Relationship between standard user, administrator user and UAC

[Bob Coleman]

There has long been, and I guess still is, advice to use a standard user rather than administrator account to limit the things that can be done by malware. Until recently I've always used an administrator account despite this advice. After recently seeing a report stating that an extremely large percentage of vulnerabilities cannot be exploited on a standard user account, I started experimenting with using one.

Now, I somewhat frequently get a request for an administrator password. Supplying one causes, I guess, the operation being performed to be performed as if done by the administrator account. I think that if I were using an administrator account, the same actions would result in a UAC prompt to which I would have to respond in the affirmative to allow the action to occur.

My question is why is forcing myself to provide an administrator password safer than clicking Yes in a UAC prompt?

 

[LMiller7]

My question is why is forcing myself to provide an administrator password safer than clicking Yes in a UAC prompt?

Human nature.

UAC prompts have a serious problem that limits their usefulness. This isn't a technical problem and it isn't something that Microsoft can fix. Software designers have known for a long time that most people do not read error messages or warnings unless they are unexpected. They will make the warning go away by the most direct method possible so they can get on with their work. They quickly become conditioned to click on "OK" without even glancing at the what they are authorizing.

Requiring you to enter a password slows the process down so that you will, hopefully, have time to read the message know what you are saying yes to.

At least that is the way I see it.

 

[Bob Coleman]

Requiring you to enter a password slows the process down so that you will, hopefully, have time to read the message know what you are saying yes to.

Hmm, if that's really the only advantage, I think I'll go back to being an administrator and hope I'm smart enough to pay attention.

 

[LMiller7]

I didn't say it was the only advantage. But it is the only one I can easily describe.