Permissios

Apparently a ton of s are having "issues" with permissions, and I too, have
grown weary already of trying to get things to work properly. I cannot change
my OWN permissions, and I on't have write access, and it denies me the right
to change permissions. A lot of my online related programs won't work due to
failure to open or write to the files. mIrc being a good example......
Lets go ms, we have a issue here.....................

cj wrote:
> Apparently a ton of s are having "issues" with permissions, and I too, have
> grown weary already of trying to get things to work properly. I cannot change
> my OWN permissions, and I on't have write access, and it denies me the right
> to change permissions. A lot of my online related programs won't work due to
> failure to open or write to the files. mIrc being a good example......
> Lets go ms, we have a issue here.....................

UAC is a bit clunky (I believe there are plans to improve that though)
but an IRC application that requires admin privileges is just plain
broken. That is *not* a problem with vista.. in fact it's one of the
things that is good about it, because it'll force people to think about
security when they write code.

Complain to mIrc authors not Microsoft.

Tony

"Tony Hoyle" wrote:

> cj wrote:
> > Apparently a ton of s are having "issues" with permissions, and I too, have
> > grown weary already of trying to get things to work properly. I cannot change
> > my OWN permissions, and I on't have write access, and it denies me the right
> > to change permissions. A lot of my online related programs won't work due to
> > failure to open or write to the files. mIrc being a good example......
> > Lets go ms, we have a issue here.....................
>
> UAC is a bit clunky (I believe there are plans to improve that though)
> but an IRC application that requires admin privileges is just plain
> broken. That is *not* a problem with vista.. in fact it's one of the
> things that is good about it, because it'll force people to think about
> security when they write code.
>
> Complain to mIrc authors not Microsoft.
>
> Tony
>
>
>

Tony,
Thanks for the response, however, that was mearly and example, with the
real issue being, why can't I change my own permissions, and why don't I have
full access to everything ?

Hello,

It is helpful to remember that in Windows Vista, even though you are running
as an administrator account, every program you run is running under a
*standard user* account, and does not have administrator-level permission.
The only way a program can get administrator-level permission is if the
application automatically prompts you for permission, or if you explicitly
give that application permission.

So ... what are the actual ramifications of this when dealing with the
filesystem? Let's take a look at the default access permissions for most
folders in windows:

- A user has read access to just about everything
- A user generally cannot write to anything outside of his profile directory
- Any user can create a folder almost anywhere in the filesystem
- The owner of a folder has full control over it and its contents
- Administrators have almost full control over just about everything

So... this means, that even though you are an running in an admin account,
all your explorer windows and programs you run (having normal user
credentials) will be able to read almost any file, but will not be able to
write anything unless it is in your profile directory, or a directory that
you created or took ownership of.

So, here's the major problem:

- Folders and files from a different windows installation probably won't
allow you to write to them, even if they're YOUR files you created from a
different version of windows.

- You will need to modify their permissions to give either Everyone full
access or your user account in Vista full access. Taking ownership of them
is NOT RECOMMENDED as you may have trouble accessing them from the other
windows installation.

- Managing your files and folders are going to be a real pain ... which
brings me to

HOW DO I MANAGE MY FILES AND FOLDERS if explorer run as a standard user ?!?!

Here's how:

- Click Start
- Type: explorer.exe
- When it shows up under Applications, right-click it and click Run As
Administrator

You now have an "administrator" explorer, kind of like a root shell in that
other operating system, that will allow you to change permissions and access
files as admin, just like in the good 'ol days.

Hope this helps!

- JB

Not that it's any help but I have zero problems with Mirc.

"cj" <cj@discussions.microsoft.com> wrote in message
news:65DC7978-DBB1-439D-9C5C-49F37FF20652@microsoft.com...
> Apparently a ton of s are having "issues" with permissions, and I too,
> have
> grown weary already of trying to get things to work properly. I cannot
> change
> my OWN permissions, and I on't have write access, and it denies me the
> right
> to change permissions. A lot of my online related programs won't work due
> to
> failure to open or write to the files. mIrc being a good example......
> Lets go ms, we have a issue here.....................

