Giving UAC a second chance or why putting a silk dress on a sow its still a pig Part #2

[Adam Albright]

This just keeps getting worse!

Example #3

I previously mentioned I burn a lot of DVD's. I've been using Easy
Creator 9. This application seems to be working fine since in just a
few days time I've successfully burned close to 100 fully filled 4.7
GB DVD's. All different content, not just copying. As usual when you
do a large project, you hit one or two problems. Out of this stack one
DVD kept hanging and wouldn't burn. So I tried a few tricks and
finally it did. Easy Creator 9 cleans up after itself, so for example
if you "copy" a DVD and only have one burner it copies to your hard
drive, then once the DVD is burned will delete the data you no longer
need. This didn't create any permission issues because I had UAC
turned off.

For this one problem disc I manually copied the files to a different
location on my E drive. I finally got to burn a good copy to a DVD,
now time to delete the folder where the files were on my hard drive.

Because I truly wanted to give UAC a second chance, this morning I
returned UAC to its default "on" condition.

Guess what, Vista won't let me delete. So it seems even if you have
UAC turned off to do some task as I did yesterday, under some
situtations at least if you turn it UAC back on it imposes
restrictions retroactively.

So looking again on the security tab this moronic crap call UAC
created no less then five users.

1. everyone
2 creator owner
3. system
4. administrators
5. users

Every 'owner' in the above list Vista has given "full control" except
for 'creator owner' which would imply I should be able to delete the
folder since I am a user running with full administrative rights.
Oops, that don't mean what it use to in XP. Even if I can't delete
this folder as just a 'user' for some goofy reason, surely the moronic
"everyone" user should be able to, Vista don't make it easy to switch
to one of those users though.

It seems Vista is trying to say this folder and the files in it were
created by a "user" it named 'creator owner'. It gave this user what
it calls "special" permission. Stop laughing! Well, not too special
since I can't delete the files or the folder until I again do the UAC
dance. Advance tab, select the owner that has limited permission, edit
and change to give it full permission which of course blows the whole
idea of having restricted permissions in the first place if you have
to keep elevating permissions to get anything done.

Could I now delete these files and folder? No, of course not. Now this
time the previous method that did work to change permission as I
detailed in Examples #1-2 won't work this time.

If I click on 'creator owner' under the advnced tab then click edit
then try to change permissions all the options are grayed out and stay
that way no matter what.

UAC now babbles that the permissions have been "inherited" from the
parent object. Well, that's nice Vista, but it doesn't say who the
parent object it, offering instead to make changes here in this dialog
box to create a new permission that overrides the inherited
permissions. I'm getting kind of sick to my stomach.

Ok, I would try that but UAC doesn't say how to do that anywhere in
the Dialog box, but does offer a link to read page after page of help
topics on their new "security" featues part of UAC. For now I'm
skipping that, I don't want to barf all over my keyboard.

 

[Kerry Brown]

You have just proved that all of your claims about knowing more than most
MVPs about Windows are false. You don't even seem to understand how NTFS
permissions work or are propagated. The exact same situation could have
existed in all versions of Windows that use NTFS. The only difference is
that Vista has changed the default NTFS permissions for some folders. How
the permissions work, how they are propagated, and how you change them are
the same as they always have been. The UI is slightly different but if you
understand how things work the UI is very easy to figure out. If you don't
understand the basics of NTFS then no UI in the world will help.

 

[Adam Albright]

You have just proved that all of your claims about knowing more than most
MVPs about Windows are false.

I have just proved UAC is useless to the typical user that isn't about
to waste valiable time fighting with it to try to undo the mess
Microsoft created that prevents users from getting any work done. NTFS
isn't the issue. I'm sorry you insist on remaing arrogant and as I
expected avoid addressing ANY of the issues I raised. Typical MVP. You
can talk the talk, but fall flat on your face when somebody points out
factually things that are broken.

 

[Robert Firth]

Well, it is NTFS permissions that are your issue. Has nothing to do with
UAC. If you need to delete something, you need to set yourself as the owner
if you are not currently the owner.

Right click > properties > security tab > Advanced > owner tab > edit >
change owner to: select your account > apply

All those users you see (everyone, system, users, administrators...) and
folder property propigation are part of NTFS.

