User Account Control: Password Required?

[not so gray matter]

Is there a way to require a password whenever the UAC Box appears?

I'm wondering... Is there a way to force UAC to require a password anytime it pops up? I've been trying to increase security by using a non admin account, but that presents a problem. First of all, I can't use some programs due to inaccesible files. Not to mention I have to log into an admin account anytime that I want to do anything security related. I don't like to use the admin account because after the initial password, there is very little internal security other than a UAC box and even those are just Yes/No.

What I want seems to be a mix of the two, similar to the way user accounts work on OS X. Whenever I attempt to access something secure (ie. something that UAC would notify on) Windows should ask me for the administrative password. This way even if I'm on an admin account, I'd still need the password to access the feature, instead of just getting a worthless pop up that asks me whether I'd like to proceed.

Apparently in some installations, a standard user would be prompted by a password when trying to access something security related. On my computer, I just get an error and/or a dialog that says to log into an administrative account.

This is the type of prompt I want:

 

[Lomai]

Hi,

Link applies to Vista UAC - have not tested if there are any major differences in 7.

Configuring and Disabling User Account Control



Hope this helps and regards

 

[not so gray matter]

It actually did help, thanks.

The method is this:

Open Local Security Policy via Search Box

Go to: Local Policies > Security Options > Scroll Down

When you see the UAC options, set both "Behavior of the elevation prompt..." lines to "Prompt for credentials"

Now no matter whether you're an administrator or a standard user, you get prompted for a password any time the UAC pops up. I think this makes my admin account a bit more secure, I hope... Hopefully the UAC will pop up in the standard account now

 

[Lomai]

Thanks for letting me know

Take care and regards

 

[Lomai]

Having re-read your post, the only time this happened to me was because I had turned UAC off while trying to install a modded theme. Restoring the UAC level back to its default level, pre-theme-modding, reverted things to normal on the standard account.

 

[not so gray matter]

Having re-read your post, the only time this happened to me was because I had turned UAC off while trying to install a modded theme. Restoring the UAC level back to its default level, pre-theme-modding, reverted things to normal on the standard account.

Now that I've got the UAC Password thing figured out, I'm just going to delete the other account. As long as you have to enter a password to use system settings/install a program then I'm ok with using an admin account.

 

[Lomai]

Ok.
Hope that works out fine.

 

[Barman58]

Just for the record there is a good explanation of using standard accounts on win7 here ...

Configuring Windows 7 for a Limited User Account

May be worth a read for anyone considering this security scenario

 

[Lomai]

Thanks Nigel

Did want to share the same with OP - didn't pursue further as he comes across as way above the "average user".

Regards

 

[Barman58]

Although notsograymatter Is as you rightly say more than an average user it's always worth adding helpful information to possibly aid those who may read this thread in future, and may be at a more basic understanding level

 

[Lomai]

Noted and understood.
Regards

 

[not so gray matter]

Thanks BarMan... From what I briefly skimmed in that article, the main reason to use a standard account is so that when you attempt a process which requires administrative access, you're confronted by a password requirement.

Well, that is exactly what I've done to my account. Instead of being able to launch an elevated command prompt by just a right click and a "Yes", now I have to enter a password in order to open the window. In other words, my administrator account now functions exactly like a standard account, except without the headaches that I somehow ran into.

If my standard account worked properly I would just use that, as it can still perform all of the administrative functions, you just need a password. But, since it doesn't, I've converted my admin account to function like a standard account.

EDIT: Another good security tip for user accounts.
Force users to log in with both the username and password: http://www.sevenforums.com/tutorials/61650-log-user-name-password.html
Force users to press ctrl-alt-dlt to log in: http://www.sevenforums.com/tutorials/612-secure-logon-press-ctrl-alt-delete-log.html

 

[Lomai]

Hi

The following is a link on Vista UAC
Administrator account - Built-in vs. new one
Hope this helps

 

[Barman58]

One problem with the correct operation of the UAC is the fact that not all applications are written correctly to take advantage of it.

Due to the long run of XP some developers simply assume that the user is an administrator, and code accordingly, without performing the required checks.

Although win7 has certain traps in place for this type of code there are so many variations that it cannot catch them all. This is what causes the occasional Run as administrator catch-all prompt.

As win7 and UAC matures hopefully more programs will be updated to comply with the current procedures