Benefits of UAC?

What are the benefits of UAC? It's getting really annoying for me now, I need to be convinced that I need it.

 

One benefit: You get finger exercise!

Seriously? - Ditch it.

 

Unless you are a complete newbie to computing, you can turn it off.

 

"Benifits of UAC" is the greatest oxymoron I've ever seen.

 

How about a constructive post here...other than "it sucks", I think it would be helpful to know WHY it sucks, or why only a complete n00b would need to leave it enabled.

I'm not a n00b...but as far as UAC is concerned, I'm definitely a n000b, so teach on!

 

No.

http://en.wikipedia.org/wiki/User_Account_Control

 

Think of UAC as a firewall that is paranoid about everything. If you sneeze, it tells you it stopped your malicious sneeze before it was done and asks you if you want to continue.

 

UAC Disabled thank you guys

 

UAC is a *****, turn it off.

 

Well in case you want an actual answer to your question...

Essentially, UAC is a step toward fixing what's traditionally been Windows' biggest security problem (ok except for user stupidity): that most people run everything as admin with full privileges, so any malicious software that can run can immediately do anything it wants to your machine.

It has nothing to do with whether you're a "complete newbie" or not. If you're the victim of a buffer overflow exploit (say on a malicious web page or media file for example), it won't matter if you're a novice or not but it will matter if you're running UAC. Because with UAC you're running in a lower-privilege mode, so the exploit won't be able to do much.

As for it being annoying... it's fairly easy to prevent it from coming up too often. It comes up all the time at first when you install your programs and put your control panel settings the way you like them... but then it shouldn't come up much anymore. Are you saving files to the drive root (C:\)? Well don't. Create a folder somewhere, preferably under your home dir, make sure you have permissions, and save stuff there. Are you tweaking settings or installing and uninstalling programs every day? Why? It shouldn't be popping up much (if at all) when just using applications normally.

 

thanks for this great explanation.

 

rep point added

 

There are some benefits... Main ones for me...

File & Registry Virtualization and IE Protected Mode...

Now ActiveX junk that I have to install for coursework or to download stuff (thanks Adobe) won't have actual access to my HD

 

Yep... that too.

 

It seems to me like all it is, is a brute force "are you sure" step before certain type programs can run that may alter the system.

And maybe that's the only way to accomplish the goal. But it's hard for me to believe there isn't a more clever solution that doesn't involve adding an extra step for the user. I'd like to get paid 0.001 cents for every time someone has to click "Continue".

It would be nice if the OS could do a better job of figuring out what's malicious and what's not on its own. But if something like that just isn't possible or just isn't available, I guess the UAC feature at least covers Microsoft's butt. Anytime something bad happens, they could ask "did you disable UAC?".

One more gripe. For first time Vista users, since the UAC feature is probably the very first real difference you notice, Microsoft should anticipate that a LOT of people may decide to disable it or try it both ways.

But from what I've seen and read, when you switch back and forth between enabling and disabling UAC, over time, it can lead to issues with certain types of user files. Did this not get tested?

 

I've heard the same, that while UAC is on it puts files in specific locations that aren't accessible while it is off. Maybe it's vice-versa?

 

It doesn't say "are you sure"... does it? It says "If you started this action, click Continue." In other words, if you aren't trying to launch this program and some malware is trying to launch it, then click Cancel.

While the prompt may also cause some users to think twice about their own actions, that's more of a secondary benefit.

Some users having protection from UAC is better than no users having it.

Yeah, I agree that this is a problem (based on what I've read).

 

swarmer, I don't disagree with anything you've said.

Frankly, I like having the choice of UAC on or off, as opposed to not having it available at all.

But, it's the last point that really bugs me (with UAC on, it puts certain files in locations not available with UAC off). Again, MS has to anticipate people are going to be changing this UAC setting around until they decide which way the want to go, and IT SHOULD BE TESTED AND PROBLEM FIXED, instead of using the general population for their beta. I'm not saying it's realistic to have a bug free new OS, but this particular issue seems like one that should have been caught in my opinion, since it is an expensive OS.


By the way, a lot of times it isn't me that initiates the action that pops up the UAC window, rather it happens during startup. There are certain apps that cause UAC to come up every single time I boot up, even if I've accepted them with a "Continue" in the past. Thus I can't simply log in and walk away, to let Vista take its good old time to finish. Instead I have to stick around to hit Continue a couple of times (I think due to bloatware pre-installed on the laptop that I haven't taken the time to remove, so it's partially my fault).

