Vista - Vista User Account Control

Right, no one has addressed your exact question.

Just a guess, but, (my opinion) maybe some less experienced programmers just
*thought* that because XP (Experience) used Admin Accounts, similar to a
network with user/admin accounts, that they *should* write software that
wants to be run under Admin. Lame, I know, but third-party software for home
users isn't usually written by professional IT people.

Another idea, (again, my opinion) maybe some of those "programmers" are
self-taught out of books, without the benefit of experienced instructors,
and just honestly didn't know any better.

The thing is, those programs actually worked that way in XP, now they are
less than convenient on Vista.

KB

"Jay" wrote in message news:O8aFHv5rHHA.2368@TK2MSFTNGP05.phx.gbl...
>
> Earlier in this thread (and what I was replying to) was the suggestion
> that software written for XP was run with administrator privaledges and
> now when they run under Vista this is apparent by the number of pop ups
> seeking permission. My question was and is why would an app be written to
> run as admin unless performing admin functions or accessing sensitive
> parts of the OS. Not why does vista not allow someone to say "yes" and
> have the OS remember that.

In message <#tjj2S7rHHA.3896@TK2MSFTNGP04.phx.gbl> "Richard Urban"
<richardurbanREMOVETHIS@hotmail.com> wrote:

>Yes, I know that. But the program must be written to take advantage of this
>capability in NT based Windows. Many programmers take the easy way out and
>run their program under administrator.

Not much needs to be done to take advantage of limited users, rather,
it's a matter of not doing things which require administrative
privileges.

Usually this is just the incorrect assumption that any application can
write anywhere on the system it wants.

The only substantial change in Vista is that non-administrators can no
longer write to the root of the drive (but "Program Files" was always
locked down)

--
If quitters never win, and winners never quit,
what fool came up with, "Quit while you're ahead"?

On Fri, 15 Jun 2007 19:07:52 -0400, Jimmy Brush <jb@mvps.org> wrote, by
way of <#nwTFI6rHHA.4076@TK2MSFTNGP03.phx.gbl>, in
microsoft.public.windows.vista.general -->

[snip]
>
>The prompt is not really annoying for most users when it protects a
>program that actually *needs* admin power, because you generally don't
>run these types of programs that often.

Grant you that.

>What *is* annoying is having to run a general-use program with admin
>power over and over again when it shouldn't need it.

More like _extremely_ annoying.

--

Life got you down? Want nothing than to curl up with your
[insert type of fav pet here], a glass of milk, and some
really great cookies?


http://preview.tinyurl.com/yrcz9v
http://preview.tinyurl.com/ynzgas

Probably the same type of programs that a "limited user" can't install or
run on XP, but an admin can.
In the corporate environment, that may be a good thing, for home users, it
can be a PITA.
UAC may be a good idea for some; but I hate it & think the coders were
incompetent that made it break other things when you turn it off!
--
A Professional Amateur...If anyone knew it all, none of would be here!
CarGodZeroOne@hotmail.com
Change Alpha to Numeric to reply
"KristleBawl" <kristlebawl@hotmail.com> wrote in message
news:OL4N7W7rHHA.4020@TK2MSFTNGP05.phx.gbl...
> Right, no one has addressed your exact question.
>
> Just a guess, but, (my opinion) maybe some less experienced programmers
> just *thought* that because XP (Experience) used Admin Accounts, similar
> to a network with user/admin accounts, that they *should* write software
> that wants to be run under Admin. Lame, I know, but third-party software
> for home users isn't usually written by professional IT people.
>
> Another idea, (again, my opinion) maybe some of those "programmers" are
> self-taught out of books, without the benefit of experienced instructors,
> and just honestly didn't know any better.
>
> The thing is, those programs actually worked that way in XP, now they are
> less than convenient on Vista.
>
> KB
>
> "Jay" wrote in message news:O8aFHv5rHHA.2368@TK2MSFTNGP05.phx.gbl...
>>
>> Earlier in this thread (and what I was replying to) was the suggestion
>> that software written for XP was run with administrator privaledges and
>> now when they run under Vista this is apparent by the number of pop ups
>> seeking permission. My question was and is why would an app be written to
>> run as admin unless performing admin functions or accessing sensitive
>> parts of the OS. Not why does vista not allow someone to say "yes" and
>> have the OS remember that.
>

There is a way to turn the UAC off, but if you do that, some programs that
you download from the internet won't install because they can't get acces to
the temp folder in your user folders.

To turn off UAC:

1. Open control panel
2. Open the Users panel
3. Click the user name
4. Click "Turn User acount control on or off" (UAC) to protect your computer.

Like I said, it will stop asking your permission for everything, but you
will have to re-enable it when you install some programs (the one that gave
me the error was adobe reader 8.1) that require access to the temp folder.
5. Un check "use user acount control


"NotMe" wrote:

