Vista User Account Control

[Roger Stenson]

Hi all
When I start most of my usual, mostly Microsoft, software I have no
messages. When I start some of my hobby software, e.g. my bridge scoring
software, the system reports that this is an unknown publisher and I have
to authorize it to run.

I use MS OneCare security and the current release is allowed in the
Firewall. Is there anything I can do to assure user account control
permanently that the software's publisher is known to me and is kosher
Roger Stenson

 

[Rock]

Hi all
When I start most of my usual, mostly Microsoft, software I have no
messages. When I start some of my hobby software, e.g. my bridge scoring
software, the system reports that this is an unknown publisher and I have
to authorize it to run.

I use MS OneCare security and the current release is allowed in the
Firewall. Is there anything I can do to assure user account control
permanently that the software's publisher is known to me and is kosher
Roger Stenson

No. That software must be asking to run with Admin privileges. When that
happens it gives the prompt to authorize it. You can't authorize it for all
future runnings of the app.

 

[Lang Murphy]

No. That software must be asking to run with Admin privileges. When that
happens it gives the prompt to authorize it. You can't authorize it for
all future runnings of the app.

You can't set the exe to run as admin?

Lang

 

[Richard Urban]

This is happening because poorly written programs from Windows XP usually
want to run as an administrator. This is against the new security standards
of Vista. When you start the program you will get a popup asking if you want
the program to run.

When/if the programs developer updates the program to be Vista compatible,
this will no longer occur,

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)

 

[Jay]

This is happening because poorly written programs from Windows XP usually
want to run as an administrator.

Crazy. Why would a piece of software want/need to run as admin?
Some sort of catch all situation to ensure no problems at run time?

Jay

 

[Tiberius]

This is happening because poorly written programs from Windows XP usually

want to run as an administrator. This is against the new security
standards of Vista.

you are one mixed up puppy

 

[Steve Easton]

This is happening because poorly written programs from Windows XP usually want to run as
an administrator.

Not necessarily true.
The program only needs to contain a function that requires administrator privileges to
complete the function.

You can however "force" the program to request admin privileges with the use of a manifest
file.

 

[Steve Easton]

Is your administrator service ( account ) set to automatic, and does it have a password?
It actually runs as a service in Vista.
If set to run automatically you will have the option of either logging in to the admin
account or the user account at boot.
If you select the admin account and the machine continues and loads with out asking for a
password, then give the admin account a password.

Then reboot, and select the user account.
Launch the program and let it ask for admin privileges, you will be prompted for the admin
password.
Give it the password and then continue.
From then on the program will "supposedly" run with out prompting for admin privileges.

 

[Jimmy Brush]

Hi all
When I start most of my usual, mostly Microsoft, software I have no
messages. When I start some of my hobby software, e.g. my bridge scoring
software, the system reports that this is an unknown publisher and I
have to authorize it to run.

I use MS OneCare security and the current release is allowed in the
Firewall. Is there anything I can do to assure user account control
permanently that the software's publisher is known to me and is kosher
Roger Stenson

Hello,

There are a few different screens you may be seeing.

Can you type out some of the message that it displays when you start it?

 

[Ronnie Vernon MVP]

Crazy. Why would a piece of software want/need to run as admin?
Some sort of catch all situation to ensure no problems at run time?

Jay

Jay

If a program is Vista compatible, you should never see an administrator
prompt, except when the program is first installed. From then on, running
the program should be seamless with no prompts for privilege elevation.

As others have said, programs that ask for admin privileges, each time they
run, were written for earlier versions of Windows, such as XP. With XP,
despite recommendations to the contrary, nearly everyone used a full
administrator account. This enabled the software developers to get lazy and
simply code their programs to run with full, system wide access. This led to
the overwhelming security problems in these earlier versions of Windows. The
bad people could easily write malicious programs and simply run them with
the within the users admin account, completely in the background and
invisible to the user.

Vista enforces a new security model, which should have been done a long time
ago. Developers have had over 5 years to get ready for Vista, but despite
this, many have still not updated their programs. I do a lot of beta testing
for many different developers and once they understand what has to be done
to get their programs Vista compatible, I have seen them make the necessary
changes in less than one day.

 

[Jay]

Jay

If a program is Vista compatible, you should never see an administrator
prompt, except when the program is first installed. From then on, running
the program should be seamless with no prompts for privilege elevation.

Yep thanks, I know this...
My question was aimed at coders not Windows versions as such.
Why would somebody create an application that needed to run under the admin
context.
Do they give it most elevated permissions in order to by-pass any unforeseen
run time issues thus making their product appear seamless and easy to use.

Jay

 

[Manatee Memories]

way of <[email protected]>, in
microsoft.public.windows.vista.general -->

[snip]

Why would somebody create an application that needed to run under the admin
context.

[snip]

Perhaps so that said app would not have a requirement to keep being
clicked, over & over & over again, when the situation is "as plain as
the nose on your face" of said user having given the app permission to
run, & being bloody sick & tired of having to _keep_ giving
permission?

