Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

RE: ANS: "What's the deal with UAC (Windows Needs Your Permission scre

microsoft.public.windows.vista.security






Speedup My PC
Reply
  #1 (permalink)  
Old 12-17-2007
johns
 

Posts: n/a
RE: ANS: "What's the deal with UAC (Windows Needs Your Permission scre


"Jimmy Brush" wrote:

> Hello,
>
> I've noticed that a lot of the questions in these newsgroups are either
> directly or indirectly related to UAC (User Account Control). In this post,
> I will go over what UAC does, how it works, the reasoning behind it, how to
> use your computer with UAC on, why you shouldn't turn UAC off, and answer
> some common questions and respond to common complaints about it.
>
>
> * What is UAC and what does it do?
>
> UAC mode (also known as Admin Approval Mode) is a mode of operation that
> (primarily) affects the way administrator accounts work.
>
> When UAC is turned on (which it is by default), you must explicitly give
> permission to any program that wants to use "administrator" powers. Any
> program that tries to use admin powers without your permission will be
> denied access.
>
>
> * How does UAC work
>
> When UAC mode is enabled, every program that you run will be given only
> "standard user" access to the system, even when you are logged in as an
> administrator. There are only 2 ways that a program can be "elevated" to get
> full admin access to the system:
>
> - If it automatically asks you for permission when it starts up, and you
> click Continue
> - If you start the program with permission by right-clicking it, then
> clicking Run As Administrator
>
> A program either starts with STANDARD rights or, if you give permission,
> ADMINISTRATOR rights, and once the program is running it cannot change from
> one to the other.
>
> If a program that you have already started with admin powers starts another
> program, that program will automatically be given admin powers without
> needing your permission. For example, if you start Windows Explorer as
> administrator, and then double-click on a text file, notepad will open and
> display the contents of the text file. Since notepad was opened from the
> admin explorer window, notepad WILL ALSO automatically run WITH admin
> powers, and will not ask for permission.
>
>
> * What's the point of UAC?
>
> UAC is designed to put control of your computer back into your hands,
> instead of at the mercy of the programs running on your computer.
>
> When logged in as an administrator in Windows XP, any program that could
> somehow get itself started could take control of the entire computer without
> you even knowing about it.
>
> With UAC turned on, you must know about and authorize a program in order for
> it to gain admin access to the system, REGARDLESS of how the program got
> there or how it is started.
>
> This is important to all levels of users - from home users to enterprise
> administrators. Being alerted when any program tries to use admin powers and
> being able to unilaterally disallow a program from having such power is a
> VERY powerful ability. No longer is the security of the system tantamount to
> "crossing one's fingers and hoping for the best" - YOU now control your
> system.
>
>
> * How do I effectively use my computer with UAC turned on?
>
> It's easy. Just keep in mind that programs don't have admin access to your
> computer unless you give them permission. Microsoft programs that come with
> Windows Vista that need admin access will always ask for admin permissions
> when you start them. However, most other programs will not.
>
> This will change after Windows Vista is released - all Windows Vista-era
> programs that need admin power will always ask you for it. Until then, you
> will need to run programs that need administrative powers that were not
> designed for Windows Vista "as administrator".
>
> Command-line programs do not automatically ask for permission. Not even the
> built-in ones. You will need to run the command prompt "as administrator" in
> order to run administrative command-line utilities.
>
> Working with files and folders from Windows Explorer can be a real pain when
> you are not working with your own files. When you are needing to work with
> system files, files that you didn't create, or files from another operating
> system, run Windows Explorer "as administrator". In the same vein, ANY
> program that you run that needs access to system files or files that you
> didn't create will need to be ran "as administrator".
>
> If you are going to be working with the control panel for a long time,
> running control.exe "as administrator" will make things less painful - you
> will only be asked for permission once, instead of every time you try to
> change a system-wide setting.
>
> In short:
>
> - Run command prompt as admin when you need to run admin utilities
> - Run setup programs as admin
> - Run programs not designed for Vista as admin if (and only if) they need
> admin access
> - Run Windows Explorer as admin when you need access to files that aren't
> yours or system files
> - Run programs that need access to files that aren't yours or system files
> as admin
> - Run control.exe as admin when changing many settings in the control panel
>
>
> * UAC is annoying, I want to turn it off