You seem to not understand what the "parent object" is. Image a folder that
has many subfolders. You can set the permissions on that folder and have it
propigate those permissions down to the subfolders. However, those
permissions can be overridden. This is nothing to be "sick to my [your]
stomach" about. It is useful if you don't want to set the permissions on
every single subfolder - which could take a long time.

"This just keeps getting worse!" for you. You keep comming up with examples
of Vista doing its job.

Additionally, if you need more help deleting files, visit this site:
http://blogs.msdn.com/tims/archive/2006/11/10/windows-vista-secret-11-deleting-the-undeletable.aspx

--
/* * * * * * * * * * * * * * * * * *
* Robert Firth *
* Windows Vista x86 RTM *
* http://www.WinVistaInfo.org *
* * * * * * * * * * * * * * * * * */

 

[Adam Albright]

Well, it is NTFS permissions that are your issue. Has nothing to do with
UAC. If you need to delete something, you need to set yourself as the owner
if you are not currently the owner.

Hint: Since I did a install in place I AM the owner of the files.
Obviously Vista isn't smart enough to be able to figure that out or
make appropriate changes on the fly during the transition from XP to
Vista which too funny, it says its doing. What does the word UPGRADE
mean to you? Vista didn't upgrade, it trashed my system messing around
with hundreds of thousands of files I never gave it permission to
change permissions on.

That, obviously presents HUGE problems or will, for millions of users
in similar situations like me. For Microsoft or any MVP to think a
typical user is going to stop and look at the permission of hundreds
of thousands of his files, one at a time, sometimes millions of files
to look at that are on a typical power user or business user's system
is quite frankly absurd. On the other hand to make permission changes
globally which I'm sure you'll suggest next, defeats the purpose UAC
is suppose to bring as a "security" feature, does it not?

The $64,000 dollar question is WHY get forced to elevate a file's
status to get it so Vista does what you tell it to do? All that does
it stop you from working. In effect it is just a fancy way of turning
UAC off if you have to constantly elevate a file's status. That's no
security at all.

Right click > properties > security tab > Advanced > owner tab > edit >
change owner to: select your account > apply

For hundreds of thousands of files? One at a time? You daft man? I'm
not trying to be a smart-ass, but it seems most of the MVP's here
likely have mickey mouse systems where you may have Windows and
perhaps a few applications and a handful of data files, but REAL users
have hundreds of thousands of such files spread over many thousands of
folders. Going forward to put up with UAC is one thing, to have to go
through the torture of making the files ALREADY on your system
digestable to UAC is totally insane. Actually what happens is you, the
user are getting forced to do what Vista should have been smart enough
on its own to do. If I get stopped constantly and have to fiddle with
permissions and end up elevating zillions of files, then these files
in order to work on them aren't a damn bit safer then they were under
XP!

All those users you see (everyone, system, users, administrators...) and
folder property propigation are part of NTFS.

Understood and it is controlled by UAC. Hint: Why its called User
Account Control. Again I doubt many users would mind putting up with
nag screens going forward. But to force users to change hundreds of
thousands of THEIR files that were created in a earlier version of
Windows simply doesn't make any sense. Nor does it when you do
something with UAC off, then if your turn it back on, work you did
with UAC off revents to you having to turn it off again or again mess
with permissions to change anything. Again, that's INSANE!

You seem to not understand what the "parent object" is. Image a folder that
has many subfolders. You can set the permissions on that folder and have it
propigate those permissions down to the subfolders. However, those
permissions can be overridden.

Exactly what I detailed. Vists the dumb pile of crap it is added a new
user then restricted it to read and execute only that prevented me
from changing it. That's a feature? Clicking on the advanced tab to
try to change it had no effect.

This is nothing to be "sick to my [your]
stomach" about. It is useful if you don't want to set the permissions on
every single subfolder - which could take a long time.

How "useful" a feature is or isn't should be left up to the USER. Me!
That's what so many don't seem to get.

"This just keeps getting worse!" for you. You keep comming up with examples
of Vista doing its job.

Its job is to drive users crazy? That a "feature" too? Come on, get
real.

 

[Grant]

You have just proved that all of your claims about knowing more than most
MVPs about Windows are false. You don't even seem to understand how NTFS
permissions work or are propagated. The exact same situation could have
existed in all versions of Windows that use NTFS. The only difference is
that Vista has changed the default NTFS permissions for some folders. How
the permissions work, how they are propagated, and how you change them are
the same as they always have been. The UI is slightly different but if you
understand how things work the UI is very easy to figure out. If you don't
understand the basics of NTFS then no UI in the world will help.

