Giving UAC a second chance or why putting a silk dress on a sow its still a pig

Now that I'm reasonablly satisified all my hardware and software is
stable and working (as good as it is going to get for now) time to do
a little house cleaning and give UAC a second chance to see how much a
nag it still wants to be. So I turned it back on and rebooted.

First a partial list of when UAC will nag automatically. For those new
to UAC, this is a new feature in Vista, User Account Control, which
attempts to provide better security. If you attempt to do the tasks
listed UAC will stop you dead in your tracks, gray your screen and if
you have administrative rights make you confirm you really want to do
what you've already decided to do. If you don't have administrative
rights, Vista won't let you proceed at all.

When you:

1. install or uninstall an application
2. install a device driver
3. configure and install Windows updates
4. install an ActiveX control
5. configure Parental Controls
6. adjust Windows Firewall settings
7. change a user's account type
8. add or remove a user account
9. modify UAC settings
10. configure Remote Desktop access
11. copy or move files into the Program Files or Windows folders
12. schedule Automated Tasks
13. restore files backed up by the system

Guess what, I don't have any problems with any of the above because
each is a limited activity you don't do that often or a activity that
does present some risk to your security so a quick reminder what
you're about to do may present a risk is fine with me.

Sadly what UAC is SUPPOSE to do and what it ACTUALLY does is a
different story. Before reading further, have some headache medicine
handy or a stiff drink handy. Maybe both.

What follows is some detailed examples I've run into when UAC just
becomes too much of a nag and interfers with routine tasks. It is
obvious many people have more than one physical hard drive these days.
Even if you don't, over the years most people have become comfortable
partitioning their hard drives, so even if you only have one physical
drive, many people have more than one drive letter. This presents a
problem to UAC because right off the bat it will get to be a real nag
with things you do on your root drive, for most people your "C" drive
IF you attempt to do things outside of folders Vista expects you to do
them in. This may or may not also happen on other drives which is why
UAC is so confusing. So far, in my testing, it seem Vista treats the
root drive differently than other drives and seems more fussy in what
it will let you do. I could me wrong, sure seems that way.

Keep in mind I did a install in place. Because of that Vista may have
created some folders or changed them in ways you may not see if you do
a clean install. I don't know since so far I only have Vista on one
box. So what follows applies to MY experience, your milage may vary.

The Good, the Bad and the ludicious

Example #1

On my C Drive I have a Users folder. It has over 1,200 sub folders and
in excess of 39,000 files. Opening it I see lots of my stuff, some
notes, word documents, spreadsheets, images, a whole collection of
mostly junk, much of which are duplicates, results of tests I've did
and never bothered to clean up and so on. So just like most people
sooner or later get around to cleaning up their garage or basement, I
decided to clean up this folder and just dump stuff I know I have
other copies of elsewhere or simply don't want any more.

This is where UAC can be a real pain in the butt. Consider the
following. I have a whole collection of images of myself, before and
after shots when I was a lot heavier then I am now, the new improved
me. Oh my God, I don't want to look at my "fat" pictures any more so I
decided to select the first such image and just delete it.

I tell Vista to delete the first image, It responds you need to
confirm this operation offering me three choices; confirm, skip or
cancel. I dutifully click on confirm and you think Vista will now let
me delete this image. No, next it brings up a second Warning Dialog
box after dimming the desktop, and again wants me to confirm I really
want to delete the file. Again, I agree and finally it deletes the
image file.

Remember I got almost 40,000 files to work through just in this one
folder, so this will be a royal pain for sure.

Lets stop and think about what's happening. Is deleting a image file I
no longer want a security risk to my system? No, of course not. So in
this situation Vista's UAC is just being a mindless nag. I have an
extensive system with 4 internal large size drives and several more
externals. I've deleted thousands of files already under Vista from
these physical drives and UAC for the most part, if UAC was on, for
these drives, it only brought up one nag screen, to confirm I wanted
to delete a file, then it did delete it.

