Standard user vs. Administrator in Windows 7

[juice13610]

So we are a company stuck a few years in the past. We give all of our approximate 1,200 users (currently on XP Pro SP 2) admin rights because we have about 5 different computer models at any given time and have 5 images to maintain. With all of the software we have on our network and our limited IS staff (on the support side aside from server guys/network guys/etc, we have 3 service desk guys and 2 desktop support guys in our corporate office, and we have about 10 remote sites and only 5 of them have IS support, mostly with one person or one part-time person at each site), we just can't seem to find that magic bullet for just suddenly taking everyone's admin rights away or just suddenly stop shipping computers with admin rights. With Windows 7, I thought I had seen the light with UAC - ship users their computers with limited user accounts, and remote in to input administrator credentials to install all of their software for them. However, after lowering my UAC level to "Never notify," suddenly I can install Java, Roxio, etc...

So today I attended a 3 hour workshop on Windows 7 and the instructor told me that if you do not use Group Policy to disable the UAC "slider," then user's can install software and do anything else that they want to. That just doesn't sound right to me.

If that's not right, why am I able to install software on my PC as a regular user without inputting admin info?

 

[Zidane24]

So we are a company stuck a few years in the past. We give all of our approximate 1,200 users (currently on XP Pro SP 2) admin rights because we have about 5 different computer models at any given time and have 5 images to maintain. With all of the software we have on our network and our limited IS staff (on the support side aside from server guys/network guys/etc, we have 3 service desk guys and 2 desktop support guys in our corporate office, and we have about 10 remote sites and only 5 of them have IS support, mostly with one person or one part-time person at each site), we just can't seem to find that magic bullet for just suddenly taking everyone's admin rights away or just suddenly stop shipping computers with admin rights. With Windows 7, I thought I had seen the light with UAC - ship users their computers with limited user accounts, and remote in to input administrator credentials to install all of their software for them. However, after lowering my UAC level to "Never notify," suddenly I can install Java, Roxio, etc...

So today I attended a 3 hour workshop on Windows 7 and the instructor told me that if you do not use Group Policy to disable the UAC "slider," then user's can install software and do anything else that they want to. That just doesn't sound right to me.

If that's not right, why am I able to install software on my PC as a regular user without inputting admin info?

Your PC at work or at home...

Were you logged into a limited account when installing the software? If you are logged in as an Administrator than UAC will either notify you when an app is trying to access System files or needs to be elevated to access critical components...

 

[kegobeer]

To piggyback on Zidane's post - the first user created by Windows 7 is an administrator. I can change any settings I want, and the UAC prompt will not ask for a password. If I am logged on as a non-administrator, the UAC prompt will ask for the admin name and password. Just like in XP, if you do not have admin rights, you cannot install software that requires access to protected files and folders.

 

[juice13610]

Thanks for your responses.

The first user created was a local admin, just "Joey." I then joined the domain and started logging in with my domain account, and made my domain account a regular user. I dropped the slider to "never notify" and was able to install Roxio and Java.

Just to confirm that nothing else was awry, I tried changing date/time settings and accessing Device Manager. The date/time settings flat out denied me, and the DevMan just alerted me that while I can view it, I can't make any changes.

 

[kegobeer]

I haven't done enough research about domain and UAC to understand why a standard domain user has full access to UAC, when a non-domain machine standard user cannot change UAC settings. I guess you'll have to use the group policy editor to disable the UAC slider.