UAC for a specific Program, how to turn off?

[Frenchy]

I don't mind the click throughs of UAC (or not at this early stage in my
Vista land experience) but when you know a specific program is OK (in this
case M$ Money 2005) that is set up to run as an Administrator, why on earth
do I have to always click "Allow I trust this program"

I can see where I can turn this off for everything, but is there no-way I
can do this for individual programs that UAC is flagging??

Frenchy

 

[gls858]

I don't mind the click throughs of UAC (or not at this early stage in my
Vista land experience) but when you know a specific program is OK (in
this case M$ Money 2005) that is set up to run as an Administrator, why
on earth do I have to always click "Allow I trust this program"

I can see where I can turn this off for everything, but is there no-way
I can do this for individual programs that UAC is flagging??

Frenchy

If it was set to automatically allow, then any exploit of that program
would automatically run with admin privileges.

Just my take on it.

gls858

 

[Rick Rogers]

Hi,

That's not UAC, that occurs because the program is trying to write to system
files. Under Vista, program's shouldn't be doing that. As that older piece
of software is not Vista compliant, it will always require elevated
privileges to run.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org

 

[Frenchy]

If it was set to automatically allow, then any exploit of that program
would automatically run with admin privileges.

Just my take on it.

gls858

Nope. This freaking Microsoft Money 2005 (the latest version that is
available here in New Zealand) will not run at all, unless I give it Admin
privileges and once that is done, it asks each time to allow it to open.
You would have thought M$ would have got their own programs up to Vista
speed??

Frenchy

 

[Rick Rogers]

Meant to start that with "That's not UAC's fault,...."

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org

 

[NoStop]

I don't mind the click throughs of UAC (or not at this early stage in my
Vista land experience) but when you know a specific program is OK (in this
case M$ Money 2005) that is set up to run as an Administrator, why on
earth do I have to always click "Allow I trust this program"

I can see where I can turn this off for everything, but is there no-way I
can do this for individual programs that UAC is flagging??

Frenchy

Instructions here might help you ...

Cheers.

--
The "Wow" starts now.

Windows is not a virus! Viruses are small, efficient and built to get a job
done. Windows on the other hand ...

 

[Adam Albright]

I don't mind the click throughs of UAC (or not at this early stage in my
Vista land experience) but when you know a specific program is OK (in this
case M$ Money 2005) that is set up to run as an Administrator, why on earth
do I have to always click "Allow I trust this program"

Because Vista hasn't been taught how to make and follow a
decision/rules list based on specific rules and past events. A
shocking omission, I can't believe Microsoft just forgot by accident.
One reason I feel Vista was rushed out the door, unfinished.

A decision list is a common programming routine often used in
Firewalls where some screen will pop up THE FIRST TIME some
application wants to do something, like your browser or FTP client
wanting to gain access to the Internet. The Firewall asks YOU, NEVER
deciding by itself, if YOU want to allow this action or not. The next
time, the Firewall then looks of this Rules or decision list instead
of nagging you and takes the appropriate action by itself. So it only
nags once, then sets up some "rule" for the next time. Of course you
can also modify or changes the "rules" for specifc applications as
often as you want. That's why UAC while a good idea, is POORLY
implemented. Shame on Microsoft! They know better.

 

[Paul Smith]

Because Vista hasn't been taught how to make and follow a
decision/rules list based on specific rules and past events. A
shocking omission, I can't believe Microsoft just forgot by accident.
One reason I feel Vista was rushed out the door, unfinished.

Sorry Adam. Go listen to what the actual developers working on UAC said.
http://channel9.msdn.com/Showpost.aspx?postid=288259

--
Paul Smith,
Yeovil, UK.
Microsoft MVP Windows Shell/User.
http://www.windowsresource.net/

*Remove nospam. to reply by e-mail*

 

[Jimmy Brush]

Hello,

UAC ensures that *you* are the one starting an administrative program.

If there was an option to "always allow" a certain program to run with admin
power, this could not be guaranteed. Because then, a devious program could
run that "always allow" application and perform the administrative tasks
that it does, without your knowledge/consent.

Now, in the case of MS MONEY, you're right; it should not need admin access
at all, and hopefully MS will release a patch that allows it to run without
admin power.

