Re: "What's the deal with UAC (Windows Needs Your Permission scree

[Guest Marge T]

What must I do to uninstall adobe Reader8.1.2 . I am told there is not

sufficient access to uninstall same, that I need to contact a`systems

administrator.How do I do that, what are my steps?

--

Marge T

 

 

"Alan Simpson" wrote:

<span style="color:blue">

> Well said Jimmy. But just a couple minor additions. Using a computer in a

> limited account for day-to-day stuff has been a security "best practice" for

> many years, and totally ignored outside the corporate environment for just

> as many years. Basically Vista makes that practice security best practice

> automatic and as painless as possible by letting you temporarily elevate

> on-the-fly on an as-needed basis.

>

> Also, for home users, there's a tie-in to parental controls here. From a

> password-protected administrative account you can set parental controls on

> children's standard accounts and monitor their computer and Internet use.

> The kids can't get to any of that from their standard accounts (without an

> administrative password). So they can't tamper with any of that.

>

>

> "Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message

> news:3DD0CEBA-1550-486F-9361-9A0F826897A0@microsoft.com...<span style="color:green">

> > Hello,

> >

> > I've noticed that a lot of the questions in these newsgroups are either

> > directly or indirectly related to UAC (User Account Control). In this

> > post, I will go over what UAC does, how it works, the reasoning behind it,

> > how to use your computer with UAC on, why you shouldn't turn UAC off, and

> > answer some common questions and respond to common complaints about it.

> >

> >

> > What is UAC and what does it do?

> >

> > UAC mode (also known as Admin Approval Mode) is a mode of operation that

> > (primarily) affects the way administrator accounts work.

> >

> > When UAC is turned on (which it is by default), you must explicitly give

> > permission to any program that wants to use "administrator" powers. Any

> > program that tries to use admin powers without your permission will be

> > denied access.

> >

> >

> > How does UAC work

> >

> > When UAC mode is enabled, every program that you run will be given only

> > "standard user" access to the system, even when you are logged in as an

> > administrator. There are only 2 ways that a program can be "elevated" to

> > get full admin access to the system:

> >

> > - If it automatically asks you for permission when it starts up, and you

> > click Continue

> > - If you start the program with permission by right-clicking it, then

> > clicking Run As Administrator

> >

> > A program either starts with STANDARD rights or, if you give permission,

> > ADMINISTRATOR rights, and once the program is running it cannot change

> > from one to the other.

> >

> > If a program that you have already started with admin powers starts

> > another program, that program will automatically be given admin powers

> > without needing your permission. For example, if you start Windows

> > Explorer as administrator, and then double-click on a text file, notepad

> > will open and display the contents of the text file. Since notepad was

> > opened from the admin explorer window, notepad WILL ALSO automatically run

> > WITH admin powers, and will not ask for permission.

> >

> >

> > What's the point of UAC?

> >

> > UAC is designed to put control of your computer back into your hands,

> > instead of at the mercy of the programs running on your computer.

> >

> > When logged in as an administrator in Windows XP, any program that could

> > somehow get itself started could take control of the entire computer

> > without you even knowing about it.

> >

> > With UAC turned on, you must know about and authorize a program in order

> > for it to gain admin access to the system, REGARDLESS of how the program

> > got there or how it is started.

> >

> > This is important to all levels of users - from home users to enterprise

> > administrators. Being alerted when any program tries to use admin powers

> > and being able to unilaterally disallow a program from having such power

> > is a VERY powerful ability. No longer is the security of the system

> > tantamount to "crossing one's fingers and hoping for the best" - YOU now

> > control your system.

> >

> >

> > How do I effectively use my computer with UAC turned on?

> >

> > It's easy. Just keep in mind that programs don't have admin access to your

> > computer unless you give them permission. Microsoft programs that come

> > with Windows Vista that need admin access will always ask for admin

> > permissions when you start them. However, most other programs will not.

> >

> > This will change after Windows Vista is released - all Windows Vista-era

> > programs that need admin power will always ask you for it. Until then, you

> > will need to run programs that need administrative powers that were not

> > designed for Windows Vista "as administrator".

> >

> > Command-line programs do not automatically ask for permission. Not even

> > the built-in ones. You will need to run the command prompt "as

> > administrator" in order to run administrative command-line utilities.

> >

> > Working with files and folders from Windows Explorer can be a real pain

> > when you are not working with your own files. When you are needing to work

> > with system files, files that you didn't create, or files from another

> > operating system, run Windows Explorer "as administrator". In the same

> > vein, ANY program that you run that needs access to system files or files

> > that you didn't create will need to be ran "as administrator".

> >

> > If you are going to be working with the control panel for a long time,

> > running control.exe "as administrator" will make things less painful - you

> > will only be asked for permission once, instead of every time you try to

> > change a system-wide setting.

> >

> > In short:

> >

> > - Run command prompt as admin when you need to run admin utilities

> > - Run setup programs as admin

> > - Run programs not designed for Vista as admin if (and only if) they need

> > admin access

> > - Run Windows Explorer as admin when you need access to files that aren't

> > yours or system files

> > - Run programs that need access to files that aren't yours or system files

> > as admin

> > - Run control.exe as admin when changing many settings in the control

> > panel

> >

> >

> > UAC is annoying, I want to turn it off

> >

> > Having to go through an extra step (clicking Continue) when opening

> > administrative programs is annoying. And it is also very frustrating to

> > run a program that needs admin power but doesn't automatically ask you for

> > it (you have to right-click these programs and click Run As Administrator

> > for them to run correctly).