>
> Having to go through an extra step (clicking Continue) when opening
> administrative programs is annoying. And it is also very frustrating to run
> a program that needs admin power but doesn't automatically ask you for it
> (you have to right-click these programs and click Run As Administrator for
> them to run correctly).
>
> But, keep in mind that these small inconveniences are insignificant when
> weighed against the benefit: NO PROGRAM can get full access to your system
> without you being informed. The first time the permission dialog pops up and
> it is from some program that you know nothing about or that you do not want
> to have access to your system, you will be very glad that the Cancel button
> was available to you.
>
>
> * Answers to common questions and responses to common criticism
>
> Q: I have anti-virus, a firewall, a spyware-detector, or something similar.
> Why do I need UAC?
>
> A: Detectors can only see known threats. And of all the known threats in
> existence, they only detect the most common of those threats. With UAC
> turned on, *you* control what programs have access to your computer - you
> can stop ALL threats. Detectors are nice, but they're not enough. How many
> people do you know that have detectors of all kinds and yet are still
> infested with programs that they don't want on their computer? Everyone that
> I have ever helped falls into this category.
>
>
> Q: Does UAC replace anti-virus, a firewall, a spyware-detector, or similar
> programs?
>
> A: No. Microsoft recommends that you use a virus scanner and/or other types
> of security software. These types of programs compliment UAC: They will get
> rid of known threats for you. UAC will allow you to stop unknown threats, as
> well as prevent any program that you do not trust from gaining access to
> your computer.
>
>
> Q: I am a system administrator - I have no use for UAC.
>
> A: Really? You don't NEED to know when a program on your computer runs with
> admin powers? You are a system administrator and you really could care less
> when a program runs that has full control of your system, and possibly your
> entire domain? You're joking, right?
>
>
> Q: UAC keeps me from accessing files and folders
>
> A: No, it doesn't - UAC protects you from programs that would try to delete
> or modify system files and folders without your knowledge. If you want a
> program to have full access to the files on your computer, you will need to
> run it as admin. Or as an alternative, if possible, put the files it needs
> access to in a place that all programs have access to - such as your
> documents folder, or any folder under your user folder.
>
>
> Q: UAC stops programs from working correctly
>
> A: If a program needs admin power and it doesn't ask you for permission when
> it starts, you have to give it admin powers by right-clicking it and
> clicking Run As Administrator. Programs should work like they did in XP when
> you use Run As Administrator. If they don't, then this is a bug.
>
>
> Q: UAC keeps me from doing things that I could do in XP
>
> A: This is not the case. Just remember that programs that do not ask for
> permission when they start do not get admin access to your computer. If you
> are using a tool that needs admin access, right-click it and click Run As
> Administrator. It should work exactly as it did in XP. If it does not, then
> this is a bug.
>
>
> Q: UAC is Microsoft's way of controlling my computer and preventing me from
> using it!
>
> A: This is 100% UNTRUE. UAC puts control of your computer IN YOUR HANDS by
> allowing you to prevent unwanted programs from accessing your computer.
> *Everything* that you can do with UAC turned off, you can do with it turned
> on. If this is not the case, then that is a bug.
>
>
> Q: I don't need Windows to hold my freaking hand! I *know* what I've got on
> my computer, and I *know* when programs run! I am logged on as an
> ADMINISTRATOR for a dang reason!
>
> A: I accept the way that you think, and can see the logic, but I don't agree
> with this idea. UAC is putting POWER in your hands by letting you CONTROL
> what runs on your system. But you want to give up this control and allow all
> programs to run willy-nilly. Look, if you want to do this go right ahead,
> you can turn UAC off and things will return to how they worked in XP. But,
> don't be surprised when either 1) You run something by mistake that messes
> up your computer and/or domain, or 2) A program somehow gets on your
> computer that you know nothing about that takes over your computer and/or
> domain, and UAC would have allowed you to have stopped it.
>
>
> - JB
>
> Vista Support FAQ
> http://www.jimmah.com/vista/
> ok i understand the benifit to uac but you should have made it so when it

gets permission for a program that you have installed it stops asking every
time you boot up that is why i will stop using it i dont think it built
right yet still needs some work
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 12-19-2007
Ronnie Vernon MVP
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
"johns" <johns@discussions.microsoft.com> wrote in message
news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
>> ok i understand the benifit to uac but you should have made it so when it