Well I've never come across anything like that and I've worked on hundreds
of XP machines all using NTFS.

 

[Adam Albright]

Well I've never come across anything like that and I've worked on hundreds
of XP machines all using NTFS.

I think Microsoft is in panic mode. It knows UAC is a nightmare and
infested with all kinds of goofy issues and to prove that a couple
days ago I posted a link with Microsoft pleading with a group of more
technical users that apparenlty got their hands on a early release of
the final version to please, please don't disable UAC, we know its
buggy, but if you turn it off we won't get any feedback then how can
we fix it. That speaks volumes. Microsoft knowing dumped Vista on a
unsuspecting public KNOWING one of its main and most talked about
features, its new "security" isn't working right.

 

[Donald L McDaniel]

Well, it is NTFS permissions that are your issue. Has nothing to do with
UAC. If you need to delete something, you need to set yourself as the owner
if you are not currently the owner.

Hint: Since I did a install in place I AM the owner of the files.
Obviously Vista isn't smart enough to be able to figure that out or
make appropriate changes on the fly during the transition from XP to
Vista which too funny, it says its doing. What does the word UPGRADE
mean to you? Vista didn't upgrade, it trashed my system messing around
with hundreds of thousands of files I never gave it permission to
change permissions on.

That, obviously presents HUGE problems or will, for millions of users
in similar situations like me. For Microsoft or any MVP to think a
typical user is going to stop and look at the permission of hundreds
of thousands of his files, one at a time, sometimes millions of files
to look at that are on a typical power user or business user's system
is quite frankly absurd. On the other hand to make permission changes
globally which I'm sure you'll suggest next, defeats the purpose UAC
is suppose to bring as a "security" feature, does it not?

The $64,000 dollar question is WHY get forced to elevate a file's
status to get it so Vista does what you tell it to do? All that does
it stop you from working. In effect it is just a fancy way of turning
UAC off if you have to constantly elevate a file's status. That's no
security at all.

Right click > properties > security tab > Advanced > owner tab > edit >
change owner to: select your account > apply

For hundreds of thousands of files? One at a time? You daft man? I'm
not trying to be a smart-ass, but it seems most of the MVP's here
likely have mickey mouse systems where you may have Windows and
perhaps a few applications and a handful of data files, but REAL users
have hundreds of thousands of such files spread over many thousands of
folders. Going forward to put up with UAC is one thing, to have to go
through the torture of making the files ALREADY on your system
digestable to UAC is totally insane. Actually what happens is you, the
user are getting forced to do what Vista should have been smart enough
on its own to do. If I get stopped constantly and have to fiddle with
permissions and end up elevating zillions of files, then these files
in order to work on them aren't a damn bit safer then they were under
XP!

All those users you see (everyone, system, users, administrators...) and
folder property propigation are part of NTFS.

Understood and it is controlled by UAC. Hint: Why its called User
Account Control. Again I doubt many users would mind putting up with
nag screens going forward. But to force users to change hundreds of
thousands of THEIR files that were created in a earlier version of
Windows simply doesn't make any sense. Nor does it when you do
something with UAC off, then if your turn it back on, work you did
with UAC off revents to you having to turn it off again or again mess
with permissions to change anything. Again, that's INSANE!

You seem to not understand what the "parent object" is. Image a folder that
has many subfolders. You can set the permissions on that folder and have it
propigate those permissions down to the subfolders. However, those
permissions can be overridden.

Exactly what I detailed. Vists the dumb pile of crap it is added a new
user then restricted it to read and execute only that prevented me
from changing it. That's a feature? Clicking on the advanced tab to
try to change it had no effect.

This is nothing to be "sick to my [your]
stomach" about. It is useful if you don't want to set the permissions on
every single subfolder - which could take a long time.

How "useful" a feature is or isn't should be left up to the USER. Me!
That's what so many don't seem to get.

"This just keeps getting worse!" for you. You keep comming up with examples
of Vista doing its job.

Its job is to drive users crazy? That a "feature" too? Come on, get
real.