> >

> > But, keep in mind that these small inconveniences are insignificant when

> > weighed against the benefit: NO PROGRAM can get full access to your system

> > without you being informed. The first time the permission dialog pops up

> > and it is from some program that you know nothing about or that you do not

> > want to have access to your system, you will be very glad that the Cancel

> > button was available to you.

> >

> >

> > Answers to common questions and responses to common criticism

> >

> > Q: I have anti-virus, a firewall, a spyware-detector, or something

> > similar. Why do I need UAC?

> >

> > A: Detectors can only see known threats. And of all the known threats in

> > existence, they only detect the most common of those threats. With UAC

> > turned on, you control what programs have access to your computer - you

> > can stop ALL threats. Detectors are nice, but they're not enough. How many

> > people do you know that have detectors of all kinds and yet are still

> > infested with programs that they don't want on their computer? Everyone

> > that I have ever helped falls into this category.

> >

> >

> > Q: Does UAC replace anti-virus, a firewall, a spyware-detector, or similar

> > programs?

> >

> > A: No. Microsoft recommends that you use a virus scanner and/or other

> > types of security software. These types of programs compliment UAC: They

> > will get rid of known threats for you. UAC will allow you to stop unknown

> > threats, as well as prevent any program that you do not trust from gaining

> > access to your computer.

> >

> >

> > Q: I am a system administrator - I have no use for UAC.

> >

> > A: Really? You don't NEED to know when a program on your computer runs

> > with admin powers? You are a system administrator and you really could

> > care less when a program runs that has full control of your system, and

> > possibly your entire domain? You're joking, right?

> >

> >

> > Q: UAC keeps me from accessing files and folders

> >

> > A: No, it doesn't - UAC protects you from programs that would try to

> > delete or modify system files and folders without your knowledge. If you

> > want a program to have full access to the files on your computer, you will

> > need to run it as admin. Or as an alternative, if possible, put the files

> > it needs access to in a place that all programs have access to - such as

> > your documents folder, or any folder under your user folder.

> >

> >

> > Q: UAC stops programs from working correctly

> >

> > A: If a program needs admin power and it doesn't ask you for permission

> > when it starts, you have to give it admin powers by right-clicking it and

> > clicking Run As Administrator. Programs should work like they did in XP

> > when you use Run As Administrator. If they don't, then this is a bug.

> >

> >

> > Q: UAC keeps me from doing things that I could do in XP

> >

> > A: This is not the case. Just remember that programs that do not ask for

> > permission when they start do not get admin access to your computer. If

> > you are using a tool that needs admin access, right-click it and click Run

> > As Administrator. It should work exactly as it did in XP. If it does not,

> > then this is a bug.

> >

> >

> > Q: UAC is Microsoft's way of controlling my computer and preventing me

> > from using it!

> >

> > A: This is 100% UNTRUE. UAC puts control of your computer IN YOUR HANDS by

> > allowing you to prevent unwanted programs from accessing your computer.

> > Everything that you can do with UAC turned off, you can do with it

> > turned on. If this is not the case, then that is a bug.

> >

> >

> > Q: I don't need Windows to hold my freaking hand! I know what I've got

> > on my computer, and I know when programs run! I am logged on as an

> > ADMINISTRATOR for a dang reason!

> >

> > A: I accept the way that you think, and can see the logic, but I don't

> > agree with this idea. UAC is putting POWER in your hands by letting you

> > CONTROL what runs on your system. But you want to give up this control and

> > allow all programs to run willy-nilly. Look, if you want to do this go

> > right ahead, you can turn UAC off and things will return to how they

> > worked in XP. But, don't be surprised when either 1) You run something by

> > mistake that messes up your computer and/or domain, or 2) A program

> > somehow gets on your computer that you know nothing about that takes over

> > your computer and/or domain, and UAC would have allowed you to have

> > stopped it.

> >

> >

> > - JB

> >

> > Vista Support FAQ

> > http://www.jimmah.com/vista/ </span>

> </span>

[Guest Bob]

All of that nonsense can be eliminated by running UAC in “quiet†mode.

<span style="color:blue">

> "Alan Simpson" wrote:

><span style="color:green">

>> Well said Jimmy. But just a couple minor additions. Using a computer in a

>> limited account for day-to-day stuff has been a security "best practice"

>> for

>> many years, and totally ignored outside the corporate environment for

>> just

>> as many years. Basically Vista makes that practice security best practice

>> automatic and as painless as possible by letting you temporarily elevate

>> on-the-fly on an as-needed basis.

>>

>> Also, for home users, there's a tie-in to parental controls here. From a

>> password-protected administrative account you can set parental controls

>> on

>> children's standard accounts and monitor their computer and Internet use.

>> The kids can't get to any of that from their standard accounts (without

>> an

>> administrative password). So they can't tamper with any of that.

>>

>>

>> "Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message

>> news:3DD0CEBA-1550-486F-9361-9A0F826897A0@microsoft.com...<span style="color:darkred">

>> > Hello,

>> >

>> > I've noticed that a lot of the questions in these newsgroups are either

>> > directly or indirectly related to UAC (User Account Control). In this

>> > post, I will go over what UAC does, how it works, the reasoning behind

>> > it,

>> > how to use your computer with UAC on, why you shouldn't turn UAC off,

>> > and

>> > answer some common questions and respond to common complaints about it.

>> >

>> >

>> > What is UAC and what does it do?

>> >

>> > UAC mode (also known as Admin Approval Mode) is a mode of operation

>> > that

>> > (primarily) affects the way administrator accounts work.