> gets permission for a program that you have installed it stops asking
> every
> time you boot up that is why i will stop using it i dont think it built
> right yet still needs some work


This is a misconception that many people have.

When a program asks for your permission to run with a UAC prompt, this means
that program is asking for complete and unrestricted access to every part of
your computer. This keeps you in control of what is happening on your
machine.

If you were able to allow access for this program to run, without notifying
you, it would be very easy for a separate, malicious program to gain access
to your computer by 'piggybacking' on this programs unrestricted access.

At this point, it would no longer be 'your' computer.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User

Reply With Quote
  #3 (permalink)  
Old 12-19-2007
Michael Jennings
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
"Ronnie Vernon MVP" <rv@invalid.org> wrote in message
news:C654FD2B-E84E-4A1E-85E2-337484F893BF@microsoft.com...
> "johns" <johns@discussions.microsoft.com> wrote in message
> news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
>>> ok i understand the benifit to uac but you should have made it so when it

>> gets permission for a program that you have installed it stops asking every
>> time you boot up that is why i will stop using it i dont think it built
>> right yet still needs some work

>
> This is a misconception that many people have.
>
> When a program asks for your permission to run with a UAC prompt, this means
> that program is asking for complete and unrestricted access to every part of
> your computer. This keeps you in control of what is happening on your machine.
>
> If you were able to allow access for this program to run, without notifying
> you, it would be very easy for a separate, malicious program to gain access to
> your computer by 'piggybacking' on this programs unrestricted access.
>
> At this point, it would no longer be 'your' computer.


If another application launches the trusted application, Ronnie, the user can
be notified that this is the case. The hijack can then be allowed or denied by
the user. Further, if the CRC of the trusted application changes, the user can
be notified that's so, and if there is no reason it should have changed it can
be
forbidden to run by the user. Maybe this is rocket science, but if Sygate could
accomplish it with their firewall, then I suppose Microsoft could accomplish it
with their UAC. It was simpler to put more of a burden on the user - showing
a lack of consideration for the user meant less coding effort. They chose.


Reply With Quote
  #4 (permalink)  
Old 12-19-2007
Mark
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
The misconception is that this method works.

1. The user is frustrated with this method, because:
a. Doesn't understand why three prompts must be answered to delete a
file in the Programs(x86) folder.
b. No useful information is provided in any of the prompts as to what is
really being done that requires permission.
e.g. "A change to the Programs(x86) folder has been initiated by
program xxx."
"Program xxx is attempting to create a directory under
C:\Users\UserName."

Instead we get something like, "Administrator priveledges are
required for this function. Do you wish to continue?"
What function?

2. End result:
a. "Of course I want to Continue." Click

3. All that MS has done is protect themselves by giving themselves the
ability to state, "You were warned by a prompt that 'something' was
happening and you clicked 'continue.' It's not our fault."

I've stated this before:
Put UAC on your car's ignition switch.
When you select Start, you get a prompt on the Speedometer glass,
"Owner's permission required to continue. Do you wish to continue?"
And you can feel safe that your car can never be used without your
permission by those nefarious individuals out there.