If Vista does not already have some simple means of allowing such & such
an app to ask permission, once, to run (and no additional "asking"
required), and then "Be DONE with 'it'!!", then now is certainly the
time to implement such (notice, allow, then no further notices).

 

[Jay]

way of <[email protected]>, in
microsoft.public.windows.vista.general -->

[snip]

Why would somebody create an application that needed to run under the
admin
context.

[snip]

Perhaps so that said app would not have a requirement to keep being
clicked, over & over & over again, when the situation is "as plain as
the nose on your face" of said user having given the app permission to
run, & being bloody sick & tired of having to _keep_ giving
permission?

You are missing the point, what reason should a program need to impersonate
an admin account?
What is this app doing that it needs admin persmissions in order to do so.
Hardware calls should be made via the OS, file system tasks should be done
in it's own program files folder and under the context of the USER running
it.

I'm not talking install, I'm talking run time.

Jay

 

[Manatee Memories]

news:[email protected]... [snip]
You are missing the point, what reason should a program need to impersonate
an admin account?

[snip]

Perhaps what is being missed (or, at least, diminished) here is that,
while many people might not object to a given app displaying a "notice
of impending" (my words) once, they darn sure _do_ object to being
dunned, over and over again, against being required to keep
pounding-away so as to re-authorizing, and re-re-authorizing, and
re-re-re-authorizing, and . . . . perhaps the point has been made
more-clear to you, just now?

Authorize once, and be _done_ with it (whatever "it" may be).

 

[Jay]

news:[email protected]... [snip]
You are missing the point, what reason should a program need to
impersonate
an admin account?

[snip]

Perhaps what is being missed (or, at least, diminished) here is that,
while many people might not object to a given app displaying a "notice
of impending" (my words) once, they darn sure _do_ object to being
dunned, over and over again, against being required to keep
pounding-away so as to re-authorizing, and re-re-authorizing, and
re-re-re-authorizing, and . . . . perhaps the point has been made
more-clear to you, just now?

Earlier in this thread (and what I was replying to) was the suggestion that
software written for XP was run with administrator privaledges and now when
they run under Vista this is apparent by the number of pop ups seeking
permission. My question was and is why would an app be written to run as
admin unless performing admin functions or accessing sensitive parts of the
OS. Not why does vista not allow someone to say "yes" and have the OS
remember that.

 

[Jimmy Brush]

news:[email protected]... [snip]
You are missing the point, what reason should a program need to
impersonate
an admin account?

[snip]

Perhaps what is being missed (or, at least, diminished) here is that,
while many people might not object to a given app displaying a "notice
of impending" (my words) once, they darn sure _do_ object to being
dunned, over and over again, against being required to keep
pounding-away so as to re-authorizing, and re-re-authorizing, and
re-re-re-authorizing, and . . . . perhaps the point has been made
more-clear to you, just now?

Earlier in this thread (and what I was replying to) was the suggestion that
software written for XP was run with administrator privaledges and now when
they run under Vista this is apparent by the number of pop ups seeking
permission. My question was and is why would an app be written to run as
admin unless performing admin functions or accessing sensitive parts of the
OS. Not why does vista not allow someone to say "yes" and have the OS
remember that.

Authorize once, and be _done_ with it (whatever "it" may be).

You can't say "remember me" because an admin program must prompt each
time it is run.

This prevents malicious programs from running trusted admin utilities to
take over your computer.

UAC is not just asking you if you trust a program, it is more
importantly asking you "Did you actually start this program?"

The prompt is not really annoying for most users when it protects a
program that actually *needs* admin power, because you generally don't
run these types of programs that often.

What *is* annoying is having to run a general-use program with admin
power over and over again when it shouldn't need it.

 

[Jay]

What *is* annoying is having to run a general-use program with admin power
over and over again when it shouldn't need it.

Exactly! and is what I was referring to in this thread.

Jay

 

[DevilsPGD]

In message <[email protected]> "Richard Urban"

This is happening because poorly written programs from Windows XP usually
want to run as an administrator. This is against the new security standards
of Vista. When you start the program you will get a popup asking if you want
the program to run.

.... From Windows 98, not from Vista ...

All NT based versions of Windows are designed to run applications
without administrative permissions.

 

[Richard Urban]

There is no reason why a program can not be written to run as a user. You do
not need administrator privileges. The coders are lazy.

When they write properly you will not be seeing any pop ups at all.

Vista is warning you that you have old software that is not up to current
coding standards (for the past 5 years).

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)

news:[email protected]... [snip]
You are missing the point, what reason should a program need to
impersonate
an admin account?

[snip]

Perhaps what is being missed (or, at least, diminished) here is that,
while many people might not object to a given app displaying a "notice
of impending" (my words) once, they darn sure _do_ object to being
dunned, over and over again, against being required to keep
pounding-away so as to re-authorizing, and re-re-authorizing, and
re-re-re-authorizing, and . . . . perhaps the point has been made
more-clear to you, just now?

Authorize once, and be _done_ with it (whatever "it" may be).

 

[Richard Urban]

Yes, I know that. But the program must be written to take advantage of this
capability in NT based Windows. Many programmers take the easy way out and
run their program under administrator.

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)