>> >

>> > When UAC is turned on (which it is by default), you must explicitly

>> > give

>> > permission to any program that wants to use "administrator" powers. Any

>> > program that tries to use admin powers without your permission will be

>> > denied access.

>> >

>> >

>> > How does UAC work

>> >

>> > When UAC mode is enabled, every program that you run will be given only

>> > "standard user" access to the system, even when you are logged in as an

>> > administrator. There are only 2 ways that a program can be "elevated"

>> > to

>> > get full admin access to the system:

>> >

>> > - If it automatically asks you for permission when it starts up, and

>> > you

>> > click Continue

>> > - If you start the program with permission by right-clicking it, then

>> > clicking Run As Administrator

>> >

>> > A program either starts with STANDARD rights or, if you give

>> > permission,

>> > ADMINISTRATOR rights, and once the program is running it cannot change

>> > from one to the other.

>> >

>> > If a program that you have already started with admin powers starts

>> > another program, that program will automatically be given admin powers

>> > without needing your permission. For example, if you start Windows

>> > Explorer as administrator, and then double-click on a text file,

>> > notepad

>> > will open and display the contents of the text file. Since notepad was

>> > opened from the admin explorer window, notepad WILL ALSO automatically

>> > run

>> > WITH admin powers, and will not ask for permission.

>> >

>> >

>> > What's the point of UAC?

>> >

>> > UAC is designed to put control of your computer back into your hands,

>> > instead of at the mercy of the programs running on your computer.

>> >

>> > When logged in as an administrator in Windows XP, any program that

>> > could

>> > somehow get itself started could take control of the entire computer

>> > without you even knowing about it.

>> >

>> > With UAC turned on, you must know about and authorize a program in

>> > order

>> > for it to gain admin access to the system, REGARDLESS of how the

>> > program

>> > got there or how it is started.

>> >

>> > This is important to all levels of users - from home users to

>> > enterprise

>> > administrators. Being alerted when any program tries to use admin

>> > powers

>> > and being able to unilaterally disallow a program from having such

>> > power

>> > is a VERY powerful ability. No longer is the security of the system

>> > tantamount to "crossing one's fingers and hoping for the best" - YOU

>> > now

>> > control your system.

>> >

>> >

>> > How do I effectively use my computer with UAC turned on?

>> >

>> > It's easy. Just keep in mind that programs don't have admin access to

>> > your

>> > computer unless you give them permission. Microsoft programs that come

>> > with Windows Vista that need admin access will always ask for admin

>> > permissions when you start them. However, most other programs will not.

>> >

>> > This will change after Windows Vista is released - all Windows

>> > Vista-era

>> > programs that need admin power will always ask you for it. Until then,

>> > you

>> > will need to run programs that need administrative powers that were not

>> > designed for Windows Vista "as administrator".

>> >

>> > Command-line programs do not automatically ask for permission. Not even

>> > the built-in ones. You will need to run the command prompt "as

>> > administrator" in order to run administrative command-line utilities.

>> >

>> > Working with files and folders from Windows Explorer can be a real pain

>> > when you are not working with your own files. When you are needing to

>> > work

>> > with system files, files that you didn't create, or files from another

>> > operating system, run Windows Explorer "as administrator". In the same

>> > vein, ANY program that you run that needs access to system files or

>> > files

>> > that you didn't create will need to be ran "as administrator".

>> >

>> > If you are going to be working with the control panel for a long time,

>> > running control.exe "as administrator" will make things less painful -

>> > you

>> > will only be asked for permission once, instead of every time you try

>> > to

>> > change a system-wide setting.

>> >

>> > In short:

>> >

>> > - Run command prompt as admin when you need to run admin utilities

>> > - Run setup programs as admin

>> > - Run programs not designed for Vista as admin if (and only if) they

>> > need

>> > admin access

>> > - Run Windows Explorer as admin when you need access to files that

>> > aren't

>> > yours or system files

>> > - Run programs that need access to files that aren't yours or system

>> > files

>> > as admin

>> > - Run control.exe as admin when changing many settings in the control

>> > panel

>> >

>> >

>> > UAC is annoying, I want to turn it off

>> >

>> > Having to go through an extra step (clicking Continue) when opening

>> > administrative programs is annoying. And it is also very frustrating to

>> > run a program that needs admin power but doesn't automatically ask you

>> > for

>> > it (you have to right-click these programs and click Run As

>> > Administrator

>> > for them to run correctly).

>> >

>> > But, keep in mind that these small inconveniences are insignificant

>> > when

>> > weighed against the benefit: NO PROGRAM can get full access to your

>> > system

>> > without you being informed. The first time the permission dialog pops

>> > up

>> > and it is from some program that you know nothing about or that you do

>> > not

>> > want to have access to your system, you will be very glad that the

>> > Cancel

>> > button was available to you.

>> >

>> >

>> > Answers to common questions and responses to common criticism

>> >

>> > Q: I have anti-virus, a firewall, a spyware-detector, or something

>> > similar. Why do I need UAC?

>> >

>> > A: Detectors can only see known threats. And of all the known threats

>> > in

>> > existence, they only detect the most common of those threats. With UAC

>> > turned on, you control what programs have access to your computer -

>> > you

>> > can stop ALL threats. Detectors are nice, but they're not enough. How

>> > many

>> > people do you know that have detectors of all kinds and yet are still

>> > infested with programs that they don't want on their computer? Everyone

>> > that I have ever helped falls into this category.

>> >

>> >

>> > Q: Does UAC replace anti-virus, a firewall, a spyware-detector, or

>> > similar

>> > programs?