But, to use a more common example, where you would "always allow" an
administrative tool, such as format.exe, to always run elevated: this would
allow malware to run format.exe without your knowledge, giving them the
power to erase your data, and you would not be able to stop it.

UAC does two things:

1- Makes sure programs that do NOT need admin power, do not receive it

2- Makes sure that *YOU* are the one that is performing an administrative
program

This #2 is the reason you can't always allow programs - because without the
prompt, the system can't be sure that you are starting a program as opposed
to some other program starting a program. ("Hey why is format.exe running; I
didn't start it!")


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

 

[Wrecklass]

Heard it, been there. The problem with UAC is that while it is necessary,
virtually no applications from the past work correctly. They want to write
data to the Program Files directory, or even the Windows Directory. They
write to administrator registery areas.

The issue is that Microsoft either gave no thought to valid applications
that behave this way, or didn't give a flying flick. So without
consideration to how things are 'in the real world.' Microsoft made the
unilateral decision to make these applications fail or be so difficult to
install and use as to be impossible.

Now, we come to the issue of the specific old applications and Microsoft's
claims that "you just need to get your application manufacturer to fix their
code." This falls directly in the face of the fact that Microsoft hasn't
even (as of the time Vista Launched) taken the time to fix their OWN
applications. So how do we convince ISV's to fix their apps, when Microsoft
won't do the same?

So, does this mean that Microsoft's engineers are incompetent or that
Microsoft as a company is acting in a malevolent fashion? Not very good
choices, but from out here 'in the real world' those are the only apparent
choices we have when considering Microsoft's design of the UAC.

Is there a better way to do this without 'inflicting pain?' Absolutely, as
has been proven by much more robust and secure operating systems the world
over. However, we are left to believe that Microsoft didn't care to do it
right.

 

[Guest]

There are many preprogramed application and you can add as many as you want.
Just read the app compat toolkit. Virtualisation was in XP, you just had to
turn it on by app. In XP the toolkit was on the CDRom.

 

[Adam Albright]

Heard it, been there. The problem with UAC is that while it is necessary,
virtually no applications from the past work correctly. They want to write
data to the Program Files directory, or even the Windows Directory. They
write to administrator registery areas.

The issue is that Microsoft either gave no thought to valid applications
that behave this way, or didn't give a flying flick. So without
consideration to how things are 'in the real world.' Microsoft made the
unilateral decision to make these applications fail or be so difficult to
install and use as to be impossible.

Now, we come to the issue of the specific old applications and Microsoft's
claims that "you just need to get your application manufacturer to fix their
code." This falls directly in the face of the fact that Microsoft hasn't
even (as of the time Vista Launched) taken the time to fix their OWN
applications. So how do we convince ISV's to fix their apps, when Microsoft
won't do the same?

So, does this mean that Microsoft's engineers are incompetent or that
Microsoft as a company is acting in a malevolent fashion? Not very good
choices, but from out here 'in the real world' those are the only apparent
choices we have when considering Microsoft's design of the UAC.

Is there a better way to do this without 'inflicting pain?' Absolutely, as
has been proven by much more robust and secure operating systems the world
over. However, we are left to believe that Microsoft didn't care to do it
right.

No kidding... There is a right way, a wrong way and the way Microsoft
does things, which often flys in the face of all reason and logic.
Considering it is a software developer, odd corporate thinking.

When I first ran the Vista Update Advisor only three applications out
of the over 200 I use it didn't like. Nero, which is expected, but the
other two were Microsoft applications. Very strange that Microsoft
wants all vendors to update their software but neglects to update its
own.

 

[NoStop]

Meant to start that with "That's not UAC's fault,...."

Another totally useless top posting response that leaves the reader almost
as clueless as the MVP poster who doesn't know how to post properly on
UseNet.

Cheers.

--
The "Wow" starts now.

Before you setup a Windows Media Centre PC, look at this comparison ...
http://tinyurl.com/33b4b4

 

[Richard Urban]

Wrong!

Microsoft made the unilateral decision to get the situation under control
and "force" those programmers to write their programs per the accepted
protocols. Microsoft is now forcing programs to be written to be used with
standard user account privileges and NOT with administrator privileges -
except where absolutely necessary.

Once this has been accomplished you may never again see another UAC prompt.

