UAC

  • Thread starter Thread starter msnews
  • Start date Start date
M

msnews

Leading up to the release of Vista there was a lot of speculation about end
users turning off UAC. Can the "evangelists" and "naysayers" here offer
their experiences?
 
UAC serves as a 'warning'.. if you feel that you do not need it, MS have
provided the option to turn it off.. if you as a parent/system admin feel
that your kids/workforce need 'controlling', you can leave it turned on..


msnews said:
Leading up to the release of Vista there was a lot of speculation about
end users turning off UAC. Can the "evangelists" and "naysayers" here
offer their experiences?
Click to expand...

--


Mike Hall
MS MVP Windows Shell/User
http://msmvps.com/blogs/mikehall/
 
as intrusive as it is.
as aggravating as it gets.
I still leave it turned on because of the extra security it provides.
since you have to approve every program that runs, it gives you notice if some program wants to run another program.



(e-mail address removed)



Leading up to the release of Vista there was a lot of speculation about end
users turning off UAC. Can the "evangelists" and "naysayers" here offer
their experiences?
 
Leading up to the release of Vista there was a lot of speculation
about end users turning off UAC. Can the "evangelists" and
"naysayers" here offer their experiences?
Click to expand...

I use it at home and work, altough my fellow workers turned UAC off. I
find it no problem at all...makes you think about what you are doing before
you do it.

Adam
 
Although I currently have it turned off, it's not really that bad. In fact,
I bought a program for XP that does essentially the same thing, but UAC is
actually less intrusive, and more user friendly than the program I bought
for XP.

-- Larry Maturo
 
I wouldn't put it all on UAC, but I have no enabled admin account on my
system (Vista makes this situation a bit easier to be in). The issue with
UAC is that the author didn't take into account what happens when there are
no accounts, leaving it very confusing when it asks for a password when
there is no place to enter one (when there are zero items in the list, there
shoudl be a different message).

I think MS did a pretty good job of securing the OS, but the shell, being
what it is and has become over years of bandaids, has enough holes to really
screw the user in how it manages the security.
 
I use it at home and work, altough my fellow workers turned UAC off. I
find it no problem at all...makes you think about what you are doing before
you do it.

Adam
Click to expand...

How many problems UAC causes, if any, is directly releated to what you
do with your system, to a great extent what legacy software you have
installed and if or not Vista in it's present state is or isn't
hard-wired to bypass "false" UAC prompts for your particular software.

Don't take my word for it, but it is what I've been saying for over a
month, ie, UAC while a good idea, is not presntly implemented very
well is now confimed by the two authorites that ought to know, the two
people most responsible for writing the code behind UAC. Check out the
64 minute interview and learn from the Microsoft engineers that wrote
UAC for Microsoft.

http://channel9.msdn.com/ShowPost.aspx?PostID=288259

Also note the people here that were ranting and raving at people
saying they didn't know how to use UAC, implying they had to be
"stupid" are now back pedaling at warp speed since the truth is out.

This proves once again, take anything said in newsgroups with a
liberal amount of salt and learn who the bullshit artists are.
 
msnews said:
Leading up to the release of Vista there was a lot of speculation about
end users turning off UAC. Can the "evangelists" and "naysayers" here
offer their experiences?
Click to expand...
In the meantime I had two situations, where the UAC prevent me from some
realy bad things, some unwandet access from programs to windows files. AND I
have learn to setup my system to work without problems togehter with this
UAC.

Peter
 
While I'm first configuring the PC, I turn it off. It can be maddening.
After it's all done and I'm not installing (much...), then I turned it
back on.

All the people that complain are usually told to go to Linux. But, it
makes you have higher rights, too. "sudo make me some toast!".

Yes, it can be VERY annoying. I saw a picture that said "You moved your
mouse. Are you sure you want to use your mouse?" as a UAC prompt. It was
pretty much right.