>> >

>> > A: No. Microsoft recommends that you use a virus scanner and/or other

>> > types of security software. These types of programs compliment UAC:

>> > They

>> > will get rid of known threats for you. UAC will allow you to stop

>> > unknown

>> > threats, as well as prevent any program that you do not trust from

>> > gaining

>> > access to your computer.

>> >

>> >

>> > Q: I am a system administrator - I have no use for UAC.

>> >

>> > A: Really? You don't NEED to know when a program on your computer runs

>> > with admin powers? You are a system administrator and you really could

>> > care less when a program runs that has full control of your system, and

>> > possibly your entire domain? You're joking, right?

>> >

>> >

>> > Q: UAC keeps me from accessing files and folders

>> >

>> > A: No, it doesn't - UAC protects you from programs that would try to

>> > delete or modify system files and folders without your knowledge. If

>> > you

>> > want a program to have full access to the files on your computer, you

>> > will

>> > need to run it as admin. Or as an alternative, if possible, put the

>> > files

>> > it needs access to in a place that all programs have access to - such

>> > as

>> > your documents folder, or any folder under your user folder.

>> >

>> >

>> > Q: UAC stops programs from working correctly

>> >

>> > A: If a program needs admin power and it doesn't ask you for permission

>> > when it starts, you have to give it admin powers by right-clicking it

>> > and

>> > clicking Run As Administrator. Programs should work like they did in XP

>> > when you use Run As Administrator. If they don't, then this is a bug.

>> >

>> >

>> > Q: UAC keeps me from doing things that I could do in XP

>> >

>> > A: This is not the case. Just remember that programs that do not ask

>> > for

>> > permission when they start do not get admin access to your computer. If

>> > you are using a tool that needs admin access, right-click it and click

>> > Run

>> > As Administrator. It should work exactly as it did in XP. If it does

>> > not,

>> > then this is a bug.

>> >

>> >

>> > Q: UAC is Microsoft's way of controlling my computer and preventing me

>> > from using it!

>> >

>> > A: This is 100% UNTRUE. UAC puts control of your computer IN YOUR HANDS

>> > by

>> > allowing you to prevent unwanted programs from accessing your computer.

>> > Everything that you can do with UAC turned off, you can do with it

>> > turned on. If this is not the case, then that is a bug.

>> >

>> >

>> > Q: I don't need Windows to hold my freaking hand! I know what I've

>> > got

>> > on my computer, and I know when programs run! I am logged on as an

>> > ADMINISTRATOR for a dang reason!

>> >

>> > A: I accept the way that you think, and can see the logic, but I don't

>> > agree with this idea. UAC is putting POWER in your hands by letting you

>> > CONTROL what runs on your system. But you want to give up this control

>> > and

>> > allow all programs to run willy-nilly. Look, if you want to do this go

>> > right ahead, you can turn UAC off and things will return to how they

>> > worked in XP. But, don't be surprised when either 1) You run something

>> > by

>> > mistake that messes up your computer and/or domain, or 2) A program

>> > somehow gets on your computer that you know nothing about that takes

>> > over

>> > your computer and/or domain, and UAC would have allowed you to have

>> > stopped it.

>> >

>> >

>> > - JB

>> >

>> > Vista Support FAQ

>> > http://www.jimmah.com/vista/</span>

>> </span></span>

[Guest Ronnie Vernon MVP]

"Bob" <bob@nowhere.net> wrote in message

news:VISdnaGl9rkOUnjanZ2dnUVZ_g-dnZ2d@comcast.com...<span style="color:blue">

>

> All of that nonsense can be eliminated by running UAC in “quiet†mode.</span>

 

This is a fallacy! If UAC cannot notify the user that a program is trying to

gain global access to the system, then it is effectively 'disabled'. This so

called 'quite mode' setting just changes a UAC registry setting to

'automatically elevate everything without prompting'. This means that when

you click to open a file, it is 'assumed' that you already know that the

file will have unrestricted access to your computer.

 

The main thing that UAC does is to detect when a program or application

tries to access restricted parts of the system or registry that requires

administrator privileges. When a program does this, UAC will prompt the user

for administrative elevation. Without this prompt, UAC cannot warn the user,

which means that it is effectively disabled.

 

Some people will tell you that using "quiet mode" will still let IE run in

protected mode, but this just isn't true. Without the UAC prompt, a

malicious file that runs from a website can run, without restrictions, and

silently.

 

Another issue is that with UAC prompt disabled, some legitimate procedures

will just silently fail to work properly, with no notification, if you are

logged on with a Standard User account, since the application cannot notify

you that administrative privileges are required.

 

Even the developer of the TweakUAC utility includes this statement about his

product.

"if you are an experienced user and have some understanding of how to manage

your Windows settings properly, you can safely use the quiet mode of UAC."

In my opinion, if you are an experienced user, the last thing you would want

to do is turn off the UAC notification.

 

If you 'are' an experienced user, then you would already know how to

temporarily bypass the UAC prompt to perform just about any procedure in

Vista, such as running programs from an elevated command prompt, or using an

elevated instance of windows explorer.

 

The last problem I have with this so-called 'quiet mode' is that it

dissuades developers from programming their applications to run in a least

user privilege environment.

--

 

Ronnie Vernon

Microsoft MVP

Windows Desktop Experience

[Guest Bob]

Ronnie

Even with the prompt enabled it still requires the user to be knowledgeable

of the application UAC is prompting about. Once elevation is allowed UAC

does not protect the user. Clicking allow becomes nothing more than an

annoying additional click which in many cases becomes automatic.

Additionally, the most common way a PC becomes infected is by downloading

something from the net and even with the UAC prompts disabled you still

receive a security warning when you attempt a download.