"Ronnie Vernon MVP" <rv@invalid.org> wrote in message
news:C654FD2B-E84E-4A1E-85E2-337484F893BF@microsoft.com...
> "johns" <johns@discussions.microsoft.com> wrote in message
> news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
> >> ok i understand the benifit to uac but you should have made it so when

it
> > gets permission for a program that you have installed it stops asking
> > every
> > time you boot up that is why i will stop using it i dont think it built
> > right yet still needs some work

>
> This is a misconception that many people have.
>
> When a program asks for your permission to run with a UAC prompt, this

means
> that program is asking for complete and unrestricted access to every part

of
> your computer. This keeps you in control of what is happening on your
> machine.
>
> If you were able to allow access for this program to run, without

notifying
> you, it would be very easy for a separate, malicious program to gain

access
> to your computer by 'piggybacking' on this programs unrestricted access.
>
> At this point, it would no longer be 'your' computer.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>



Reply With Quote
  #5 (permalink)  
Old 12-20-2007
Ronnie Vernon MVP
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
Mark

If you are seeing more than 1 prompt for an action, these are not all coming
from UAC. You are probably seeing an 'access denied' prompt first which is
comes from the 'Shell' because of the permissions that are set on the
destination folder/file.

You can click the Details button on the UAC prompt that shows the action is
being initiated.

You can also bypass the UAC prompt, depending on your use of the program. If
this is an application that you are using constantly, you can create a
Scheduled Task to start the program. Set it to start with certain triggers,
such as at boot time or...., and set it to run with highest privileges.

Your example of starting the car is a good one, but you forget that you have
already proven ownership and given permission when you insert the proper
key. This would only be a good example if every car was equipped with a
toggle switch instead of a unique key.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Mark" <jmhonzell@nospam.insightbb.com> wrote in message
news:eCRQVtnQIHA.5692@TK2MSFTNGP04.phx.gbl...
> The misconception is that this method works.
>
> 1. The user is frustrated with this method, because:
> a. Doesn't understand why three prompts must be answered to delete a
> file in the Programs(x86) folder.
> b. No useful information is provided in any of the prompts as to what
> is
> really being done that requires permission.
> e.g. "A change to the Programs(x86) folder has been initiated
> by
> program xxx."
> "Program xxx is attempting to create a directory under
> C:\Users\UserName."
>
> Instead we get something like, "Administrator priveledges are
> required for this function. Do you wish to continue?"
> What function?
>
> 2. End result:
> a. "Of course I want to Continue." Click
>
> 3. All that MS has done is protect themselves by giving themselves the
> ability to state, "You were warned by a prompt that 'something' was
> happening and you clicked 'continue.' It's not our fault."
>
> I've stated this before:
> Put UAC on your car's ignition switch.
> When you select Start, you get a prompt on the Speedometer glass,
> "Owner's permission required to continue. Do you wish to continue?"
> And you can feel safe that your car can never be used without your
> permission by those nefarious individuals out there.
>
>
>
> "Ronnie Vernon MVP" <rv@invalid.org> wrote in message
> news:C654FD2B-E84E-4A1E-85E2-337484F893BF@microsoft.com...
>> "johns" <johns@discussions.microsoft.com> wrote in message
>> news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
>> >> ok i understand the benifit to uac but you should have made it so when

> it
>> > gets permission for a program that you have installed it stops asking
>> > every
>> > time you boot up that is why i will stop using it i dont think it
>> > built
>> > right yet still needs some work

>>
>> This is a misconception that many people have.
>>
>> When a program asks for your permission to run with a UAC prompt, this

> means
>> that program is asking for complete and unrestricted access to every part

> of
>> your computer. This keeps you in control of what is happening on your
>> machine.
>>
>> If you were able to allow access for this program to run, without

> notifying
>> you, it would be very easy for a separate, malicious program to gain

> access
>> to your computer by 'piggybacking' on this programs unrestricted access.
>>
>> At this point, it would no longer be 'your' computer.
>>
>> --
>>
>> Ronnie Vernon
>> Microsoft MVP
>> Windows Shell/User
>>

>
>


Reply With Quote
  #6 (permalink)  
Old 12-20-2007
Mark
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
My car analogy was indicating a thief would bypass the ignition and still
get the prompt where they simply click Continue.

The other details are excellent information, but my point was regarding the
"typical frustrated user."


