Security in Vista Business vs. Vista Ultimate

Are the default security settings different in Vista Business than in Vista
Ultimate (both RTM)? I've noticed a special account called
"TrustedInstaller" in Vista Business that has full control permissions for
the system32 folder and files but this account doesn't seem to exist in
Vista Ultimate. I'm trying to install Outlook 2007 Business Contact Manager
under Vista Business and it fails due to a permissions error but it installs
just fine under Vista Ultimate.

Any help is greatly appreciated.

--
Jeff Lynch
MVP Windows Server System - Commerce Server
http://codebetter.com/blogs/jeff.lynch

In article <D62F1EB0-43E1-4721-8E6A-0A5EE5154C64@microsoft.com>,
in the microsoft.public.windows.vista.security news group, Jeff
Lynch [MVP] <jeff.lynch@newsgroup.nospam> says...

> Are the default security settings different in Vista Business than in Vista
> Ultimate (both RTM)? I've noticed a special account called
> "TrustedInstaller" in Vista Business that has full control permissions for
> the system32 folder and files but this account doesn't seem to exist in
> Vista Ultimate. I'm trying to install Outlook 2007 Business Contact Manager
> under Vista Business and it fails due to a permissions error but it installs
> just fine under Vista Ultimate.

Jeff, are these both clean installs of RTM and not upgrade
installs of a previous release? My understanding is that the
TrustedInstaller is gone in the RTM versions of all Vista SKUs.
I've not installed Business yet but I know it is gone from
Ultimate and I know that I read somewhere recently that
TrustedInstaller is gone...

I'll try and throw Business up in a VM today and check.

--
Paul Adare - MVP Virtual Machines
Waiting for a bus is about as thrilling as fishing,
with the similar tantalisation that something,
sometime, somehow, will turn up. George Courtauld

In article <MPG.1fec1e238de5e85998a30d@msnews.microsoft.com >, in
the microsoft.public.windows.vista.security news group, Paul
Adare <padare@newsguy.com> says...

> In article <D62F1EB0-43E1-4721-8E6A-0A5EE5154C64@microsoft.com>,
> in the microsoft.public.windows.vista.security news group, Jeff
> Lynch [MVP] <jeff.lynch@newsgroup.nospam> says...
>
> > Are the default security settings different in Vista Business than in Vista
> > Ultimate (both RTM)? I've noticed a special account called
> > "TrustedInstaller" in Vista Business that has full control permissions for
> > the system32 folder and files but this account doesn't seem to exist in
> > Vista Ultimate. I'm trying to install Outlook 2007 Business Contact Manager
> > under Vista Business and it fails due to a permissions error but it installs
> > just fine under Vista Ultimate.
>
> Jeff, are these both clean installs of RTM and not upgrade
> installs of a previous release? My understanding is that the
> TrustedInstaller is gone in the RTM versions of all Vista SKUs.
> I've not installed Business yet but I know it is gone from
> Ultimate and I know that I read somewhere recently that
> TrustedInstaller is gone...
>
> I'll try and throw Business up in a VM today and check.

Ok, so no TrustedInstaller in a clean install of Business
either.

--
Paul Adare - MVP Virtual Machines
Waiting for a bus is about as thrilling as fishing,
with the similar tantalisation that something,
sometime, somehow, will turn up. George Courtauld

In article <MPG.1fec448edf20b66d98a312@msnews.microsoft.com >, in
the microsoft.public.windows.vista.security news group, Paul
Adare <padare@newsguy.com> says...

> In article <MPG.1fec1e238de5e85998a30d@msnews.microsoft.com >, in
> the microsoft.public.windows.vista.security news group, Paul
> Adare <padare@newsguy.com> says...
>
> > In article <D62F1EB0-43E1-4721-8E6A-0A5EE5154C64@microsoft.com>,
> > in the microsoft.public.windows.vista.security news group, Jeff
> > Lynch [MVP] <jeff.lynch@newsgroup.nospam> says...
> >
> > > Are the default security settings different in Vista Business than in Vista
> > > Ultimate (both RTM)? I've noticed a special account called
> > > "TrustedInstaller" in Vista Business that has full control permissions for
> > > the system32 folder and files but this account doesn't seem to exist in
> > > Vista Ultimate. I'm trying to install Outlook 2007 Business Contact Manager
> > > under Vista Business and it fails due to a permissions error but it installs
> > > just fine under Vista Ultimate.
> >
> > Jeff, are these both clean installs of RTM and not upgrade
> > installs of a previous release? My understanding is that the
> > TrustedInstaller is gone in the RTM versions of all Vista SKUs.
> > I've not installed Business yet but I know it is gone from
> > Ultimate and I know that I read somewhere recently that
> > TrustedInstaller is gone...
> >
> > I'll try and throw Business up in a VM today and check.
>
> Ok, so no TrustedInstaller in a clean install of Business
> either.

Hmm, but it does show up in the Windows folder DACL on both
Ultimate and Business. Weird. I'll see what I can dig up...

--
Paul Adare - MVP Virtual Machines
Waiting for a bus is about as thrilling as fishing,
with the similar tantalisation that something,
sometime, somehow, will turn up. George Courtauld

In article <D62F1EB0-43E1-4721-8E6A-0A5EE5154C64@microsoft.com>,
in the microsoft.public.windows.vista.security news group, Jeff
Lynch [MVP] <jeff.lynch@newsgroup.nospam> says...

> Are the default security settings different in Vista Business than in Vista
> Ultimate (both RTM)? I've noticed a special account called
> "TrustedInstaller" in Vista Business that has full control permissions for
> the system32 folder and files but this account doesn't seem to exist in
> Vista Ultimate. I'm trying to install Outlook 2007 Business Contact Manager
> under Vista Business and it fails due to a permissions error but it installs
> just fine under Vista Ultimate.
>
> Any help is greatly appreciated.
>

Ok, you can ignore all of my previous posts on this subject, I'm
going to plead jet lag and a serious head cold. :-)
The reason you don't see TrustedInstaller listed as an account
is because it isn't one, it is a service. What you're seeing on
the DACL of the folders and files in question is part of the new
security in Vista that includes Service ACEs. Look for Windows
Service Hardening on the Vista web site for more details.

--
Paul Adare - MVP Virtual Machines
Waiting for a bus is about as thrilling as fishing,
with the similar tantalisation that something,
sometime, somehow, will turn up. George Courtauld