> Probably the same type of programs that a "limited user" can't install or
> run on XP, but an admin can.
> In the corporate environment, that may be a good thing, for home users, it
> can be a PITA.
> UAC may be a good idea for some; but I hate it & think the coders were
> incompetent that made it break other things when you turn it off!
> --
> A Professional Amateur...If anyone knew it all, none of would be here!
> CarGodZeroOne@hotmail.com
> Change Alpha to Numeric to reply
> "KristleBawl" <kristlebawl@hotmail.com> wrote in message
> news:OL4N7W7rHHA.4020@TK2MSFTNGP05.phx.gbl...
> > Right, no one has addressed your exact question.
> >
> > Just a guess, but, (my opinion) maybe some less experienced programmers
> > just *thought* that because XP (Experience) used Admin Accounts, similar
> > to a network with user/admin accounts, that they *should* write software
> > that wants to be run under Admin. Lame, I know, but third-party software
> > for home users isn't usually written by professional IT people.
> >
> > Another idea, (again, my opinion) maybe some of those "programmers" are
> > self-taught out of books, without the benefit of experienced instructors,
> > and just honestly didn't know any better.
> >
> > The thing is, those programs actually worked that way in XP, now they are
> > less than convenient on Vista.
> >
> > KB
> >
> > "Jay" wrote in message news:O8aFHv5rHHA.2368@TK2MSFTNGP05.phx.gbl...
> >>
> >> Earlier in this thread (and what I was replying to) was the suggestion
> >> that software written for XP was run with administrator privaledges and
> >> now when they run under Vista this is apparent by the number of pop ups
> >> seeking permission. My question was and is why would an app be written to
> >> run as admin unless performing admin functions or accessing sensitive
> >> parts of the OS. Not why does vista not allow someone to say "yes" and
> >> have the OS remember that.
> >
>
>
>

Hi Everyone,

Go here for details on how to disable UAC safely:

http://www.vistax64.com/tutorials/63...ems.html?ltr=P

Look at this section towards bottom:
Disable UAC For Administrators Only:

Hope this helps,
Shawn

"NotMe" <cargodZeroOne@hotmail.com> wrote in message
news:ejBQdu7rHHA.2032@TK2MSFTNGP03.phx.gbl...
> Probably the same type of programs that a "limited user" can't install or
> run on XP, but an admin can.
<snip>

Nothing worng with that IMO.
It is the running of the app with admin privs that I mean not the initial
install.
When a prog is installing and doing "stuff" behind the WI interface then I
want to know *exactly* what it is doing and I welcome the Vista pop ups.
That said, when I run this app and Vista tells me this app needs admin
rights to *run* then I will be asking Qs of the app not the OS.

Jay

PS I am not an MS apologist. UAC annoys me. Coders need to find a way (and
I'm one of them) to have an app run in the user context.

"Richard Urban" <richardurbanREMOVETHIS@hotmail.com> wrote in message
news:uqCCaR7rHHA.4180@TK2MSFTNGP04.phx.gbl...
> There is no reason why a program can not be written to run as a user. You
> do not need administrator privileges. The coders are lazy.
>
> When they write properly you will not be seeing any pop ups at all.
>
> Vista is warning you that you have old software that is not up to current
> coding standards (for the past 5 years).


Agree 100%
Regular apps DO NOT need to run as admin.
MS is doing what they have been critisised for not doing in the past... not
allowing rogue code to run with elevated permissions and thus opening up
security holes.
Damned if they do, damned if they don't.
I now recognise UAC for what it is and I welcome it.

Jay

Manatee Memories wrote:
> On Sat, 16 Jun 2007 09:49:12 +1200, "Jay" <nospam@**here.com> wrote, by
> way of <u7#8Db5rHHA.5032@TK2MSFTNGP04.phx.gbl>, in
> microsoft.public.windows.vista.general -->
>
>> "Manatee Memories" <royalfeline!REMOVE!@hotmail.com> wrote in message
>> news:re1673ha9hur8pru7tufkohmtj50l251dv@4ax.com...
> [snip]
>> You are missing the point, what reason should a program need to impersonate
>> an admin account?
> [snip]
>
> Perhaps what is being missed (or, at least, diminished) here is that,
> while many people might not object to a given app displaying a "notice
> of impending" (my words) once, they darn sure _do_ object to being
> dunned, over and over again, against being required to keep
> pounding-away so as to re-authorizing, and re-re-authorizing, and
> re-re-re-authorizing, and . . . . perhaps the point has been made
> more-clear to you, just now?
>
> Authorize once, and be _done_ with it (whatever "it" may be).

The good way to do it would be to implement "no write up, no read down
(without permission)" for executable code. That way, normal programs
could not send any information to programs running as admin, and so you
could then safely have a "never prompt again" option for UAC.

This security policy is very old and basic (the star property), and
anybody with any knowledge of computer security would implement it that
way (or better).

Microsoft is clearly capable of employing at least one security person,
which leads me to think that the UAC dialogs are a marketting tool. If
you don't notice the extra security when you're using the OS then I
don't see how it could be sold as a 'feature'.

Alas, that's how it's implemented. Maybe they'll do it properly in the
next version.
I expect the adverts for their next version to say "no annoying dialogs"!

Alun Harford

<snip>
> The good way to do it would be to implement "no write up, no read down
> (without permission)" for executable code. That way, normal programs
> could not send any information to programs running as admin, and so you
> could then safely have a "never prompt again" option for UAC.

There is a no-write-up policy. However, read-down is not prohibited.

In any case, this still would not allow a "never prompt again" option.

The UAC prompt determines if the user is actually starting an app (as
opposed to another program starting the app).

If you take the prompt away, lesser-privileged apps could start
higher-privileged ones. Just by virtue of starting a higher-privileged
app, without interacting with it, they could break out of their cage
(imagine the many command-line tools available for system administration).

While I do think it's possible to get rid of the prompt, I think the
problem is much harder than it seems at first glance

<snip>

> Alas, that's how it's implemented. Maybe they'll do it properly in the
> next version.
> I expect the adverts for their next version to say "no annoying dialogs"!
>
> Alun Harford

So do I.

--
-JB
Microsoft MVP - Windows Shell/User
Windows Vista Support FAQ - http://www.jimmah.com/vista/