Microsoft tells us that "UAC is NOT a security feature" in its back pages.
In fact the very programmer who wrote UAC tells us that.

In reality, Microsoft has just made it harder to be the owner of files,
and slapped the "suggestion" that UAC is a "security feature" on top in
all their Vista advertisements.

Whether UAC "does its job" or not is still up in the air. Not enough of
the general public have reported on Vista security breaches yet.

Personally, I just gave myself Owner permissions, then changed permissions
to my ENTIRE Vista drive, and all subfolders and files. This makes it
MUCH simpler. However, even doing this leaves me with the inability to
take ownership of a few files, such as the page file, the hibernate file,
and some extremely-low-level system files. It also leaves me with an
inability to open my folders on the Vista drive from within XP, which is
completely inexcusable, and defeats the purpose of a dual-boot setup.

This may have been Microsoft's true intentions all along, for which they
should be put up against the nearest brick wall and shot through the head.

Donald L McDaniel
Please reply to the original thread and newsgroup
===========================================================

 

[Kerry Brown]

Well I've never come across anything like that and I've worked on hundreds
of XP machines all using NTFS.

The same situation could exist. It certainly wouldn't be common and probably
doesn't exist. Vista changes the ACLs to make the file system much more
secure than it used to be. The ACLs for some common folders are very
different from previous versions of Windows. Changing them to how you want
them is done the same as with previous versions of Windows and has nothing
to do with UAC. It's all very basic NTFS stuff. Nothing has changed there.
What has changed is the ACLs on some folders.

 

[Kerry Brown]

I have just proved UAC is useless to the typical user that isn't about
to waste valiable time fighting with it to try to undo the mess
Microsoft created that prevents users from getting any work done. NTFS
isn't the issue. I'm sorry you insist on remaing arrogant and as I
expected avoid addressing ANY of the issues I raised. Typical MVP. You
can talk the talk, but fall flat on your face when somebody points out
factually things that are broken.

You prove your ignorance again. The problem you describe is because the ACLs
are different in Vista from XP. It has nothing to do with UAC. UAC comes
into play when you try to change the ACLs but that is part of the UI. If you
understand NTFS the problem and the solution are obvious. You may have to OK
a couple of UAC prompts when implementing the solution.

 

[Adam Albright]

The same situation could exist. It certainly wouldn't be common and probably
doesn't exist. Vista changes the ACLs to make the file system much more
secure than it used to be.

Kerry, all you're doing is parroting the same BS Microsoft originally
said and is now backpedaling away from at warp speed.

The ACLs for some common folders are very
different from previous versions of Windows. Changing them to how you want
them is done the same as with previous versions of Windows and has nothing
to do with UAC. It's all very basic NTFS stuff. Nothing has changed there.
What has changed is the ACLs on some folders.

Again, you're shooting blanks. The inner workings of NTFS is neither
basic or well understood by the casual user. Do me a favor, go to
Vista help, look up NTFS and report back WHERE it tells you how to set
up or change permisssions. I already have. It briefly glosses over
what they are, that's about it. Anyone stuck in the blizzard of
annoying and next to useless error messages and nag screens when
working with permissions won't find help looking under NTFS in Vista's
built-in help.

Maybe MVP's were given a magic wand to make changes easier. That it?

Too funny, I just found this is Vista help:

"The Security tab is not available on file and folder properties in
Windows Vista Home Premium, Windows Vista Home Basic, and Windows
Vista Starter."

 

[Adam Albright]

You prove your ignorance again. The problem you describe is because the ACLs
are different in Vista from XP.

Nothing dumber then some smart-ass throwing out some acronym and never
defining what it means. I know that ACL means Access Control List, but
you think everyone reading your comments does?

Lets follow through with your "suggestion". If I enter ACL in Vista's
help system it produces 2 hits. The first is "what are permissions".
All the details show are the types and what each is, not how to change
them or use them effectively. The next hit talks about what to know
before applying permissions to a file or folder. Here the help system
does give some information but correctly admits there are RISKS to
applying permissions, then goes on to say ARE YOU LISTENING that
WINDOWS applies permissions to files and folders BASED ON User Account
settings. There is no information on how to change these easily.