Wouldn't turning off the UAC be easier to do? That will do away with just
about all annoyances for now.


"Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message
news:550B454D-4103-499D-940A-09739B00279D@microsoft.com...
> Hello,
>
> It is helpful to remember that in Windows Vista, even though you are
> running as an administrator account, every program you run is running
> under a *standard user* account, and does not have administrator-level
> permission. The only way a program can get administrator-level permission
> is if the application automatically prompts you for permission, or if you
> explicitly give that application permission.
>
> So ... what are the actual ramifications of this when dealing with the
> filesystem? Let's take a look at the default access permissions for most
> folders in windows:
>
> - A user has read access to just about everything
> - A user generally cannot write to anything outside of his profile
> directory
> - Any user can create a folder almost anywhere in the filesystem
> - The owner of a folder has full control over it and its contents
> - Administrators have almost full control over just about everything
>
> So... this means, that even though you are an running in an admin account,
> all your explorer windows and programs you run (having normal user
> credentials) will be able to read almost any file, but will not be able to
> write anything unless it is in your profile directory, or a directory that
> you created or took ownership of.
>
> So, here's the major problem:
>
> - Folders and files from a different windows installation probably won't
> allow you to write to them, even if they're YOUR files you created from a
> different version of windows.
>
> - You will need to modify their permissions to give either Everyone full
> access or your user account in Vista full access. Taking ownership of them
> is NOT RECOMMENDED as you may have trouble accessing them from the other
> windows installation.
>
> - Managing your files and folders are going to be a real pain ... which
> brings me to
>
> HOW DO I MANAGE MY FILES AND FOLDERS if explorer run as a standard user
> ?!?!
>
> Here's how:
>
> - Click Start
> - Type: explorer.exe
> - When it shows up under Applications, right-click it and click Run As
> Administrator
>
> You now have an "administrator" explorer, kind of like a root shell in
> that other operating system, that will allow you to change permissions and
> access files as admin, just like in the good 'ol days.
>
> Hope this helps!
>
> - JB

You are correct, this would work.

However, I think it's important that people understand why they are having
problems before they go about disabling things

- JB

Yes but at the same time MS should understand that if I am a user with Admin
rights then I should have 'admin rights' and not a restricted set of rights.
If we want to restrict users we set them up as standard users..we set up
admin users precisely because we want them to be able to do anything..so the
next logical step for almost everyone in here is to turn off UAC - kinda
defeats whatever anal purpose MS thoguht they were giving the world..You just
didn't think about it enough and used Security brainstroming as it's
rationale for this ..sometimes you need a bit of common sense....

"Jimmy Brush" wrote:

> You are correct, this would work.
>
> However, I think it's important that people understand why they are having
> problems before they go about disabling things
>
> - JB
>
>

UAC must be meant for people unfamiliar with using a computer. For me it was
a real pain untill I got to the section which told me what it did and how to
disable it. It did take me two days. UAC makes using ones computer very
frustrating.
LA
"Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message
news:eqtNgUamGHA.1596@TK2MSFTNGP04.phx.gbl...
> You are correct, this would work.
>
> However, I think it's important that people understand why they are having
> problems before they go about disabling things
>
> - JB

Gordon wrote:
> Yes but at the same time MS should understand that if I am a user with Admin
> rights then I should have 'admin rights' and not a restricted set of rights.

The problem is users *don't* have common sense and programmers are lazy.

XP SP2 supports the model you suggest.. and we still have everyone
running as admin all the time and lots of software not working as an
ordninary user becauase it tries to do things like write temp files into
random areas of the disk.

Initially I hated UAC, but then I've come to realize that it's the only
way - the only way to get people to work securely is going to be to
force them.

I'd go further TBH.. have the admin users have no interactive login
rights by default so UAC is the only way to do an admin task.. and I'd
remove 'run as administrator' too - apps that need admin rights should
be marked as such and preferably signed.

MS didn't decide to go that far but the halfway will make a huge
difference over the next couple of years while software producers
finally fix the security problems that they've ignored.

One thing I *do* hate is the virtualisation hack... it makes things look
like they work when they don't really, and just makes it harder to find
issues.

Tony