Tales from the Crypto

         Alun Jones (Security MVP Reconnect) writes about security, cryptography, SSL, PKI, and pretty much anything else that bothers him enough.

January 10, 2007

Windows Vista UAC – pain point or protection?

Filed under: General Security,Windows Vista @ 12:05 pm

Symantec just wants us to make the right decisions, by taking over decision making.

So why did Windows Vista’s UAC “[bug] the heck out of me–to the point where I tuned it out and, eventually, turned it off”?

First, a quick mention of what Vista’s UAC is – it stands for “User Account Control”, and refers to a really neat security feature. When you log on as an administrator to Windows Vista, the token that you use for all your operations actually has the administrator portion disabled – denied. This means that you are effectively the same as a restricted, or normal, user. How wonderful is that from a security point of view?

If you accidentally or deliberately do something that would cause an administrative action to happen, your application is interrupted by being ‘faded out’ – the desktop goes a darker shade, and a window pops up prompting you to approve the administrative action. If you’re an administrator, all you have to do is click “Continue” (or “Cancel” if you don’t approve). If you’re a restricted user, all you have to do is enter an administrator’s user name and password.

This is a whole lot better than I used to have to do – using “Run As” from the command prompt or a right-click menu as I run the application, or in a few cases, actually logging off and back on as administrator to do the administrative action, and then logging off and back on as myself, a normal or restricted user.

So, where is this bad?

It’s bad if you execute several administrative actions in sequence – or if something does it for you – and these actions aren’t packaged up into a single executable.

So, okay, in that case I usually revert to my elevated command prompt, for sequences of actions that I initiate.

Where it comes up as a really bad thing is if you’ve got a non-elevated application that automatically carries out a number of other elevated tasks and applications on your behalf, meaning that you get bugged over and over and over for UAC prompts.

[I obviously don’t run nearly enough bad software, because I love UAC. I think it’s great, because it means I don’t have to be administrator all the time, and I’m made aware of when I’m about to be dangerous.]

So, what Symantec’s VP of consumer proctuds, Rowan Trollope, says bothers him is that he is running applications that keep calling out to other applications, all of which should be marked as elevated, or should be better integrated among themselves, or shouldn’t be doing administrative tasks in the first place.

What application does he run the most, do you think?

What do you run, that causes you insufferable UAC prompts?


  1.   Aaron — January 10, 2007 @ 10:11 pm    Reply

    Poorly written applications, that’s what causes me the most pain with UAC. I presume that we will see less UAC prompt over time as Vista becomes the Windows version of choice and application developers pick up their act.

    On my work machine I’m not really seeing too many prompts – generally during software installs. On my home machines it’s games (PunkBuster requires administrative access).

    Being in IT it’s not an issue for me, but I’ll have to see how my wife or my father reacts to UAC. That should be an interesting experiment.

  2.   Jeff Jones — January 11, 2007 @ 1:28 am    Reply


    I simply can’t imagine Rowan’s scenario. I too LOVE UAC.

    I’m gonna blog on this, with props to you.


  3.   HiltonT — January 11, 2007 @ 7:42 pm    Reply

    Frustrating as UAC can be during the installation of software on a newly installed Vista box, I can understand why Microsoft implemented it – the innate inability for Microsoft and their 3rd party developers to create software that will run with limited rights.

    If Symantec software is so poorly written that it prompts for rights elevation on every keystroke (loosely paraphrades), then maybe Symantec should get a clue! I’m a well known proponent of good coding practices and this simply excludes every piece of Symantec code that they manage to get their hands into – the first release after they borg some poor security company is generally not too bad, but after that, the good ol’ Symantec Shitas Touch takes full effect, and the software turns to sh… well, you know!

    Do I care that Symantec can’t get their own code running with UAC? Not in the slightest – we refuse to support any of their poorly written rubbish on any of our lcient sites.

  4.   alunj — January 11, 2007 @ 8:28 pm    Reply

    Hilton, please tell me you don’t author a spelling correction program.

RSS feed for comments on this post. TrackBack URI

Leave a comment

© 2017 Tales from the Crypto   Provided by WPMU DEV -The WordPress Experts   Hosted by Microsoft MVPs