 

Personally, when I decide to run something I don't have a need to be asked

to confirm it. If I didn't want to run it I would not have clicked on it in

the first place.

 

The bottom line is UAC does no more than protect the user from himself, and

even that still requires the user to be knowledgeable.

 

"Ronnie Vernon MVP" <rv@invalid.org> wrote in

messagenews:3F04A9A8-EC21-412D-9ED2-3386B2E653BB@microsoft.com...<span style="color:blue">

> "Bob" <bob@nowhere.net> wrote in message

> news:VISdnaGl9rkOUnjanZ2dnUVZ_g-dnZ2d@comcast.com...<span style="color:green">

>>

>> All of that nonsense can be eliminated by running UAC in “quiet†mode.</span>

>

> This is a fallacy! If UAC cannot notify the user that a program is trying

> to gain global access to the system, then it is effectively 'disabled'.

> This so called 'quite mode' setting just changes a UAC registry setting to

> 'automatically elevate everything without prompting'. This means that when

> you click to open a file, it is 'assumed' that you already know that the

> file will have unrestricted access to your computer.

>

> The main thing that UAC does is to detect when a program or application

> tries to access restricted parts of the system or registry that requires

> administrator privileges. When a program does this, UAC will prompt the

> user for administrative elevation. Without this prompt, UAC cannot warn

> the user, which means that it is effectively disabled.

>

> Some people will tell you that using "quiet mode" will still let IE run in

> protected mode, but this just isn't true. Without the UAC prompt, a

> malicious file that runs from a website can run, without restrictions, and

> silently.

>

> Another issue is that with UAC prompt disabled, some legitimate procedures

> will just silently fail to work properly, with no notification, if you are

> logged on with a Standard User account, since the application cannot

> notify you that administrative privileges are required.

>

> Even the developer of the TweakUAC utility includes this statement about

> his product.

> "if you are an experienced user and have some understanding of how to

> manage your Windows settings properly, you can safely use the quiet mode

> of UAC." In my opinion, if you are an experienced user, the last thing you

> would want to do is turn off the UAC notification.

>

> If you 'are' an experienced user, then you would already know how to

> temporarily bypass the UAC prompt to perform just about any procedure in

> Vista, such as running programs from an elevated command prompt, or using

> an elevated instance of windows explorer.

>

> The last problem I have with this so-called 'quiet mode' is that it

> dissuades developers from programming their applications to run in a least

> user privilege environment.

> --

>

> Ronnie Vernon

> Microsoft MVP

> Windows Desktop Experience </span>

[Guest here@home.again]

"Bob" wrote in message news:8MOdnY5hI8aWaHvanZ2dnUVZ_gKdnZ2d@comcast.com...<span style="color:blue">

> Ronnie

> Even with the prompt enabled it still requires the user to be

> knowledgeable of the application UAC is prompting about. Once elevation is

> allowed UAC does not protect the user. Clicking allow becomes nothing more

> than an annoying additional click which in many cases becomes automatic.

> Additionally, the most common way a PC becomes infected is by downloading

> something from the net and even with the UAC prompts disabled you still

> receive a security warning when you attempt a download.

>

> Personally, when I decide to run something I don't have a need to be asked

> to confirm it. If I didn't want to run it I would not have clicked on it

> in the first place.

>

> The bottom line is UAC does no more than protect the user from himself,

> and even that still requires the user to be knowledgeable.

>

> "Ronnie Vernon MVP" wrote ...<span style="color:green">

>> "Bob" wrote in message...<span style="color:darkred">

>>>

>>> All of that nonsense can be eliminated by running UAC in "quiet" mode.</span>

>>

>> This is a fallacy! If UAC cannot notify the user that a program is trying

>> to gain global access to the system, then it is effectively 'disabled'.

>> This so called 'quite mode' setting just changes a UAC registry setting

>> to 'automatically elevate everything without prompting'. This means that

>> when you click to open a file, it is 'assumed' that you already know that

>> the file will have unrestricted access to your computer.

>>

>> The main thing that UAC does is to detect when a program or application

>> tries to access restricted parts of the system or registry that requires

>> administrator privileges. When a program does this, UAC will prompt the

>> user for administrative elevation. Without this prompt, UAC cannot warn

>> the user, which means that it is effectively disabled.

>>

>> Some people will tell you that using "quiet mode" will still let IE run

>> in protected mode, but this just isn't true. Without the UAC prompt, a

>> malicious file that runs from a website can run, without restrictions,

>> and silently.

>>

>> Another issue is that with UAC prompt disabled, some legitimate

>> procedures will just silently fail to work properly, with no

>> notification, if you are logged on with a Standard User account, since

>> the application cannot notify you that administrative privileges are

>> required.

>>

>> Even the developer of the TweakUAC utility includes this statement about

>> his product.

>> "if you are an experienced user and have some understanding of how to

>> manage your Windows settings properly, you can safely use the quiet mode

>> of UAC." In my opinion, if you are an experienced user, the last thing

>> you would want to do is turn off the UAC notification.

>>

>> If you 'are' an experienced user, then you would already know how to

>> temporarily bypass the UAC prompt to perform just about any procedure in

>> Vista, such as running programs from an elevated command prompt, or using

>> an elevated instance of windows explorer.

>>

>> The last problem I have with this so-called 'quiet mode' is that it

>> dissuades developers from programming their applications to run in a

>> least user privilege environment.</span></span>

 

 

Sorry, Bob, but I agree with Ronnie. The so-called "quiet" mode is nothing

more than disabling the built-in warning system. UAC actually works.

