My UAC seems to be broken. Help!

I have a Thinkpad T500 with Win 7 Pro x64 running on it. I have not modified any of the default config and my UAC was working fine till today. Now my UAC is not working Basically I have an Admin account and a standard user account. I log in with my standard user account 99% of the time unless I am required to use the Admin account. So when I am in as my Standard user and I have to do something that requires admin preveliges, I am prompted for a password and hit enter. Then the program continues. Now I am prompted for a password and I enter it in and the screen just stays dark and nothing happens. Any idea on what I can do?

 

@ OP, try adjusting the UAC slider down to where it doesn't switch you to the secure desktop (takes a snapshot and gray's out the screen) and see if the problem occurs.



This might help narrow where the problem is coming from.

 

LOL. Why bother with UAC? Just disable it. =.=!(It annoys me for telling me stupid things which I know what I am doing)
Your System won't destroy without it. Get a PAID Antivirus if you have money or get FREE Antivirus like Microsoft Security Essential, Avast! Home Edition 5 or Avira Antivir Personal 9. These FREE AVs are GREAT!

However, some people said it's CRITICAL and VERY IMPORTANT which I find my PC is still kicking nicely without UAC for years already.

It's up to you. Disable or Enable UAC.

 

I just leave my UAC on, then I don't have to run an anti-virus. Never had a virus or anything similar on Windows 7 period. I guess it helps that I'm double NAT'd and have about 3 firewalls running on various pieces of enterprise grade network equipment.

 

UAC would NEVER help me.. The trojan/virusses/etc i get on my pc is always because i download things i dont suspect to be infected. UAC wouldn't help me, but my antivirus does, most of the time.

With these great free antiviruses theres out there, using that UAC bugger is just useless.

 

Well thanks for the posts guys. I want to keep my UAC on. I have read the people for and against it many times, but I would rather just leave it as default and not worry about it.

In any event, my UAC is working properly again. I have no idea what the heck happened as I did not make any changes to UAC, security settings and did not download any updates. I just logged out of my standard user account, logged in as Admin and did what I was trying to do as my standard user, and then logged back in as the standard user and all is well with the standard user. Weird.

I will say Win 7 is ok, but not great. Certainly not worth upgrading over Vista if it is going to cost a lot of money.

 

Frankly speaking, I don't what the purpose of UAC(I mean it's quite useless). I have all my PCs UAC turned off. All my friends have UAC turned off too. For ages, there's no problem at all.

To those who said you never have a virus or anything with no AV installed in your System and just have UAC enabled. Download a Antivirus and scan your system. FREE AV? MSSE, Avast! HE 5, Avira AP 9. Your call.

 

UAC will only warn for certain activity, there are a ton of things a malware writer can do with the UAC being on.

Browser attacks are an example of an attack type that will pass through firewall / NAT and if the malware writer knows what he/she/it is doing, will be able to bypass the most strict UAC settings.

On the other hand, plenty of attacks and threads will be stopped by UAC, I personally (with Windows being such a mess OS on the inside) would go for both UAC and anti-malware...

 

Whats up with all these standard user, admin user things anyway? Why not just one user with control over your pc? I would hate anything else.

 

http://en.wikipedia.org/wiki/Principle_of_least_privilege

Essentially, you are supposed to do the less major things with the standard user (aka. the normal tasks) and do the more major ones with the admin account (aka. use it as little as possible if the task allows you to), but the distinction between the two has always been kind of hazy in Windows, thanks to the silly way windows originally went with making the normal user an admin...

 

Hey, why not just go back to DOS then, since you apparently have no need for any security at all on your computer? To make this entriely clear, running as an administrator with UAC turned off disables your OS security in its entirety. From a security point of view, this is pretty much equivalent to going back to MS-DOS. Now, I am not telling you what to do with your computer, of course, and if you like using MS-DOS, that is perfectly fine with me. But if you feel that any kind of anti-this-or-that software could even begin to substitute for your OS security, then you are wildly naive.

First of all, obviously, anti-virus software will only, sometimes, prevent infections with known viruses, and any cracker worth his/her salt will test their malware with existing popular AV programs to make sure they go undetected. Viewed this way, as a matter of fact it is anti-virus software which is not entirely, but mostly useless. On the other hand, a properly configured modern operating system will prevent malware from making any kind of system-wide changes at all, with 100% reliability.

Of course, the malware could still affect your user space, but, a), most malware writers rely on users being as naive, assuming their code will be free to happily do whatever it wants on their system, which means that most malware will not be effective on a properly configured system, and b), the manipulations that are possible of the user's environment are limited, and can easily be reversed from a privileged account.

 

Microsoft actually recommends people create one administrator account they'll use only for the initial system setup (installing software and adding users on your first day with your computer, etc.) then create a standard account for themselves and the rest of the family, as it allows people to only make changes and install software that can only affect their user account. Anything else, and (In windows vista and 7) UAC will ask for the administrator password. This is actually a blessing for family systems, since it's easier to stick with keeping everyone on limited accounts because you can accept UAC prompts on a case by case basis.

It also makes it safer if your the only one that uses your computer, because it'll provide more than just a "yes or no" box that comes up when your an administrator, so no suspicious people can mess with your settings if you step out for a second and forget to lock your computer or something.

Although Microsoft recommended this since XP SP2, it was hard to actually do IRL because XP didn't have UAC. The closest thing was the "Run As..." right click command. And that only worked on some things...not everything. As a result, most XP users run themselves as a administrator and probably lock down the accounts for their kids..I say probably because if the kids decide they like to game..you have to reluctantly give them a admin account and hope they don't go crazy downloading crap.