But, it's also a very good way to protect yourself. If I'm just playing
around on the internet and I see "T&A needs permission to install, do
you want to allow?", I'd say no. I bet it would probably catch the Sony
rootkit type of issues, and the StarForce copy protection hidden driver
installs. So, that's a good thing.
 
For most software installations directly from CD/DVD, the warning doesn't
make sense if you are the only user/admin.
Hmm... I bought the software from a vendor and I want to
install it. If it has spyware, or worse, I'm probably going to
ignore the UAC prompts anyway.

For anything downloaded or automatically installed when you go to a site, it
has worked as I felt it should. But, so did my third party software that at
least learned what I was doing and quit prompting me so much.

While I prefer to make the choice of which viruses/spyware/malware will be
installed, I think a little better coordination between IE7 and Vista is
needed.

Try the following:
Open the Gadget Menu and select Browse for more gadgets.
This will take you to the Microsoft Website for gadgets.

They are all third party and will try to "run" outside of IE7
protected mode if you opt to install them directly to the Sidebar. (vice
saving them first)

This results in no less than seven warnings or messages on my
machine for a program I desire to install.

A bit of an overkill.


While I agree with UAC, I don't really care for UAC's draconian approach.
IE7's Protected Mode seems to be a good feature, but needs to work with UAC a
bit better.
 
Thanks, all, for your thoughts. I'm trying (desperately) to determine why
I'd want to upgrade to Vista and so far all I can come up with is "it's
different" or "it's prettier" - not exactly stellar reasons to spend a good
chunk of change.

I thought that the UAC was the main selling point - providing additional
security so that you, as a user, didn't have to worry about it. Seems to me
that with the UAC turned ON a user would just get used to seeing the prompts
and simple "OK" everything anyway without understanding what it is they're
doing. IMO that's no different than than opening emails from unknown
sources.

Is the UAC more for businesses than it is for home users (who, quite
frankly, may not understand what it is they're doing in the first place)?
 
msnews said:
Thanks, all, for your thoughts. I'm trying (desperately) to determine why
I'd want to upgrade to Vista and so far all I can come up with is "it's
different" or "it's prettier" - not exactly stellar reasons to spend a
good chunk of change.

I thought that the UAC was the main selling point - providing additional
security so that you, as a user, didn't have to worry about it. Seems to
me that with the UAC turned ON a user would just get used to seeing the
prompts and simple "OK" everything anyway without understanding what it is
they're doing. IMO that's no different than than opening emails from
unknown sources.

Is the UAC more for businesses than it is for home users (who, quite
frankly, may not understand what it is they're doing in the first place)?
Click to expand...


The idea of people simply clicking through every time they see UAC as an
argument is actually a good one, IF it popped up every time you tried to do
something, as the Apple TV ad implies . . . it doesn't.

It only pops up when you're making a system change (or opening a
component/program that can make system changes) and when you're installing
new software, and/or when an un-registered (or blocked) program is run.

When you're installing something, you learn to expect to see the UAC warning
pop up, so you click "OK" and continue on . . . the idea is, if you're
simply sitting there working in Word, or reading a web page, and you
suddenly see UAC pop up telling you some program is trying to install, or
access some 'restricted' area of your computer, then you (hopefully) would
be suspicious and investigate what it is before clicking "OK" and if you
find that it isn't something you initiated, be smart enough to click "NO"
and assume something has just tried to install something you didn't ask for,
or want on your system.

This is UACs strength, it's just there as a warning, and a way to allow YOU
to stop things that you didn't ask for from getting into, or making changes
to your system.

Turning it off allows just about everything to run, or make system changes,
without your knowledge or approval. This was XPs greatest weakness, along
with every user defaulting to having root/administrative privileges.

Mic
 
The idea of people simply clicking through every time they see UAC as an
argument is actually a good one, IF it popped up every time you tried to do
something, as the Apple TV ad implies . . . it doesn't.