 

Troubleshooting my nephew's pc over the weekend, set in "quiet" mode, I

found a worm and three everyday ordinary virus hits. Apparently, after

tweaking the UAC, the worm disabled the AV enough to allow a virus to

auto-install, three different times, in just under a month.

 

His excuse? Clicking the little box when he installed a couple games was too

annoying.

[Guest Ronnie Vernon MVP]

Bob

 

<inline>

 

"Bob" <bob@nowhere.net> wrote in message

news:8MOdnY5hI8aWaHvanZ2dnUVZ_gKdnZ2d@comcast.com...<span style="color:blue">

> Ronnie

> Even with the prompt enabled it still requires the user to be

> knowledgeable of the application UAC is prompting about. Once elevation is

> allowed UAC does not protect the user. Clicking allow becomes nothing more

> than an annoying additional click which in many cases becomes automatic.</span>

 

It it only annoying until you run into something unexpected. Right after

Vista was first released, we went through all of the debates about users

getting to the point where clicking on the prompt became an 'automatic'

response.

 

One user told us about a utility that he downloaded and installed and he got

the expected 'security warning' about the file not having a digital

signature. He clicked to run the file anyway and the utility installed. He

then got a message to 'click here' to configure your personal settings. He

then received this prompt.

 

http://i196.photobucket.com/albums/aa86/rvmv/UACPrompt2.jpg

 

Without UAC, he never would have been aware of the second file being

installed, since he had already permitted the program to run. Needless to

say, he decided that he would leave UAC on.

 

<span style="color:blue">

> Additionally, the most common way a PC becomes infected is by downloading

> something from the net and even with the UAC prompts disabled you still

> receive a security warning when you attempt a download.</span>

 

Only in specific instances, such as an installation file that does not have

a digital signature attached. The security warning does nothing to protect

against 'drive-by' downloads that run automatically. Most of the smaller

software developers will not bother with a digital signature, simply because

it is time consuming and expensive for them.

<span style="color:blue">

>

> Personally, when I decide to run something I don't have a need to be asked

> to confirm it. If I didn't want to run it I would not have clicked on it

> in the first place.</span>

 

It's not about you deciding to run a program, it's about 'isolation', it's

about 'integrity levels', it's about what background actions the program

will take when you do run it. Have you ever wondered why an application,

that does nothing more than make images look better, needs full and

unrestricted access to every part of your computer?

<span style="color:blue">

>

> The bottom line is UAC does no more than protect the user from himself,

> and even that still requires the user to be knowledgeable.</span>

 

This is the whole point of UAC. The only way that a malicious program can be

installed is if the user gets complacent and stops paying attention to what

they are doing.

 

When Vista is first installed, a user will typically see a ton of UAC

prompts as they install all of their software programs and utilities, but

these will gradually become more rare. Windows has to overcome almost twenty

years of being a 'push button' operating system before it will attain any

semblance of a 'secure' operating system. The education of users as well as

developers will take some time. UAC and other security 'hardening'

procedures are not going to 'go away'.

 

When the majority of developers see the benefits, and start following the

Microsoft developer guidelines for coding their programs and applications to

run in a 'least user privilege' environment, UAC will become a prompt that

is rarely seen. The vast majority of windows software should not even need

to initiate a UAC prompt.

 

Take a few minutes to read the following article. It will give you a better

understanding, and show you the underlying reasons and goals of UAC.

 

The Long-Term Impact of User Account Control:

http://technet.microsoft.com/en-us/magazine/cc137811.aspx

 

 

--

 

Ronnie Vernon

Microsoft MVP

Windows Desktop Experience

 

 

<span style="color:blue">

>

> "Ronnie Vernon MVP" <rv@invalid.org> wrote in

> messagenews:3F04A9A8-EC21-412D-9ED2-3386B2E653BB@microsoft.com...<span style="color:green">

>> "Bob" <bob@nowhere.net> wrote in message

>> news:VISdnaGl9rkOUnjanZ2dnUVZ_g-dnZ2d@comcast.com...<span style="color:darkred">

>>>

>>> All of that nonsense can be eliminated by running UAC in “quiet†mode.</span>

>>

>> This is a fallacy! If UAC cannot notify the user that a program is trying

>> to gain global access to the system, then it is effectively 'disabled'.

>> This so called 'quite mode' setting just changes a UAC registry setting

>> to 'automatically elevate everything without prompting'. This means that

>> when you click to open a file, it is 'assumed' that you already know that

>> the file will have unrestricted access to your computer.

>>

>> The main thing that UAC does is to detect when a program or application

>> tries to access restricted parts of the system or registry that requires

>> administrator privileges. When a program does this, UAC will prompt the

>> user for administrative elevation. Without this prompt, UAC cannot warn

>> the user, which means that it is effectively disabled.

>>

>> Some people will tell you that using "quiet mode" will still let IE run

>> in protected mode, but this just isn't true. Without the UAC prompt, a

>> malicious file that runs from a website can run, without restrictions,

>> and silently.

>>

>> Another issue is that with UAC prompt disabled, some legitimate

>> procedures will just silently fail to work properly, with no

>> notification, if you are logged on with a Standard User account, since

>> the application cannot notify you that administrative privileges are

>> required.

>>

>> Even the developer of the TweakUAC utility includes this statement about

>> his product.

>> "if you are an experienced user and have some understanding of how to

>> manage your Windows settings properly, you can safely use the quiet mode

>> of UAC." In my opinion, if you are an experienced user, the last thing

>> you would want to do is turn off the UAC notification.