"Ronnie Vernon MVP" <rv@invalid.org> wrote in message
news:436500E4-7DE0-4118-AC3B-AD2DDB8D464D@microsoft.com...
> Mark
>
> If you are seeing more than 1 prompt for an action, these are not all
> coming from UAC. You are probably seeing an 'access denied' prompt first
> which is comes from the 'Shell' because of the permissions that are set on
> the destination folder/file.
>
> You can click the Details button on the UAC prompt that shows the action
> is being initiated.
>
> You can also bypass the UAC prompt, depending on your use of the program.
> If this is an application that you are using constantly, you can create a
> Scheduled Task to start the program. Set it to start with certain
> triggers, such as at boot time or...., and set it to run with highest
> privileges.
>
> Your example of starting the car is a good one, but you forget that you
> have already proven ownership and given permission when you insert the
> proper key. This would only be a good example if every car was equipped
> with a toggle switch instead of a unique key.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>
> "Mark" <jmhonzell@nospam.insightbb.com> wrote in message
> news:eCRQVtnQIHA.5692@TK2MSFTNGP04.phx.gbl...
>> The misconception is that this method works.
>>
>> 1. The user is frustrated with this method, because:
>> a. Doesn't understand why three prompts must be answered to delete a
>> file in the Programs(x86) folder.
>> b. No useful information is provided in any of the prompts as to what
>> is
>> really being done that requires permission.
>> e.g. "A change to the Programs(x86) folder has been initiated
>> by
>> program xxx."
>> "Program xxx is attempting to create a directory under
>> C:\Users\UserName."
>>
>> Instead we get something like, "Administrator priveledges are
>> required for this function. Do you wish to continue?"
>> What function?
>>
>> 2. End result:
>> a. "Of course I want to Continue." Click
>>
>> 3. All that MS has done is protect themselves by giving themselves the
>> ability to state, "You were warned by a prompt that 'something' was
>> happening and you clicked 'continue.' It's not our fault."
>>
>> I've stated this before:
>> Put UAC on your car's ignition switch.
>> When you select Start, you get a prompt on the Speedometer glass,
>> "Owner's permission required to continue. Do you wish to continue?"
>> And you can feel safe that your car can never be used without your
>> permission by those nefarious individuals out there.
>>
>>
>>
>> "Ronnie Vernon MVP" <rv@invalid.org> wrote in message
>> news:C654FD2B-E84E-4A1E-85E2-337484F893BF@microsoft.com...
>>> "johns" <johns@discussions.microsoft.com> wrote in message
>>> news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
>>> >> ok i understand the benifit to uac but you should have made it so
>>> >> when

>> it
>>> > gets permission for a program that you have installed it stops asking
>>> > every
>>> > time you boot up that is why i will stop using it i dont think it
>>> > built
>>> > right yet still needs some work
>>>
>>> This is a misconception that many people have.
>>>
>>> When a program asks for your permission to run with a UAC prompt, this

>> means
>>> that program is asking for complete and unrestricted access to every
>>> part

>> of
>>> your computer. This keeps you in control of what is happening on your
>>> machine.
>>>
>>> If you were able to allow access for this program to run, without

>> notifying
>>> you, it would be very easy for a separate, malicious program to gain

>> access
>>> to your computer by 'piggybacking' on this programs unrestricted access.
>>>
>>> At this point, it would no longer be 'your' computer.
>>>
>>> --
>>>
>>> Ronnie Vernon
>>> Microsoft MVP
>>> Windows Shell/User
>>>

>>
>>

>


Reply With Quote
  #7 (permalink)  
Old 12-20-2007
Steve Thackery
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
I can't see what all the fuss is about with UAC. I've been running Vista
for almost a year, and I rarely get a UAC prompt. Admittedly they were more
common during the first couple of weeks, when I was installing all my
software and setting everything up as I want it. Since then it has really
been a non-issue.

Tell you what helps: make your account an Administrator (don't worry, it
still runs as a normal user), and set up UAC so you don't have to enter your
password.

That way you just need a single click to dismiss the UAC prompt, and -
provided you are the sole user of your PC - there is no loss of security.

