved them the grief in the long run. My answer will always be,, plain and simple, because it does what it is supposed to do,, run as standard user with UAC enabled. Is it the best perfect all around wonderful god like utility that we hope and wish it would be? No. But, it's not a useless tool either as long as people pay attention to why it is popping.

This is a controversy that will go down in the annals of all that is MS, just as activating XP did back in the day, just as Run with no page file or what, still is today (even though it's has been proven time and again that it is best to run with MS recommended page file sizes regardless of how much ram you have installed).

So, why do I say run with UAC is my standard answer?

Because, I know people, and the largest majority of people asking this question, do not know what they are really doing, are not really all that safe of surfers or stewards of their own security. I also am not here to tell anyone how to run their own system or protect them from themselves. That's not my intention, nor my job, and frankly speaking, I don't want anyone forcing it on me. But, we also all (as techs, or more experienced users) provide the (not sure how to put this) ,, best answers, not always as we ourselves run our system but how a system is intended to run, to the best of our knowledge. Giving security advice that works for us, is not something that always works for everyone else. Spitting out some of the answers I have seen in this thread, many are well, irresponsible. Bad Advice.

Putting even more simply, and which may become my standard answer to this particular question is...

Q. Should one turn off UAC or not?

A. If you have to ask that question, then No, you Should not turn off UAC.

Actually, I'll make that part of my sig.

Nice post...I wanted to give you rep but I cannot at this point until i give others Rep.

This is the exact reason why I state, use Standard User with UAC enabled.
Far better protection in my opinion. And the way Win 7 is meant to be used.

I might just try going this route for a while on a box at work and see how things work out.

**Sigh**for those who want complete bulletproof computing,

For those people, just turn off your computers and find another hobby. Regardless of what you use and how you use it...there is no such thing as "bulletproff" where software and user interaction is intertwined.

 

[zzz2496]

...For those people, just turn off your computers and find another hobby. Regardless of what you use and how you use it...there is no such thing as "bulletproff" where software and user interaction is intertwined.

Ahh, yes... The on/off switch is the best solution for bulletproof computing...
... Particularly when it's on "OFF" position...

zzz2496

 

[zzz2496]

**Sigh**... This is going too far, for those who want complete bulletproof computing, go use the "Guest" account, that will give you complete bulletproof computing.

zzz2496

Not according to Marco Giuliani. Is Limited User Account enough? Not really...

This dirty job can be done even from a guest account; even from there it is possible to intercept and log keystrokes.

If you read that blog post, you should've understand that yes, the malware can still capture your keystrokes, BUT ONLY your keystrokes. If your wife logged in using her own user, her account won't have that nasty keylogger...

You should understand by now that LUA and Guest account can indeed limit the damage the malware/virus might cause. But in the case of Guest, you can set Windows to delete Guest account's account content upon log off (or was it not to save anything? I forgot), the point is, using Guest won't save anything...
Just like using browser in anonymous mode (dump or reject every cookie it receives).

As I said earlier, even IF you got an infection, the infection will run amok in your particular user ONLY. It won't be able to "destroy" Windows because it's running as a Limited user, your limited user account. It can't do anything as far as system destruction... Your files (documents, music, movies) might get "hit" by it, but you do have a backup of those files, right? It's much much muuuuch safer than using UAC IMHO. In a sense, yes you might caught an infection, but the infection is only affecting your limited user, and can't/won't be able to install a global service.

Again...

Here's the difference, let's say you got a keylogger installed (a malware) in your account. That keylogger will always run when you login, when your wife login (using her own LUA), her profile won't have that nasty keylogger... That is MUCH SAFER than you voluntarily clicked the UAC "OK" button because you need some crack to run some illegitimate app, and got your whole computer taken over (with LUA, only your user is hijacked, the system is safe).

I repeat, LUA + UAC = moot. As for security products (MSE, Avast, etc), it's common sense to use them in ANY KIND of Windows installation...

zzz2496

At the end, be careful: a standard LUA is really useful to avoid pc infections, but it is not enough by itself.

 

[malexous]

...

Create Your own account as 'user' only - you can play anywhere you like with full knowledge that your PC is pretty bulletproof - nothing can be installed on your PC in the background - to install anything you will have to switch accounts

LUA doesn't stop malware from running and stealing your data. It just prevents them from embedding into your system.

LUA doesn't stop all malware from doing harm. That's my point.