User Account Control

Category: New User Account Features | Comment 0 Comments | Read 1836 Read | Posted Posted: VistaTrick | 17 November 2007

In order to make the system more secure, Microsoft has architected Windows Vista such that all of the tasks you can perform in the system are divided into two groups, those that require administrative privileges and those that don't.

This required a lot of thought and a lot of engineering work, naturally, because the company had to weigh the ramifications of each potential action and then code the system accordingly. What they’ve arrived at is a decent compromise, and although some of the security controls in Windows Vista will likely cause fits in certain circles, many users will understand that they’re in place to keep the system more secure and will learn to live with them. Our feeling is that anyone who’s been bitten by a worm, virus, Trojan, or other bit of malicious code will gladly and will- ingly accept the new restrictions.

Here’s how it works. Every user, whether configured as a standard user or administrator, can perform any of the tasks in Windows Vista that are denoted as not requiring adminis- trator privileges, just as they did in Windows XP. You can launch applications, change time zone and power management settings, add a printer, run Windows Update, and per- form other similar tasks. However, when you attempt to run a task that does require administrative privileges, the system will force you to provide appropriate credentials in order to continue. The experiences differ a bit, depending on the account type.

Standard users receive a User Account Control credentials dialog box, as shown in Figure
9-1. This dialog box requires you to enter the password for an administrator account that is already configured on the system. Consider why this is useful. If you’ve configured your children with standard user accounts, they can let you know when they run into this dia- log box, giving you the option to allow or deny the task they are attempting to complete.

Figure 9-1: Standard users attempting to perform admin-level tasks will be confronted by the
User Account Control credentials dialog box.

Administrators receive a simpler dialog box, called the User Account Control consent dia- log box, which is shown in Figure 9-2. Because these users are already configured as administrators, they do not have to provide administrator credentials. Instead, they simply need to click Continue to keep going.

Figure 9-2: Administrators receive a slightly less annoying dialog box.

By default, administrators using Windows Vista are running in a new execution mode called Admin Approval Mode. This is the reason you see consent dialog boxes appear from time to time. You can actually disable this mode, making administrator accounts work more like they did in XP, without any annoying dialog boxes popping. However, you should realize that disabling Admin Approval Mode could open up your system to attack. If you’re still interested in disabling this feature, or disabling User Account Control, we will discuss ways to do so at the end of this section.

Conversely, administrators who would like Windows Vista to be even more secure can also configure the system to prompt with a User Account Control credentials dia- log box — which requires a complete password — every time they attempt an admin- istrative task. This option is also discussed shortly.

The presentation of both of these dialog boxes can be quite jarring. If you attempt to com- plete an administrative task, the screen will flash, the background will turn black, and the credentials or consent dialog will appear in the middle of the screen. You cannot continue doing anything else until you have dealt with these dialog boxes one way or the other. For the record, there’s actually a third type of User Account Control dialog box that will appear occasionally regardless of which type of user account you have configured. This dialog box appears whenever you attempt to install an application that has not been dig- itally signed or validated by its creator. These types of applications are quite common, so you’re likely to see the dialog box shown in Figure 9-3 fairly frequently.

Figure 9-3: This colorful dialog box will appear whenever you attempt to execute an application installer from an unknown source.

By design, this dialog box is more colorful and in-your-face than the other User Account Control dialog boxes. Microsoft wants to make sure you really think about it before con- tinuing. Rule of thumb: You’re going to see this one a lot, but if you just downloaded an installer from a place you trust, it’s probably okay to go ahead and install it.

Disabling and Configuring User Account Control

As we mentioned previously, many people are going to be annoyed by User Account Control and will want to simply disable it. This is easily done, but it’s not recommended. You can also configure various User Account Control features using a hidden manage- ment console. In this section, we’ll describe both of these options.

Disabling User Account Control

You can disable User Account Control across the board for all users of a given PC by navigating to the User Controls section of the Control Panel (in Control Panel➪User Accounts and Family Settings➪User Accounts) and selecting the option titled Change security settings. This will load the Change Security Settings window shown in Figure
9-4. To disable User Account Control, simply uncheck the option titled Use User Account Control (UAC) to help protect your computer and then click the OK button. Note that you will have to reboot your computer for the changes to take affect.

Figure 9-4: Disabling User Account Control is simple, but it affects all users.

If you want to disable User Account Control for just a single user, you simply need to select a single check box in the User Accounts Control Panel. The quickest way is to open the Start menu and click the picture that’s associated with your user account. Then, in the User Accounts window that appears, click Turn User Account Control on or off. You’ll see the required check box in the next window.

Configuring User Account Control

Microsoft makes a number of User Account Control settings available through the hidden Local Security Settings management console. To launch this console, open the Start menu and type secpol.msc and then tap Enter. This displays the console shown in Figure 9-5.

Figure 9-5: The Local Security Settings management console enables you to con- figure various security features, including User Account Control.

To access the User Account Control options, you will need to expand the Local Policies and Security Options nodes in the tree view under Security Settings in the left pane of the management console. When you do so, the right pane will fill up with a list of security options. Scroll to the bottom and you will see eight security options related to User Account Control. Table 9-1 highlights these settings and explains what each does.

Tip: The Local Security Settings management console should be used only on PCs that are not centrally managed by a Windows Server–based Active Directory (AD)-based domain. Unless you work for a large company, it’s unlikely that your PC is centrally
managed in this way.

| Rate: 10 / 3 | Printing Page

Print

Comments

No Comments

STATISTICS

SEARCH

MOSTLY VIEWED

LATEST COMMENTS

User Account Control

Comments

Post Comment