Personally I'm quite glad when Windows warns me that something with security
implications is about to happen.

So:

1/ UAC prompts warn you of possible security risks, so are A GOOD THING

2/ They occur quite rarely, and just need a simple mouse click to dismiss

So what on earth is all the fuss and moaning about?

SteveT

Reply With Quote
  #8 (permalink)  
Old 12-21-2007
Mark
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
PS.
Why would the default permissions be set to prevent administrator use?
It may not be UAC, but it is about as useful and the "regular frustrated
Joe" ain't going to figure it out.
Click... click... click... infected.

"Ronnie Vernon MVP" <rv@invalid.org> wrote in message
news:436500E4-7DE0-4118-AC3B-AD2DDB8D464D@microsoft.com...
> Mark
>
> If you are seeing more than 1 prompt for an action, these are not all

coming
> from UAC. You are probably seeing an 'access denied' prompt first which is
> comes from the 'Shell' because of the permissions that are set on the
> destination folder/file.
>
> You can click the Details button on the UAC prompt that shows the action

is
> being initiated.
>
> You can also bypass the UAC prompt, depending on your use of the program.

If
> this is an application that you are using constantly, you can create a
> Scheduled Task to start the program. Set it to start with certain

triggers,
> such as at boot time or...., and set it to run with highest privileges.
>
> Your example of starting the car is a good one, but you forget that you

have
> already proven ownership and given permission when you insert the proper
> key. This would only be a good example if every car was equipped with a
> toggle switch instead of a unique key.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>
> "Mark" <jmhonzell@nospam.insightbb.com> wrote in message
> news:eCRQVtnQIHA.5692@TK2MSFTNGP04.phx.gbl...
> > The misconception is that this method works.
> >
> > 1. The user is frustrated with this method, because:
> > a. Doesn't understand why three prompts must be answered to delete a
> > file in the Programs(x86) folder.
> > b. No useful information is provided in any of the prompts as to what
> > is
> > really being done that requires permission.
> > e.g. "A change to the Programs(x86) folder has been initiated
> > by
> > program xxx."
> > "Program xxx is attempting to create a directory under
> > C:\Users\UserName."
> >
> > Instead we get something like, "Administrator priveledges are
> > required for this function. Do you wish to continue?"
> > What function?
> >
> > 2. End result:
> > a. "Of course I want to Continue." Click
> >
> > 3. All that MS has done is protect themselves by giving themselves the
> > ability to state, "You were warned by a prompt that 'something' was
> > happening and you clicked 'continue.' It's not our fault."
> >
> > I've stated this before:
> > Put UAC on your car's ignition switch.
> > When you select Start, you get a prompt on the Speedometer glass,
> > "Owner's permission required to continue. Do you wish to continue?"
> > And you can feel safe that your car can never be used without your
> > permission by those nefarious individuals out there.
> >
> >
> >
> > "Ronnie Vernon MVP" <rv@invalid.org> wrote in message
> > news:C654FD2B-E84E-4A1E-85E2-337484F893BF@microsoft.com...
> >> "johns" <johns@discussions.microsoft.com> wrote in message
> >> news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
> >> >> ok i understand the benifit to uac but you should have made it so

when
> > it
> >> > gets permission for a program that you have installed it stops asking
> >> > every
> >> > time you boot up that is why i will stop using it i dont think it
> >> > built
> >> > right yet still needs some work
> >>
> >> This is a misconception that many people have.
> >>
> >> When a program asks for your permission to run with a UAC prompt, this

> > means
> >> that program is asking for complete and unrestricted access to every

part
> > of
> >> your computer. This keeps you in control of what is happening on your
> >> machine.
> >>
> >> If you were able to allow access for this program to run, without

> > notifying
> >> you, it would be very easy for a separate, malicious program to gain

> > access
> >> to your computer by 'piggybacking' on this programs unrestricted

access.
> >>
> >> At this point, it would no longer be 'your' computer.
> >>
> >> --
> >>
> >> Ronnie Vernon
> >> Microsoft MVP
> >> Windows Shell/User
> >>

> >
> >

>



Reply With Quote
  #9 (permalink)  
Old 12-22-2007
Jimmy Brush
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
Windows can't tell with any accuracy "if another application" is launching
the application. That's why all the separation between admin vs. non-admin
is necessary (UIPI, integrity levels, etc). Things that are running on a
user's desktop can interact and intermingle to such a point that it isn't
really possible to say "i know that process A, uninfluenced by any other
process, is launching this trusted app at the user's request". That's why
UAC is necessary, and why it is so important not to allow exceptions.