 

I agree with you that you should be able to turn it on and off without messing things up. Based on the Wikipedia UAC article, it sounds like in most cases it's just a matter of re-setting your user preferences though, right? Still, that's an annoyance though.

For some reason I thought it wouldn't pop up UAC prompts during startup... but I guess I'm wrong. What are you running at startup that's bringing up UAC? Does it say what program it is in the UAC dialog box?

 

That's the problem... The OS should NEVER be deciding what is and what isn't malicious. The user should ALWAYS be the one deciding what is and what isn't safe. The OS should only offer suggestions.

If Windows, or any OS I use, ever decided to tell me what programs I could run I'd leave it alone, period.

UAC does a good job at what its there for. Letting you know things are happening where you might not expect.

It can use some work though... Too many prompts with too little information IMHO.

There is no way around that annoyance... MS knows the only people who will be tinkering with UAC will be technically inclined users who can figure out the solution to that issue. Other users will just leave UAC on and it won't be an issue...

Since a program can stick stuff anywhere in the virtualized file system or registry they can't really offer an "automated" way to move them to a place the programs will expect.

Besides who is going to be disabling and re-enabling UAC on a regular basis?

 

Yep. It's something that should have been fixed 15 years ago (at least).
Now they're trying to retrofit it, and that causes some problems.

But ultimately, UAC is a very good thing. There are some serious problems in its actual implementation though.

But as you said, it can be configured so it doesn't pop up as often. (And there are a lot of things where it only pops up once. if you accept, then it'll never ask you about that again. So after a few days, you don't see many UAC prompts at all)

When I ran Vista, the UAC prompts didn't bother me much. Sure, you had to click a few times extra when installing a program, and it was rubbish at informing you *what* action it is you're authorizing. (And in a sane world, it should ask you for a password instead of just ok/cancel), and it pops up more often than is strictly necessary.
But I could live with it.

It was another, less obvious effect of it that made me switch back to XP. It won't let you run apps that require admin privileges at startup. At all.
If you add such an app to your startup list, it gets blocked. No way to whitelist it, to say "Yes, I know this app sucks because it only runs as admin, but I still need it, so pleeeeeease let it start when I load Windows".
Only way to solve that was to disable UAC.... entirely... Well done, Microsoft. To solve a minor transitional problem (because Windows has never before enforced this stuff, so there *is* a lot of badly behaving apps out there), they force you to disable *every* security enhancement in Vista.

 

I did that the very first day of Vista. And although Jalf said it all (as usual, I always seem to read his post first, and then reply... )

First, what if you make a shortcut to your app and click "Run as Administrator" and put it in your Startup or Run in registry with UAC enabled, would it still block it? YES!

BUT!

If you do a trick with the Windows Task Scheduler and do something like this: http://blog.gerke-preussner.de/inde...cking-Elevated-Startup-Programs-in-Vista.html

You can actually start programs at LOGON with admin privileges! I didn't have this need, but perhaps it is satisfactory for the most.

So Jalf, although I probably know your answer, here is at least one thing that can be done to mitigate one Vista issue if you ever install Vista on your comp again.

I hope this works for you,

Ivan

 

I agree.

I said that? Well, your computer can be configured so UAC doesn't need to pop up as often... just by for example setting up your file and folder permissions properly and putting files in folders you own.

That's not been my experience. UAC makes you give authorization every time you want to run a program that needs admin privileges. You can agree with that or not, but it's done that way so that software developers will actually fix their apps so that not much requires admin privileges.

It tells you what program you're authorizing.

It's easy to set it up to ask for a password instead of just ok/cancel. Change your user type from Administrator to Standard User and it will ask for a password. That's what I do. (You have to create another admin user first though, since there has to be at least one active admin user.)

If you have Business or Ultimate edition, you can fine-tune it further in Control Panel > System & Maintenance > Administrative Tools > Local Security Policy.

As for pop-ups more often than strictly necessary... so far I've only found this to be the case in Explorer, when you don't have permissions in the directory you're meddling in. However, I know there have been some updates to reduce the number of extraneous UAC prompts, and I never ran Vista without those updates.