So why is UAC nagging about a innocent image I want to delete on my C
drive? Well, just a guess, I'm assuming since the folder in question
is "outside" of where Vista expects user files to be, anything on the
root drive no matter how trival it thinks is in the wrong place its
going to nag a lot about you doing anything with it that UAC views as
security risk. That's ludicious! Trying to move files presents the
same road blocks.

Example #2

I next see several web pages I was working on, then stopped in my
Users folder I'm trying to clean up. I probably don't need them, but,
oh what the heck, I'll move them to a folder I just created on my C
drive I'm just calling unsorted documents. I select the 8 HTML files
Vista shows with the Explorer icon and I fully expect to see a nag
screen when I try to move them.

Nope, no nag screen. Nothing. I have the 8 files selected, and try to
drag and drop them in the new folder I just made. Don't work. Ok,
fine, I'll do it another way. I select them and then select "copy"
then try to paste the files in the new folder. Nothing happens. No nag
screens, Vista's out to lunch. So I can't move these files or copy
them. I don't want them where they are, so now what?

This is where UAC falls flat on its face and will drive any sane
person absolutely crazy.

I'm logged on as a user with administrative rights, in XP I would have
no problem doing anything I wanted to these files. In Vista, its a
disaster. I right click on the first file and look at the much cursed
security tab. Four 'users' listed.

1. everyone
2. system
3. administrators
4. users

I click on the advanced tab to see who can do what. As expected Vista
screwed up. Remember it, not me transferred all my files from my XP
install. It should have assigned rights accordingly. It did not.

Only the 'users' called system and administrators are "allowed" full
control of this file per UAC. Me (as a user) have only been given read
and execute permission to this file.

What's got to confuse people is the new Vista meaning of old
classifications. While you may be logged on with administrative
rights, unlike in XP, that often doesn't mean crap any more. Often you
need to "elevate" a file's status.

In order to do anything to this file I have to click on 'users' from
the advanced tab in the security tab of the properties box of this
file. Then click edit to change permissions from only read and execute
to "full" rights then check apply, then ok several times to back out
and then finally I can copy or move the file.

Ok, I now know what to do, but can't explain why Vista didn't
originally nag, it simply didn't let me do anything with these web
page files. Only because I knew or suspected what the problem was
could I fix the problem. Lots of luck for the typical user running
into this. Safe bet he won't know. Vista won't help you figure it out
either unless you already have a idea what the problem is.

So, knowing what's wrong is there a easy way to fix it? As far as I
can see not really. Remember I have several more files just like the
one I just fixed, that don't have permissions set to let me do
anything to them. I think there is a way to set permissions globally
for certain file types, (haven't checked) otherwise I will need to do
all the same steps just to move this handful of files. I don't know
about anybody else, but UAC being such a pain in the butt for things
like this surely isn't seen as a "feature" by this user. It also isn't
a security feature either. True it you know how, and are fairly clever
and nobody ever said hackers aren't both patient and clever they can
embed malicious code in both image and HTML files.

So should I calm down, or do I have a right to bitch about this?
Before you answer, consider the risk. Its really a apples and oranges
kind of thing. If Vista was nagging about NEW incoming images or web
site pages I was in the process of saving to my system, then maybe
there's a reason to be cautious. That's not the case for to two
examples I detailed. Both the image files and the HTML files were
already on my system and if they were of a malicious variety they
already had plenty of time to do whatever mischief they were designed
to do.

Vista just mindlessly nagged about them... for no reason and caused me
to stop what I was trying to do, caused me to waste a lot of my time
and in the end added nothing to my security. These files presented no
threat, even if they did, the prevention is long past. That is why so
many more experienced users can't stand UAC and turn the damn thing
off.

To be continued... assuming I don't have a nervous breakdown fighting
with UAC. I only got 39,945 files to go and that's just one folder.