It only pops up when you're making a system change (or opening a
component/program that can make system changes) and when you're installing
new software, and/or when an un-registered (or blocked) program is run.
Click to expand...

Deleting a desktop shortcut is a system change? I've got a UAC nag
trying to do that. Not letting me move files from data drive "F" to
"E" manually UAC instead squealed like a stuck pig. My backup program
doing the same thing automatically for not just one file, but
thousands at a time, Vista didn't utter a peep. See anything wrong
with UAC implementaiton?
Turning it off allows just about everything to run, or make system changes,
without your knowledge or approval. This was XPs greatest weakness, along
with every user defaulting to having root/administrative privileges.
Click to expand...

Some starling facts to chew on. Microsoft estimates that 90% of all
users under XP ran as administrator. More starling, according to the
two engineers that wrote the UAC routine say their research inhouse
showed Microsoft's own software engineers writing Windows applications
DESIGNED them to require administrator access, often for no reason, as
opposed to standard user. The biggest goof of all is Windows including
VISTA ships and installs (unless you change it) with whoever installs
it and sets it up having full administrator rights. If Micrsoft was
really serious about security, you think such things would be
different.

Damn funny, don't you think? Old habits are hard to break...
especially for Microsoft.
 
Adam Albright said:
Deleting a desktop shortcut is a system change? I've got a UAC nag
trying to do that. Not letting me move files from data drive "F" to
"E" manually UAC instead squealed like a stuck pig. My backup program
doing the same thing automatically for not just one file, but
thousands at a time, Vista didn't utter a peep. See anything wrong
with UAC implementaiton?


Some starling facts to chew on. Microsoft estimates that 90% of all
users under XP ran as administrator. More starling, according to the
two engineers that wrote the UAC routine say their research inhouse
showed Microsoft's own software engineers writing Windows applications
DESIGNED them to require administrator access, often for no reason, as
opposed to standard user. The biggest goof of all is Windows including
VISTA ships and installs (unless you change it) with whoever installs
it and sets it up having full administrator rights. If Micrsoft was
really serious about security, you think such things would be
different.

Damn funny, don't you think? Old habits are hard to break...
especially for Microsoft.
Click to expand...


I don't know why UAC is causing you so much grief (deleting/moving files,
etc.) I haven't run into that.

There are times I've inserted a flash drive and had to take ownership of a
folder on it before it would allow me to delete the entire folder (I could,
however delete files, I could also delete sub-folders as long as they were
empty. Yes, this is strange, but really the only annoyance I've personally
run into with UAC.)

You always need at least ONE admin/root account on a system, but I agree,
Microsoft should explain in detail right at the screen (in fact BEFORE the
screen) that comes up to create the first (admin) account, what the account
you're creating at that moment is capable of, for, and that the average user
should create ANOTHER standard account for day-to-day use.

So I agree with you there.

Mic
 
I don't know why UAC is causing you so much grief (deleting/moving files,
etc.) I haven't run into that.
Click to expand...

I explained in more detail a couple weeks back, you probably missed
it. In a nutshell I installed Vista in place, not a clean install
because I have over a million files, a little past 1 TB worth. These
files were created under XP. The owners of these files could be any
one of a bunch of various applications (according to Vista) or were
owned by me or some other user of this system. Because I was running
out of hard drive space while still running XP I moved thousands of
files to my C drive to several folders just a temporary storage... the
only drive I had room to store them in till I had a chance to get a
new hard drive. Back in October my motherboard suddenly died. THAT is
the reason I upgraded to Vista now, instead of waiting.

Now this is where it gets interesting. After a successful install of
Vista with UAC enabled I stated to do a little house cleaning or I
should say I tried to. With a new MB and a added 750 GB drive I again
had plenty of room. As I related to this newsgroup or maybe it was the
install group, I forget, I just picked one folder on my C drive and
TRIED to move files from it back to where they belonged. If I recall
correctly out of the first 10 files Vista nagged on 4 or 5 files and
refused to let me move them no matter what.