I have mixed feelings about the lack of "setuid" capability (i.e. an authorize this app indefinitely feature)... although they did have some good reasons for choosing not to allow that... see this article. Essentially, app developers would never fix their apps.

But... does this really need to be run automatically at startup? If you sleep or hibernate your computer, you rarely need to start up. If you have multiple apps needing authorization, you can make a batch file, so you only need to approve the UAC prompt once for all the apps that need to run priviliged when you start your computer. I guess you still can't get the apps needing privilege (or this batch file) to run at startup, but... you can launch them immediately after startup, which as I mentioned, need not be very often if you use sleep or hibernate.

But why go back to XP? Why not just turn off UAC? It doesn't turn off all the new security features (although it turns off most of them maybe). You still have Address Space Layout Randomizer even without UAC, which makes you less susceptible to buffer overflow exploits. So I would consider Vista's security better than XP's even with UAC off.

Pretty clever!

 

UAC is nice.... finally people wil stop extracting things directly to c:\ OR c:\windows\

Has anyone ever seen how a pc gets on Windows XP inside an accounting firm... MY GOD... i've found documents saved in System32 and they said they could not find them....

I LOVE VISTA... now everytime they have a problem... READ THE SCREEN... it's self explainatory...

 

I turned UAC back on. The main thing it is popping up on during startup is Client Security Services, which is a Lenovo application. My Thinkpad came loaded with quite a few things I don't fully understand yet. The second one isn't popping up anymore, but I remember what it was, and it was really my fault. It was Adobe Updater trying to update Acrobat. I had been refusing it access when UAC came up during startup. But when I disabled UAC, it finally had a chance to finish, so now that UAC doesn't pop up during startup anymore.

But I'm sure that if the Adobe updater tries again, the same thing will happen during startup. I need to get rid of the auto update feature I think.

Regarding the Client Services thing though, I've hit "Continue" many times on that when it starts up, but it always asks me during the next startup anyway. I guess I need to go into Administrative Services and disable that application. A lot of my problems would be solved if I did a clean install probably, but there are somethings bundled with the Thinkpad that I kind of like.

Once I get to where UAC doesn't popup during startup anymore, I'm going to leave it on.

Regarding turning UAC on and off, I agree it isn't likely people will be turning it on and off a lot, but while trying to figure out what works best for them, it might happen (that's what I'm doing at the moment as I experiment).

 

I've never had a UAC prompt on startup. I don't have any Adobe software installed though. If it's just the pdf reader, I suggest uninstalling it and using FoxIt Reader instead. (Of course if you prefer Adobe, I'm sure you can turn off the startup thing somehow....)

But in Vista it's not necessary to start up often anyway... I usually sleep or hibernate instead of shut down, so I only restart occasionally.

 

Well, I've had to restart my T60 way more often than I would like to. Let me digress.

Not sure where exactly the problem lies, but between Vista, my T60, and CA Security Suite Firewall, I keep losing wireless network connection when I wake up out of sleep or hibernate (happens about 30% of the time).

I don't have this problem on my desktop running XP on the same wireless network (also running CA Security Suite) nor my laptop from work. This has been the single most frustrating thing I've been fighting with on this laptop since I got it. Sometimes it happens out of the blue if I visit certain websites (e.g. RoadRunners home page???)

I know my firewall is partly to blame, cause disabling it sometimes fixes the problem. I should dump CA Security Suite, but it comes free with RoadRunner thus I like the price. I've been reading about other security suites (PC Magazine latest issue recommends either Norton 360, Norton Suite 2008, or ZoneAlarm Suite). Anyway, I'll take this issue to another thread. The result however is that I've been doing a lot of restarts.

 

Question for you guys...I don't mind having UAC on, but I am thinking of disabling it because I might be able to finally run RM Clock on my Vista x64 rig. Since I've been running it since I booted Vista, will I experience a lot of problems with "missing files" b/c of the what had been mentioned earlier?

Some what unrelated to topic:
I'd also have to disable Windows Defender (good/bad idea?)

Thanks!

 

A couple other options:

- Run it manually, leave it running, and sleep or hibernate most of the time instead of shutting down.
- Use the run-on-startup hack that ikovac mentioned.

Why? In any case, I recommend having some sort of real-time spyware protection... even though it's somewhat less essential when UAC is on, it's still a good idea... so if you disable Defender, find an alternative... look in the Windows Security subforum for some suggestions.