Vista Tutorial - How to declare a program as "trusted"

How can I declare a program I know as "trusted" so that UAC does not always
ask me for authorization to run it?
Thanks for suggestions

You can't. It would defeat the purpose of uac. What would stop programs from
changing this setting them self?

--
Kerry Brown
Microsoft MVP - Shell/User
www.vistahelp.ca/phpBB2


"petermcwerner" <petermcwerner@discussions.microsoft.com> wrote in message
news:3CEBEAD8-69C2-42AF-BA0C-A32303CF0C5E@microsoft.com...
> How can I declare a program I know as "trusted" so that UAC does not
> always
> ask me for authorization to run it?
> Thanks for suggestions

A damn nuisance. The alternative of turning off UAC completely is not a good
one either but I may be forced to do so because it is too disturbing and time
consuming to continuously give authorizations.

>What would stop programs from
> changing this setting them self?

For instance by asking for my password. Can't UAC distinguish between my
input as user and what the program tries to do?



"Kerry Brown" wrote:

> You can't. It would defeat the purpose of uac. What would stop programs from
> changing this setting them self?
>
> --
> Kerry Brown
> Microsoft MVP - Shell/User
> www.vistahelp.ca/phpBB2
>
>
> "petermcwerner" <petermcwerner@discussions.microsoft.com> wrote in message
> news:3CEBEAD8-69C2-42AF-BA0C-A32303CF0C5E@microsoft.com...
> > How can I declare a program I know as "trusted" so that UAC does not
> > always
> > ask me for authorization to run it?
> > Thanks for suggestions
>
>

Hello,

> For instance by asking for my password. Can't UAC distinguish between my
> input as user and what the program tries to do?

Once you've pre-approved an application to run elevated without consent, the
cat is out of the bag. Other programs can run that program and bypass their
privilege restrictions.

Imagine the case where you mark the command prompt as
always-elevated-without-prompt. Other programs could start a command prompt
and then run some payload from that elevated command prompt with full
privileges - without you knowing about it - thus defeating the purpose of uac.

As for your second point, YES Windows can be made to tell whether you are
performing UI - but it CANNOT know what you intend to do with the UI.

To use my command prompt example, Windows could be modified so that a
program could only launch the elevate-without-prompting command prompt when
you say click a button. But, a malicious program could pop up a message box
saying you won a thousand dollars and only offer one button, OK, for the user
to click on to dismiss the dialog - and when the user clicks that button, WAM
the payload would be executed.

Windows CAN tell when you are doing UI ... Windows CANNOT tell what you
intend to accomplish by performing the UI, nor what an application will do
with said UI.

- JB

Are you using one of the Beta builds or RTM?
UAC has steadily gotten better.
I rarely see it in RTM and have left it enabled.

--
Jupiter Jones [MVP]
http://www3.telus.net/dandemar
http://www.dts-l.org


"petermcwerner" <petermcwerner@discussions.microsoft.com> wrote in message
news:3CEBEAD8-69C2-42AF-BA0C-A32303CF0C5E@microsoft.com...
> How can I declare a program I know as "trusted" so that UAC does not
> always
> ask me for authorization to run it?
> Thanks for suggestions

I'm in the same boat here. I mark a program as trusted and was getting
pop-ups everytime I used it (inclueding I.E. 7) I got so tired of it that I
just shut down the uac and have been pop-up free ever since...
BTW: I'm running vista rc1(bummer) missed the boat on rc2......And stuck
waiting for vista to hit the stores...
--
Just when you thought you had the top of the line system...You find out that
you have to upgrade yet again. The pain gasp!!
The suffering!!
Until Payday!!!


"Jupiter Jones [MVP]" wrote:

> Are you using one of the Beta builds or RTM?
> UAC has steadily gotten better.
> I rarely see it in RTM and have left it enabled.
>
> --
> Jupiter Jones [MVP]
> http://www3.telus.net/dandemar
> http://www.dts-l.org
>
>
> "petermcwerner" <petermcwerner@discussions.microsoft.com> wrote in message
> news:3CEBEAD8-69C2-42AF-BA0C-A32303CF0C5E@microsoft.com...
> > How can I declare a program I know as "trusted" so that UAC does not
> > always
> > ask me for authorization to run it?
> > Thanks for suggestions
>
>

I am running RTM and have turned it off because of one program. I need my VPN
client to start with windows but it won't so I have turned off the UAC.

Brad

"Jupiter Jones [MVP]" wrote:

> Are you using one of the Beta builds or RTM?
> UAC has steadily gotten better.
> I rarely see it in RTM and have left it enabled.
>
> --
> Jupiter Jones [MVP]
> http://www3.telus.net/dandemar
> http://www.dts-l.org
>
>
> "petermcwerner" <petermcwerner@discussions.microsoft.com> wrote in message
> news:3CEBEAD8-69C2-42AF-BA0C-A32303CF0C5E@microsoft.com...
> > How can I declare a program I know as "trusted" so that UAC does not
> > always
> > ask me for authorization to run it?
> > Thanks for suggestions
>
>

You now have a system that anyone can use to access the computers and
servers protected by the VPN. Why use a VPN at all? Just put your
company's data on an open IP address so the world can do whatever they want
with it.

"bhorn2001" <bhorn2001@discussions.microsoft.com> wrote in message
news:27A0724A-6363-418C-ACF5-D7C91F28A2ED@microsoft.com...
>I am running RTM and have turned it off because of one program. I need my
>VPN
> client to start with windows but it won't so I have turned off the UAC.
>
> Brad
>
> "Jupiter Jones [MVP]" wrote:
>
>> Are you using one of the Beta builds or RTM?
>> UAC has steadily gotten better.
>> I rarely see it in RTM and have left it enabled.
>>
>> --
>> Jupiter Jones [MVP]
>> http://www3.telus.net/dandemar
>> http://www.dts-l.org
>>
>>
>> "petermcwerner" <petermcwerner@discussions.microsoft.com> wrote in
>> message
>> news:3CEBEAD8-69C2-42AF-BA0C-A32303CF0C5E@microsoft.com...
>> > How can I declare a program I know as "trusted" so that UAC does not
>> > always
>> > ask me for authorization to run it?
>> > Thanks for suggestions
>>
>>

You can create a manifest for the program. So, for example, the file,
sample.exe, can have an embedded manifest, or you can create on in the same
directory with the name sample.exe.manifest. You can use a program called XN
resource editor to look at the manifest for executable files, but if you
modify some of these manifests, you may also change the hash on the
executable. This isn't a big deal if it is a program like an inhouse app,
but may cause issues with digitally signed applications.

I am just getting into the meat of this, but these is a way.
--
MCSE: Security, CCNA, A+, Network +, Security+


"petermcwerner" wrote:

> How can I declare a program I know as "trusted" so that UAC does not always
> ask me for authorization to run it?
> Thanks for suggestions

Hello,

You can make/change the manifest to tell Windows how much privilege the
specific application needs; however, this won't allow you to always trust an
application. If you specify in the manifest that the application needs
administrator privileges then the system will prompt with UAC.


- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/