>>

>> If you 'are' an experienced user, then you would already know how to

>> temporarily bypass the UAC prompt to perform just about any procedure in

>> Vista, such as running programs from an elevated command prompt, or using

>> an elevated instance of windows explorer.

>>

>> The last problem I have with this so-called 'quiet mode' is that it

>> dissuades developers from programming their applications to run in a

>> least user privilege environment.

>> --

>>

>> Ronnie Vernon

>> Microsoft MVP

>> Windows Desktop Experience</span>

> </span>

[Guest Bob]

Ronnie

 

I had previously read the article.

 

The quote that stands out to me is "UAC does not, nor is it intended to,

stop malware"

 

In the example you give the user would have received a prompt even if UAC

was disabled providing he was running Windows Defender.

"If potentially harmful software tries to run or install itself on your

computer, Windows Defender notifies you and helps you choose how to take

action."

 

Re: "Have you ever wondered why an application,

that does nothing more than make images look better, needs full and

unrestricted access to every part of your computer?"

 

I don't know why you say that. I run Photoshop Elements and afaik it doesn't

need unrestricted access to every part of my computer.

 

"Ronnie Vernon MVP" <rv@invalid.org> wrote in message

news:D4168639-4396-4757-9934-EBCAF3B666BE@microsoft.com...<span style="color:blue">

> Bob

>

> <inline>

>

> "Bob" <bob@nowhere.net> wrote in message

> news:8MOdnY5hI8aWaHvanZ2dnUVZ_gKdnZ2d@comcast.com...<span style="color:green">

>> Ronnie

>> Even with the prompt enabled it still requires the user to be

>> knowledgeable of the application UAC is prompting about. Once elevation

>> is allowed UAC does not protect the user. Clicking allow becomes nothing

>> more than an annoying additional click which in many cases becomes

>> automatic.</span>

>

> It it only annoying until you run into something unexpected. Right after

> Vista was first released, we went through all of the debates about users

> getting to the point where clicking on the prompt became an 'automatic'

> response.

>

> One user told us about a utility that he downloaded and installed and he

> got the expected 'security warning' about the file not having a digital

> signature. He clicked to run the file anyway and the utility installed. He

> then got a message to 'click here' to configure your personal settings. He

> then received this prompt.

>

> http://i196.photobucket.com/albums/aa86/rvmv/UACPrompt2.jpg

>

> Without UAC, he never would have been aware of the second file being

> installed, since he had already permitted the program to run. Needless to

> say, he decided that he would leave UAC on.

>

><span style="color:green">

>> Additionally, the most common way a PC becomes infected is by downloading

>> something from the net and even with the UAC prompts disabled you still

>> receive a security warning when you attempt a download.</span>

>

> Only in specific instances, such as an installation file that does not

> have a digital signature attached. The security warning does nothing to

> protect against 'drive-by' downloads that run automatically. Most of the

> smaller software developers will not bother with a digital signature,

> simply because it is time consuming and expensive for them.

><span style="color:green">

>>

>> Personally, when I decide to run something I don't have a need to be

>> asked to confirm it. If I didn't want to run it I would not have clicked

>> on it in the first place.</span>

>

> It's not about you deciding to run a program, it's about 'isolation', it's

> about 'integrity levels', it's about what background actions the program

> will take when you do run it. Have you ever wondered why an application,

> that does nothing more than make images look better, needs full and

> unrestricted access to every part of your computer?

><span style="color:green">

>>

>> The bottom line is UAC does no more than protect the user from himself,

>> and even that still requires the user to be knowledgeable.</span>

>

> This is the whole point of UAC. The only way that a malicious program can

> be installed is if the user gets complacent and stops paying attention to

> what they are doing.

>

> When Vista is first installed, a user will typically see a ton of UAC

> prompts as they install all of their software programs and utilities, but

> these will gradually become more rare. Windows has to overcome almost

> twenty years of being a 'push button' operating system before it will

> attain any semblance of a 'secure' operating system. The education of

> users as well as developers will take some time. UAC and other security

> 'hardening' procedures are not going to 'go away'.

>

> When the majority of developers see the benefits, and start following the

> Microsoft developer guidelines for coding their programs and applications

> to run in a 'least user privilege' environment, UAC will become a prompt

> that is rarely seen. The vast majority of windows software should not even

> need to initiate a UAC prompt.

>

> Take a few minutes to read the following article. It will give you a

> better understanding, and show you the underlying reasons and goals of

> UAC.

>

> The Long-Term Impact of User Account Control:

> http://technet.microsoft.com/en-us/magazine/cc137811.aspx

>

>

> --

>

> Ronnie Vernon

> Microsoft MVP

> Windows Desktop Experience

>

>

><span style="color:green">

>>

>> "Ronnie Vernon MVP" <rv@invalid.org> wrote in

>> messagenews:3F04A9A8-EC21-412D-9ED2-3386B2E653BB@microsoft.com...<span style="color:darkred">

>>> "Bob" <bob@nowhere.net> wrote in message

>>> news:VISdnaGl9rkOUnjanZ2dnUVZ_g-dnZ2d@comcast.com...

>>>>

>>>> All of that nonsense can be eliminated by running UAC in “quiet†mode.

>>>

>>> This is a fallacy! If UAC cannot notify the user that a program is

>>> trying to gain global access to the system, then it is effectively

>>> 'disabled'. This so called 'quite mode' setting just changes a UAC

>>> registry setting to 'automatically elevate everything without

>>> prompting'. This means that when you click to open a file, it is

>>> 'assumed' that you already know that the file will have unrestricted

>>> access to your computer.