Lets review. If you have a system running XP, do a install in place
which leaves your files and settings in tact Vista should be smart
enough to read the settings from your XP install and carry them over.
That's what Vista's help implies. However it don't! It can and does
assign NEW users then gives them limited permissions that conflicts
with what XP had and thus blocks you the REAL user from having access
to these files or folders preventing you from doing what you could do
in XP unless and until you humble yourself over and over changing them
from UAC.

The biggest slice of the ignorance pie goes to Microsoft for assuming
the tens of millions of customers who will upgrade now to Vista would
sit still for this radical half-ass poorly implemented, poorly
explained pile of dog poop.

It has nothing to do with UAC. UAC comes
into play when you try to change the ACLs but that is part of the UI.

Nice double talk. Can you speak English?

If you understand NTFS the problem and the solution are obvious.

The point is the typical purchaser of a Vista license DOES NOT
understand NTFS permissions and does not want to be bothered either!
Don't you ever pay attention?

You may have to ok a couple of UAC prompts when implementing the solution.

Well I've been keeping score. So far I worked my way through 200 files
on various drives. Of that number I had to fiddle with permissions on
42 files, 3 so far no matter what I do Vista won't let me change
anything or the permission window itself is nothing but a white blank
or the check boxes remain uncheckable even after pressing the edit key
and "taking over" the user as administrator.

Heck, I only got 39,834 files more to go, in this ONE primary folder.
Then about 1 TB more worth. I ought to finish just in time to install
the next version of Windows that replaces Vista.

Of course I'm just going to turn the damn crap OFF. UAC is garbage!!!!
A good idea yes, but horrible in its present implementation.

 

[MICHAEL]

Adam,

While some may seem you as a whiner, you do
carry on a bit. ;-)
I tend to agree with many of your points.

I've been using Vista since Beta2 and
participating in these Vista forums since June-
what I find the most striking, is the fact so many
MVPs spend more time trying to defend certain
aspects of Vista and/or debating with the Linux
loonies than they do answering and helping actual
users who are having problems. Some MVPs
answering users in belittling ways, too.
Not all- there a are some good ones, like,
Colin Barnhorst.

Take care,

Michael

 

[Adam Albright]

Adam,

While some may seem you as a whiner, you do
carry on a bit. ;-)

I prefer to say I'm passionate on certain topics, that can be confused
with whining I guess as can my more aggressive writing style. I'm only
trying to document some of things I've seen Vista do. ;-)

I tend to agree with many of your points.

I've been using Vista since Beta2 and
participating in these Vista forums since June-
what I find the most striking, is the fact so many
MVPs spend more time trying to defend certain
aspects of Vista and/or debating with the Linux
loonies than they do answering and helping actual
users who are having problems.

Same thing I noticed.

Some MVPs answering users in belittling ways, too.
Not all- there a are some good ones, like,
Colin Barnhorst.

Yep, always been like that going way back to the beginning of the MVP
program many years ago, but the last couple years things seem worse
now. Well, it keeps a more technical group from getting too bland.

 

[MICHAEL]

I prefer to say I'm passionate on certain topics, that can be confused
with whining I guess as can my more aggressive writing style. I'm only
trying to document some of things I've seen Vista do. ;-)

I understand... I have had my "passionate" moments in here.

Same thing I noticed.

Ironically, a lot of the off-topic posts would simply die or
not be nearly as long if a few of the MVPs just had the self-control
to let it go. Especially, the Windows vs. Linux threads.

Yep, always been like that going way back to the beginning of the MVP
program many years ago, but the last couple years things seem worse
now. Well, it keeps a more technical group from getting too bland.

I agree. Oh, I forgot to mention that Rock and John Barnett
are two other outstanding MVPs.


Take care,

Michael

 

[Mike]

Just a comment or two from a fairly competent PC user, on NTFS/Security
as being discussed here.

1, Trying to resolve an access problem - in XP - I lost all of my music
CD's carefully converted MP3's.
Just by changing the wrong thing.

2, The reason was I had to re-install over the top of a ruined XP
install due to a driver or program glitch I could not resolve.

3, As the only user on the PC I should not have a security problem.
I should always be the creator/owner. If not why not ?
If not, then it needs to be explained better for people like me (maybe
Adam as well) because I'm totally confused by the many settings that
seem to contradict each other.

The point that needs to be resolved by Microsoft/MVP etc is the help
system on security. Maybe we'll all be more secure if its clear how to
apply and use it properly.