--
- JB
Microsoft MVP Windows Shell/User

"Michael Jennings" <metarhyme@gmail.com> wrote in message
news:OfUL$ZnQIHA.5976@TK2MSFTNGP05.phx.gbl...
> "Ronnie Vernon MVP" <rv@invalid.org> wrote in message
> news:C654FD2B-E84E-4A1E-85E2-337484F893BF@microsoft.com...
>> "johns" <johns@discussions.microsoft.com> wrote in message
>> news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
>>>> ok i understand the benifit to uac but you should have made it so when
>>>> it
>>> gets permission for a program that you have installed it stops asking
>>> every
>>> time you boot up that is why i will stop using it i dont think it built
>>> right yet still needs some work

>>
>> This is a misconception that many people have.
>>
>> When a program asks for your permission to run with a UAC prompt, this
>> means that program is asking for complete and unrestricted access to
>> every part of your computer. This keeps you in control of what is
>> happening on your machine.
>>
>> If you were able to allow access for this program to run, without
>> notifying you, it would be very easy for a separate, malicious program to
>> gain access to your computer by 'piggybacking' on this programs
>> unrestricted access.
>>
>> At this point, it would no longer be 'your' computer.

>
> If another application launches the trusted application, Ronnie, the user
> can
> be notified that this is the case. The hijack can then be allowed or
> denied by
> the user. Further, if the CRC of the trusted application changes, the user
> can
> be notified that's so, and if there is no reason it should have changed it
> can be
> forbidden to run by the user. Maybe this is rocket science, but if Sygate
> could
> accomplish it with their firewall, then I suppose Microsoft could
> accomplish it
> with their UAC. It was simpler to put more of a burden on the user -
> showing
> a lack of consideration for the user meant less coding effort. They chose.
>


Reply With Quote
  #10 (permalink)  
Old 12-22-2007
Jimmy Brush
 

Posts: n/a
Re: ANS: "What's the deal with UAC (Windows Needs Your Permission scre
Hello,

I would agree that UAC is frustrating (in some circumstances more than
others), and your analogy is correct in the context of living, breathing
users. Whoever is operating the computer while logged in is in control.

Instead, UAC is there to protect users from programs ... it's there to
insure that the programs that are requesting admin power from the user are
doing so at the request of the user.


