Vista - Vista User Account Control

"Ronnie Vernon MVP" <rv@invalid.org> wrote in message
news:4D2CD31E-72ED-4811-BC3F-E9E78DB6A38B@microsoft.com...
> "Jay" <nospam@**here.com> wrote in message
> news:e1sLiMyrHHA.1404@TK2MSFTNGP03.phx.gbl...
>>
>> Crazy. Why would a piece of software want/need to run as admin?
>> Some sort of catch all situation to ensure no problems at run time?
>>
>> Jay
>
> Jay
>
> If a program is Vista compatible, you should never see an administrator
> prompt, except when the program is first installed. From then on, running
> the program should be seamless with no prompts for privilege elevation.

Yep thanks, I know this...
My question was aimed at coders not Windows versions as such.
Why would somebody create an application that needed to run under the admin
context.
Do they give it most elevated permissions in order to by-pass any unforeseen
run time issues thus making their product appear seamless and easy to use.

Jay


> As others have said, programs that ask for admin privileges, each time
> they run, were written for earlier versions of Windows, such as XP. With
> XP, despite recommendations to the contrary, nearly everyone used a full
> administrator account. This enabled the software developers to get lazy
> and simply code their programs to run with full, system wide access. This
> led to the overwhelming security problems in these earlier versions of
> Windows. The bad people could easily write malicious programs and simply
> run them with the within the users admin account, completely in the
> background and invisible to the user.
>
> Vista enforces a new security model, which should have been done a long
> time ago. Developers have had over 5 years to get ready for Vista, but
> despite this, many have still not updated their programs. I do a lot of
> beta testing for many different developers and once they understand what
> has to be done to get their programs Vista compatible, I have seen them
> make the necessary changes in less than one day.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>
>
>
>
>
>
>
>
>

On Sat, 16 Jun 2007 09:25:03 +1200, "Jay" <nospam@**here.com> wrote, by
way of <ecYtlN5rHHA.1476@TK2MSFTNGP06.phx.gbl>, in
microsoft.public.windows.vista.general -->

[snip]
>Why would somebody create an application that needed to run under the admin
>context.
[snip]

Perhaps so that said app would not have a requirement to keep being
clicked, over & over & over again, when the situation is "as plain as
the nose on your face" of said user having given the app permission to
run, & being bloody sick & tired of having to _keep_ giving
permission[s]?

If Vista does not already have some simple means of allowing such & such
an app to ask permission, once, to run (and no additional "asking"
required), and then "Be DONE with 'it'!!", then now is certainly the
time to implement such (notice, allow, then no further notices).

--

Millenia ago, cats were worshipped as Gods.
They (the cats) have never forgotten this.

"Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
news:re1673ha9hur8pru7tufkohmtj50l251dv@4ax.com...
> On Sat, 16 Jun 2007 09:25:03 +1200, "Jay" <nospam@**here.com> wrote, by
> way of <ecYtlN5rHHA.1476@TK2MSFTNGP06.phx.gbl>, in
> microsoft.public.windows.vista.general -->
>
> [snip]
>>Why would somebody create an application that needed to run under the
>>admin
>>context.
> [snip]
>
> Perhaps so that said app would not have a requirement to keep being
> clicked, over & over & over again, when the situation is "as plain as
> the nose on your face" of said user having given the app permission to
> run, & being bloody sick & tired of having to _keep_ giving
> permission[s]?

You are missing the point, what reason should a program need to impersonate
an admin account?
What is this app doing that it needs admin persmissions in order to do so.
Hardware calls should be made via the OS, file system tasks should be done
in it's own program files folder and under the context of the USER running
it.

I'm not talking install, I'm talking run time.

Jay


> If Vista does not already have some simple means of allowing such & such
> an app to ask permission, once, to run (and no additional "asking"
> required), and then "Be DONE with 'it'!!", then now is certainly the
> time to implement such (notice, allow, then no further notices).
>
> --
>
> Millenia ago, cats were worshipped as Gods.
> They (the cats) have never forgotten this.

On Sat, 16 Jun 2007 09:49:12 +1200, "Jay" <nospam@**here.com> wrote, by
way of <u7#8Db5rHHA.5032@TK2MSFTNGP04.phx.gbl>, in
microsoft.public.windows.vista.general -->

>
>"Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
>news:re1673ha9hur8pru7tufkohmtj50l251dv@4ax.com...
[snip]
>You are missing the point, what reason should a program need to impersonate
>an admin account?
[snip]

Perhaps what is being missed (or, at least, diminished) here is that,
while many people might not object to a given app displaying a "notice
of impending" (my words) once, they darn sure _do_ object to being
dunned, over and over again, against being required to keep
pounding-away so as to re-authorizing, and re-re-authorizing, and
re-re-re-authorizing, and . . . . perhaps the point has been made
more-clear to you, just now?

Authorize once, and be _done_ with it (whatever "it" may be).

"Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
news:8q2673tcqs38v8q7f8qtk3av3716h327i8@4ax.com...
> On Sat, 16 Jun 2007 09:49:12 +1200, "Jay" <nospam@**here.com> wrote, by
> way of <u7#8Db5rHHA.5032@TK2MSFTNGP04.phx.gbl>, in
> microsoft.public.windows.vista.general -->
>
>>
>>"Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
>>news:re1673ha9hur8pru7tufkohmtj50l251dv@4ax.com...
> [snip]
>>You are missing the point, what reason should a program need to
>>impersonate
>>an admin account?
> [snip]
>
> Perhaps what is being missed (or, at least, diminished) here is that,
> while many people might not object to a given app displaying a "notice
> of impending" (my words) once, they darn sure _do_ object to being
> dunned, over and over again, against being required to keep
> pounding-away so as to re-authorizing, and re-re-authorizing, and
> re-re-re-authorizing, and . . . . perhaps the point has been made
> more-clear to you, just now?