As happens in this kind of newsgroup all too often I was immediately
gang raped by the usual suspects. I was told I don't know what UAC
was. I don't how to change it. I should learn about permissions, go
back to using XP, I don't understand these were actually NTFS
permissions, I must be dumb, etc., etc. You know the drill.

Of course all those characters never bothered to continue to read what
else I said. I explained in detail that clicking on the security tab
and from there the advanced button to the edit button these files
either had no permissions to change whatsoever, the area being totally
white and devoid of anything or if there were permissions they were
grayed out and unchangeable no matter what. Yet this obvious Vista bug
became 'my fault'. So my first experience was I could NOT take
ownership or move or work on these files unless and until I turned the
damn UAC feature off. If I didn't do that I would still be trying to
fiddle with thousands of files, one by one because Vista would not
accept any inherited permissions either. It is TOTALLY screwed up how
UAC works, especially on your root drive. In typical Microsoft fashion
they make no warnings or give any cautions, besides, doing a install
in place what other choices did I have?
 
Michael said:
You always need at least ONE admin/root account on a system, but I
agree, Microsoft should explain in detail right at the screen (in fact
BEFORE the screen) that comes up to create the first (admin) account,
what the account you're creating at that moment is capable of, for, and
that the average user should create ANOTHER standard account for
day-to-day use.
Click to expand...

I don't agree with this at all, and I think it is the one area where
Microsoft over-thought the problem. When I am the sole user of the computer
(which is the case with 90% of computers I suspect) I AM the administrator.
There isn't any sense at ALL to having a standard user account if in fact I
am not a standard user.

I guess it is because I do come from UNIX. I see Admin accounts on Windows
as the sudoers. They have the right to do anything, but they have to approve
any action that alters the system or application file area. The Built-In
Administrator is the same as the UNIX 'root' user. It should have full
access. It should rarely be used, and it shouldn't require elevation prompts
because it is by it's very nature the most elevated account.

Microsoft's error, IMHO, is that it didn't think about how people REALLY use
their computers.
 
Well over half of home computers have multiple uses. MS has research on this
somewhere.

I doubt the include the pocket computers called mobile phones. I use my
mobile as a PIM not windows.
 
Michael said:
There are times I've inserted a flash drive and had to take ownership of
a folder on it before it would allow me to delete the entire folder (I
could, however delete files, I could also delete sub-folders as long as
they were empty. Yes, this is strange, but really the only annoyance
I've personally run into with UAC.)
Click to expand...

This one drives me absolutely bonkers, and is my main reason for aggravation
with Microsoft. Admin accounts are not ADMIN accounts if you can't even
delete a file/directory even AFTER elevation.

For instance, I start up a CMD shell with Admin rights, I should then be
able to see what's in "C:\System Volume Information" then correct? NOPE!
Somehow even an administrator's account cannot see inside of some
directories. It is as if there is a secret Bill Gate's level of security on
my own system that doesn't allow a mortal to have full access to things.
Until that problem is fixed in Windows, it is just a toy operating system.
 
If you really want to an admin can go in. There are just almost no reason to
so, and deleting any file will stuff system restore. If MS had implemented
SR as a database holding blobs, and didn't give you access to the database,
would you still complain. I haven't heard you complain about Desktop's
Search database.
 
.. said:
If you really want to an admin can go in. There are just almost no
reason to so, and deleting any file will stuff system restore. If MS had
implemented SR as a database holding blobs, and didn't give you access
to the database, would you still complain.
Click to expand...

Yes, admin is admin. If I am using an Admin shell to do maintenance, I want
full access to the system files. I know I can change permissions, but that
would seem to defeat the purpose. If I am not the true admin of my machine
than who is? Some geek at Microsoft? No thanks.
I haven't heard you complain about Desktop's Search database.
Click to expand...

Because I haven't bumped into it yet.
 
Back
Top