>>>

>>> The main thing that UAC does is to detect when a program or application

>>> tries to access restricted parts of the system or registry that requires

>>> administrator privileges. When a program does this, UAC will prompt the

>>> user for administrative elevation. Without this prompt, UAC cannot warn

>>> the user, which means that it is effectively disabled.

>>>

>>> Some people will tell you that using "quiet mode" will still let IE run

>>> in protected mode, but this just isn't true. Without the UAC prompt, a

>>> malicious file that runs from a website can run, without restrictions,

>>> and silently.

>>>

>>> Another issue is that with UAC prompt disabled, some legitimate

>>> procedures will just silently fail to work properly, with no

>>> notification, if you are logged on with a Standard User account, since

>>> the application cannot notify you that administrative privileges are

>>> required.

>>>

>>> Even the developer of the TweakUAC utility includes this statement about

>>> his product.

>>> "if you are an experienced user and have some understanding of how to

>>> manage your Windows settings properly, you can safely use the quiet mode

>>> of UAC." In my opinion, if you are an experienced user, the last thing

>>> you would want to do is turn off the UAC notification.

>>>

>>> If you 'are' an experienced user, then you would already know how to

>>> temporarily bypass the UAC prompt to perform just about any procedure in

>>> Vista, such as running programs from an elevated command prompt, or

>>> using an elevated instance of windows explorer.

>>>

>>> The last problem I have with this so-called 'quiet mode' is that it

>>> dissuades developers from programming their applications to run in a

>>> least user privilege environment.

>>> --

>>>

>>> Ronnie Vernon

>>> Microsoft MVP

>>> Windows Desktop Experience</span>

>></span>

> </span>

[Guest Ronnie Vernon MVP]

"Bob" <bob@nowhere.net> wrote in message

news:PoqdnavlbdaxbHranZ2dnUVZ_hSdnZ2d@comcast.com...<span style="color:blue">

> Ronnie

>

> I had previously read the article.

>

> The quote that stands out to me is "UAC does not, nor is it intended to,

> stop malware"</span>

 

That's correct, the primary job for UAC is to allow a user to run with a

Standard User (Limited User in XP) token and still have the capability to

elevate a program or procedure with administrator privileges on demand.

However, as a side benefit, if you get an unexpected UAC prompt, this can

warn you that a process you did not start is trying to access a restricted

part of the OS.

<span style="color:blue">

> In the example you give the user would have received a prompt even if UAC

> was disabled providing he was running Windows Defender.

> "If potentially harmful software tries to run or install itself on your

> computer, Windows Defender notifies you and helps you choose how to take

> action."</span>

 

Windows Defender can only stop 'known' malware. It checks a database that is

updated often when a new threat is discovered. Defender is not an anti-virus

program.

 

Neither Defender nor UAC are designed to replace a good anti-virus program.

<span style="color:blue">

> Re: "Have you ever wondered why an application,

> that does nothing more than make images look better, needs full and

> unrestricted access to every part of your computer?"

>

> I don't know why you say that. I run Photoshop Elements and afaik it

> doesn't need unrestricted access to every part of my computer.</span>

 

This is because photoshop elements is probably designed to work properly, or

the part of the program that requires admin privileges has been Virtualized

by UAC. I have even heard of word processors that get a UAC prompt when they

are started.

 

--

 

Ronnie Vernon

Microsoft MVP

Windows Desktop Experience

[Guest Bob]

Exactly...and we both know it's best to have at least two anti-spyware

programs in addition to an AV program.

 

" Windows Defender can only stop 'known' malware. It checks a database that

is updated often when a new threat is discovered. Defender is not an

anti-virus program.

Neither Defender nor UAC are designed to replace a good anti-virus program."

 

 

 

"Ronnie Vernon MVP" <rv@invalid.org> wrote in message

news:AF812511-4163-400C-9538-8A5F8D254083@microsoft.com...<span style="color:blue">

> "Bob" <bob@nowhere.net> wrote in message

> news:PoqdnavlbdaxbHranZ2dnUVZ_hSdnZ2d@comcast.com...<span style="color:green">

>> Ronnie

>>

>> I had previously read the article.

>>

>> The quote that stands out to me is "UAC does not, nor is it intended to,

>> stop malware"</span>

>

> That's correct, the primary job for UAC is to allow a user to run with a

> Standard User (Limited User in XP) token and still have the capability to

> elevate a program or procedure with administrator privileges on demand.

> However, as a side benefit, if you get an unexpected UAC prompt, this can

> warn you that a process you did not start is trying to access a restricted

> part of the OS.

><span style="color:green">

>> In the example you give the user would have received a prompt even if UAC

>> was disabled providing he was running Windows Defender.

>> "If potentially harmful software tries to run or install itself on your

>> computer, Windows Defender notifies you and helps you choose how to take

>> action."</span>

>

> Windows Defender can only stop 'known' malware. It checks a database that

> is updated often when a new threat is discovered. Defender is not an

> anti-virus program.

>

> Neither Defender nor UAC are designed to replace a good anti-virus

> program.

><span style="color:green">

>> Re: "Have you ever wondered why an application,

>> that does nothing more than make images look better, needs full and

>> unrestricted access to every part of your computer?"

>>

>> I don't know why you say that. I run Photoshop Elements and afaik it

>> doesn't need unrestricted access to every part of my computer.</span>

>

> This is because photoshop elements is probably designed to work properly,

> or the part of the program that requires admin privileges has been

> Virtualized by UAC. I have even heard of word processors that get a UAC

> prompt when they are started.

>

> --

>

> Ronnie Vernon

> Microsoft MVP

> Windows Desktop Experience </span>