Earlier in this thread (and what I was replying to) was the suggestion that
software written for XP was run with administrator privaledges and now when
they run under Vista this is apparent by the number of pop ups seeking
permission. My question was and is why would an app be written to run as
admin unless performing admin functions or accessing sensitive parts of the
OS. Not why does vista not allow someone to say "yes" and have the OS
remember that.

> Authorize once, and be _done_ with it (whatever "it" may be).

Jay wrote:
> "Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
> news:8q2673tcqs38v8q7f8qtk3av3716h327i8@4ax.com...
>> On Sat, 16 Jun 2007 09:49:12 +1200, "Jay" <nospam@**here.com> wrote, by
>> way of <u7#8Db5rHHA.5032@TK2MSFTNGP04.phx.gbl>, in
>> microsoft.public.windows.vista.general -->
>>
>>> "Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
>>> news:re1673ha9hur8pru7tufkohmtj50l251dv@4ax.com...
>> [snip]
>>> You are missing the point, what reason should a program need to
>>> impersonate
>>> an admin account?
>> [snip]
>>
>> Perhaps what is being missed (or, at least, diminished) here is that,
>> while many people might not object to a given app displaying a "notice
>> of impending" (my words) once, they darn sure _do_ object to being
>> dunned, over and over again, against being required to keep
>> pounding-away so as to re-authorizing, and re-re-authorizing, and
>> re-re-re-authorizing, and . . . . perhaps the point has been made
>> more-clear to you, just now?
>
> Earlier in this thread (and what I was replying to) was the suggestion that
> software written for XP was run with administrator privaledges and now when
> they run under Vista this is apparent by the number of pop ups seeking
> permission. My question was and is why would an app be written to run as
> admin unless performing admin functions or accessing sensitive parts of the
> OS. Not why does vista not allow someone to say "yes" and have the OS
> remember that.
>
>> Authorize once, and be _done_ with it (whatever "it" may be).
>
>

You can't say "remember me" because an admin program must prompt each
time it is run.

This prevents malicious programs from running trusted admin utilities to
take over your computer.

UAC is not just asking you if you trust a program, it is more
importantly asking you "Did you actually start this program?"

The prompt is not really annoying for most users when it protects a
program that actually *needs* admin power, because you generally don't
run these types of programs that often.

What *is* annoying is having to run a general-use program with admin
power over and over again when it shouldn't need it.

--
-JB
Microsoft MVP - Windows Shell/User
Windows Vista Support FAQ - http://www.jimmah.com/vista/

"Jimmy Brush" <jb@mvps.org> wrote in message
news:%23nwTFI6rHHA.4076@TK2MSFTNGP03.phx.gbl...

>
> What *is* annoying is having to run a general-use program with admin power
> over and over again when it shouldn't need it.

Exactly! and is what I was referring to in this thread.

Jay

In message <eryyicxrHHA.3896@TK2MSFTNGP04.phx.gbl> "Richard Urban"
<richardurbanREMOVETHIS@hotmail.com> wrote:

>This is happening because poorly written programs from Windows XP usually
>want to run as an administrator. This is against the new security standards
>of Vista. When you start the program you will get a popup asking if you want
>the program to run.

.... From Windows 98, not from Vista ...

All NT based versions of Windows are designed to run applications
without administrative permissions.

--
If quitters never win, and winners never quit,
what fool came up with, "Quit while you're ahead"?

There is no reason why a program can not be written to run as a user. You do
not need administrator privileges. The coders are lazy.

When they write properly you will not be seeing any pop ups at all.

Vista is warning you that you have old software that is not up to current
coding standards (for the past 5 years).

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)



"Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
news:8q2673tcqs38v8q7f8qtk3av3716h327i8@4ax.com...
> On Sat, 16 Jun 2007 09:49:12 +1200, "Jay" <nospam@**here.com> wrote, by
> way of <u7#8Db5rHHA.5032@TK2MSFTNGP04.phx.gbl>, in
> microsoft.public.windows.vista.general -->
>
>>
>>"Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
>>news:re1673ha9hur8pru7tufkohmtj50l251dv@4ax.com...
> [snip]
>>You are missing the point, what reason should a program need to
>>impersonate
>>an admin account?
> [snip]
>
> Perhaps what is being missed (or, at least, diminished) here is that,
> while many people might not object to a given app displaying a "notice
> of impending" (my words) once, they darn sure _do_ object to being
> dunned, over and over again, against being required to keep
> pounding-away so as to re-authorizing, and re-re-authorizing, and
> re-re-re-authorizing, and . . . . perhaps the point has been made
> more-clear to you, just now?
>
> Authorize once, and be _done_ with it (whatever "it" may be).

Yes, I know that. But the program must be written to take advantage of this
capability in NT based Windows. Many programmers take the easy way out and
run their program under administrator.

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)



"DevilsPGD" <spam_narf_spam@crazyhat.net> wrote in message
news:rdd67391vhnvfcp44hvubm6eijn4rqbroq@4ax.com...
> In message <eryyicxrHHA.3896@TK2MSFTNGP04.phx.gbl> "Richard Urban"
> <richardurbanREMOVETHIS@hotmail.com> wrote:
>
>>This is happening because poorly written programs from Windows XP usually
>>want to run as an administrator. This is against the new security
>>standards
>>of Vista. When you start the program you will get a popup asking if you
>>want
>>the program to run.
>
> ... From Windows 98, not from Vista ...
>
> All NT based versions of Windows are designed to run applications
> without administrative permissions.
>
> --
> If quitters never win, and winners never quit,
> what fool came up with, "Quit while you're ahead"?