I've ran as a standard user on my personal machine since Windows Vista shipped, and have had little to no issue. It's really not that bad, esp. since if I want to install something, I don't have to log out..I just accept the UAC prompt.

 

As a matter of fact, the distinction between the two has always been perfectly clear, since the days of Windows NT 3.1.

 

Maybe to us, yes. But NT was what Average Joe/Jane used at work. When he came home, he hopped on his Windows 9x machine and had free reign, no need to worry about what account he was using. (most 9x systems never had user accounts set up, and even then there was no choice for creating a limited access account)

When XP came out in 2001, it was a big change, shoving the concept of User Accounts front and center for home users. Instead of possibly taking advantage of this to hone their message regarding the importance of using a Standard/Limited account, they decided to make the first account the administrator. This makes sense from a usability standpoint, esp. since RunAs was kinda tricky to use, and would make Average Joe freak out as to why his crossword app from the Windows 98 days wouldn't run....or start with a error message...

 

I am aware of the distinction, and Windows NT has been the basis for every Windows release since Windows 2000, I was referring to the fact that since so many programs have been written for Windows XP, and since at least at the first versions (I think XP SP3 fixes this, but I am not sure) the default user is an admin, too many programs just go ahead and assume that the user has admin rights. So in action, the user has to run many applications with admin rights, leading to the principle of least privilege not being followed (and that's what I meant by the hazy distinction between user and admin)

 

Well, yes, Win9x systems were strongly based on MS-DOS, and had no concept of operating system security at all. Even the file system they used had no support of any kind for security.

The reason for this choice of Microsoft is clear: They had the problem that a very large portion of the third-party software out there was written by outfits who had no concept of OS security, and wrote their software as if it was still running on an MS-DOS box. Microsoft thus faced the prospect of delivering an OS that would appear incompatible with a significant part of the existing software. In particular, just about none of the existing games would have run for regular users. Faced with that prospect, they chose the easy way out, and made users admins by default. It is a choice that can be criticized, but it must be understood that the situation was not Microsoft's fault alone.

That is not quite accurate. There would have been no issue at all if indeed software had been written for XP. The problem was that, many years after Microsoft had published the requirements for proper coding of Windows programs, people were still selling software for Windows XP that was coded for MS-DOS (or Win3.x/Win9x/WinME). I have run my machines as a limited user since Win2K, but that required quite a bit of advanced tweaking for certain software packages (CAD software, interestingly enough, was among the worst offenders...) Whenever feasible, even in those days I made a point of returning such software, reminding the developers that there code was simply not compatible with Windows.

Again, this is inaccurate, or at least misleading. At the very least, the fault for this situation lies entirely with third-party software developers that are incompetent to properly code their software.

 

If the PC is really Personal Computer(1 person use everyday and permanent), ignore creating a lot of accounts. Pointless to do so and sometime can be annoying.

Who want to play super safe like living inside the Police Station, then, go for UAC and AV.
Else, who want to just live in a free world and braver slightly(a bit enough already), then, just go for AV without UAC.
Simple.

 

The above is complete nonsense, of course. OS security in general, and UAC in particular have nothing whatsoever to do with freedom or lack thereof. But, yes, if your computer is essentially nothing but a toy, then none of this probably matters. For those of us who have things that matter on their computers, a minimum amount of system security is a necessity.

 

This is largely incorrect.
Malware is about running an executable file on your system.
UAC will alert if this happens.
If your not installing something and just browsing normally click no.
Malware stopped.

There is no way around UAC for malware , unless user gives permission for it to run.

Now users may give permission due through a social engineering attack or by not knowing anything about PC security or how UAC works .
But those things are outside the scope of UAC itself.

 

The list of things that will trigger a UAC prompt is here : http://en.wikipedia.org/wiki/User_Account_Control#Tasks_that_trigger_a_UAC_prompt

Now you can do a browser based attack and take over a single thread, one of the less complex attacks is buffer overrun : http://en.wikipedia.org/wiki/Buffer_overrun
(Albeit ASLR/DEP has made Vista/Windows 7 more resistant to buffer overrun attacks, many browsers - for a variety of reasons, like badly written plug-ins - can still be compromised by these attacks).

A browser-based attack thus can take over a thread in the browser, in that stage it can just infect executable files, inject code into applications belonging to the same user. It can also use another attack and just do an escalation of privilege : http://en.wikipedia.org/wiki/Privilege_escalation , then do what it wants without the UAC showing up.

Do not underestimate the browser-based attacks, that's part of the reason why there are so many applications that have sandbox features just for the browser (the latest version of Kaspersky added a sandbox feature). Considering that there is enough benefit in making huge botnets, and with browser attacks being one of the major infection vectors, do not underestimate these attacks...

 

Can we get back on topic guys? The OP just wanted to know how to fix a broken UAC, not opinions on whether you should or should not use it. Thanks.

 

Disabling it will disable other things like IE protected mode and file virtualization, if you want viruses then keep it disabled.

 

Well, here is another update. My UAC is working but my whole OS has become unstable. I logged in with my usual Standard user account and my whole MS Office suite stopped working, as in I couldn't open ANY documents with it. Also half my desktop icons are mysteriously gone Looks like this UAC problem might have been pointing to a bigger issue here. I will just reformat and reinstall everything from scratch. I don't mind except it is a little time consuming.

 

yeah, looks like something greater has happened. Hopefully you can make it until you have time to reformat and start anew.