--
- JB
Microsoft MVP Windows Shell/User

"Mark" <jmhonzell@nospam.insightbb.com> wrote in message
news:B9058E0E-957B-46A2-9E27-46F745AEB788@microsoft.com...
> My car analogy was indicating a thief would bypass the ignition and still
> get the prompt where they simply click Continue.
>
> The other details are excellent information, but my point was regarding
> the "typical frustrated user."
>
>
> "Ronnie Vernon MVP" <rv@invalid.org> wrote in message
> news:436500E4-7DE0-4118-AC3B-AD2DDB8D464D@microsoft.com...
>> Mark
>>
>> If you are seeing more than 1 prompt for an action, these are not all
>> coming from UAC. You are probably seeing an 'access denied' prompt first
>> which is comes from the 'Shell' because of the permissions that are set
>> on the destination folder/file.
>>
>> You can click the Details button on the UAC prompt that shows the action
>> is being initiated.
>>
>> You can also bypass the UAC prompt, depending on your use of the program.
>> If this is an application that you are using constantly, you can create a
>> Scheduled Task to start the program. Set it to start with certain
>> triggers, such as at boot time or...., and set it to run with highest
>> privileges.
>>
>> Your example of starting the car is a good one, but you forget that you
>> have already proven ownership and given permission when you insert the
>> proper key. This would only be a good example if every car was equipped
>> with a toggle switch instead of a unique key.
>>
>> --
>>
>> Ronnie Vernon
>> Microsoft MVP
>> Windows Shell/User
>>
>>
>> "Mark" <jmhonzell@nospam.insightbb.com> wrote in message
>> news:eCRQVtnQIHA.5692@TK2MSFTNGP04.phx.gbl...
>>> The misconception is that this method works.
>>>
>>> 1. The user is frustrated with this method, because:
>>> a. Doesn't understand why three prompts must be answered to delete a
>>> file in the Programs(x86) folder.
>>> b. No useful information is provided in any of the prompts as to what
>>> is
>>> really being done that requires permission.
>>> e.g. "A change to the Programs(x86) folder has been initiated
>>> by
>>> program xxx."
>>> "Program xxx is attempting to create a directory under
>>> C:\Users\UserName."
>>>
>>> Instead we get something like, "Administrator priveledges are
>>> required for this function. Do you wish to continue?"
>>> What function?
>>>
>>> 2. End result:
>>> a. "Of course I want to Continue." Click
>>>
>>> 3. All that MS has done is protect themselves by giving themselves the
>>> ability to state, "You were warned by a prompt that 'something' was
>>> happening and you clicked 'continue.' It's not our fault."
>>>
>>> I've stated this before:
>>> Put UAC on your car's ignition switch.
>>> When you select Start, you get a prompt on the Speedometer glass,
>>> "Owner's permission required to continue. Do you wish to continue?"
>>> And you can feel safe that your car can never be used without your
>>> permission by those nefarious individuals out there.
>>>
>>>
>>>
>>> "Ronnie Vernon MVP" <rv@invalid.org> wrote in message
>>> news:C654FD2B-E84E-4A1E-85E2-337484F893BF@microsoft.com...
>>>> "johns" <johns@discussions.microsoft.com> wrote in message
>>>> news:354E0CF5-3A08-441E-9B3F-772392F24BD0@microsoft.com...
>>>> >> ok i understand the benifit to uac but you should have made it so
>>>> >> when
>>> it
>>>> > gets permission for a program that you have installed it stops asking
>>>> > every
>>>> > time you boot up that is why i will stop using it i dont think it
>>>> > built
>>>> > right yet still needs some work
>>>>
>>>> This is a misconception that many people have.
>>>>
>>>> When a program asks for your permission to run with a UAC prompt, this
>>> means
>>>> that program is asking for complete and unrestricted access to every
>>>> part
>>> of
>>>> your computer. This keeps you in control of what is happening on your
>>>> machine.
>>>>
>>>> If you were able to allow access for this program to run, without
>>> notifying
>>>> you, it would be very easy for a separate, malicious program to gain
>>> access
>>>> to your computer by 'piggybacking' on this programs unrestricted
>>>> access.
>>>>
>>>> At this point, it would no longer be 'your' computer.
>>>>
>>>> --
>>>>
>>>> Ronnie Vernon
>>>> Microsoft MVP
>>>> Windows Shell/User
>>>>
>>>
>>>

>>

>


Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
RE: ANS: "What's the deal with UAC (Windows Needs Your Permission scre johns microsoft.public.windows.vista.file management 0 12-17-2007 20:11
RE: ANS: "What's the deal with UAC (Windows Needs Your Permission scre Julian microsoft.public.windows.vista.administration accounts passwords 1 08-19-2007 20:53
RE: ANS: "What's the deal with UAC (Windows Needs Your Permission scre Julian microsoft.public.windows.vista.general 1 08-19-2007 20:53
RE: ANS: "What's the deal with UAC (Windows Needs Your Permission scre Julian microsoft.public.windows.vista.security 1 08-19-2007 20:53
RE: ANS: "What's the deal with UAC (Windows Needs Your Permission scre =?Utf-8?B?VmlzdGEgdmljdGlt?= microsoft.public.windows.vista.file management 1 03-30-2007 23:53




All times are GMT +1. The time now is 16:01.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120