--


Regards,

Richard Urban MVP
Microsoft Windows Shell/User

 

[Frenchy]

OK, I can understand and accept that explanation, especially the bit about
where M$ will issue the patch <smile>

Appreciate the time you took to give the full explanation.
Frenchy

 

[Don]

Because Vista hasn't been taught how to make and follow a
decision/rules list based on specific rules and past events. A
shocking omission, I can't believe Microsoft just forgot by accident.
One reason I feel Vista was rushed out the door, unfinished...

Adam, I've been following your accounts of Vista frustrations with great
sympathy. Yes, Vista is unfinished. Just like every OS I've ever used,
and, come to think of it, just like democracy and our solar system.

Works in progress, every one.

Perfection has to start somewhere, and the two guys in charge of UAC are
making a great beginning. They know it's only a beginning and that they
are playing catch-up. If MS had taken security seriously when they
should have, the world would be a safer place now.

I still applaud them for beginning, late though it is, and I urge
everyone to view this video on the UAC story:

http://channel9.msdn.com/ShowPost.aspx?PostID=288259

 

[Adam Albright]

Wrong!

Microsoft made the unilateral decision to get the situation under control
and "force" those programmers to write their programs per the accepted
protocols. Microsoft is now forcing programs to be written to be used with
standard user account privileges and NOT with administrator privileges -
except where absolutely necessary.

Once this has been accomplished you may never again see another UAC prompt.

If you want to play the blame game, put the blame where it belongs,
squarely on the shoulders of Microsoft for being utterly incapable of
producing a "secure" version of Windows in over 20 years of trying
thus they now offer the next to useless easily overridden UAC warning
which does zero, nada, zip as far as increasing the actual security
level.

Why?

Because every time anyone clicks on the proceed button you in effect
defeat the purpose and Vista reverts back to working just like it
always has. Thus UAC is at best a nag and a nusiance. If you change
permissions and elevate some file or process owner you do the same
thing and again Vista then works just like Windows did in prior
versions and is all too happy to do what you ask of it, just click a
button or two frist please.

So tell me, how is UAC providing any real security? What UAC does is
pass the buck. Micosoft has waved the white flag of surrender and now
admits sorry folks we can't give you a truly secure Windows, hackers
will continue to write malicious code, there will continue to be
malware, worms, trojans and untold piles of virus attacks, spyware and
who know what, but wait, UAC will jump up and say hey, are you sure, I
mean really, really sure you want to delete that shortcut on your
desktop? So UAC shifts the blame. Don't blame Microsoft if you push
that button to continue. Vista told you, be careful, what you're about
to do could be risky. You do it anyway, then blame yourself, not
Micrsoft. Only in America can a giant company admit, hey we goofed,
hey its our fault, hey we can't fix it, but you're to blame.

 

[Guest]

Amen Don, you are a good man.

Adam, I've been following your accounts of Vista frustrations with great
sympathy. Yes, Vista is unfinished. Just like every OS I've ever used,
and, come to think of it, just like democracy and our solar system.

Works in progress, every one.

Perfection has to start somewhere, and the two guys in charge of UAC are
making a great beginning. They know it's only a beginning and that they
are playing catch-up. If MS had taken security seriously when they
should have, the world would be a safer place now.

I still applaud them for beginning, late though it is, and I urge
everyone to view this video on the UAC story:

http://channel9.msdn.com/ShowPost.aspx?PostID=288259

 

[Robert Johnson]

Another totally useless top posting response that leaves the reader almost
as clueless as the MVP poster who doesn't know how to post properly on
UseNet.

Cheers.

--
The "Wow" starts now.

Before you setup a Windows Media Centre PC, look at this comparison ...
http://tinyurl.com/33b4b4

Just curious, but why is top posting such a no-no. Does it really matter?
Instead of having to scroll down to the bottom to see what was written it on
the top easily visable... seems kinda silly.

Robert

 

[MICHAEL]

Just curious, but why is top posting such a no-no. Does it really matter? Instead of having
to scroll down to the bottom to see what was written it on the top easily visable... seems
kinda silly.

Robert

It's a damn silly ass debate/argument that's been going on
and on and on and on and on. It's as boring as the Linux vs. Windows
debates. Typically discussed by antiquated aresholes who have
nothing better to do than have everyone conform to their idea of
Usenet bliss.

Post how you want to.


-Michael