6 User Account Control Windows Vista Policies
This weeks BLOG will examine the 6 User Account Control (UAC) security policies that will be exposed in Windows Vista Beta2. For each policy a brief summary of the configuration options and expected defaults for the home and enterprise desktops are provided.
User type Taxonomy:
1) Standard User: member of the “users” group
2) Consent Admin: member of the “local administrators” group, who logs on with a “filtered” standard user but has the potential to elevate privilege to administrator.
-- Note: There are 14 different types of “Consent Admins” ranging from local administrator to restore operator.
The following is a screen shot of the Windows Vista Beta 2 UAC policies which are located in the Local Security Settings Microsoft Management Console (secpol.msc):
1) User Account Control: Behavior of the elevation prompt for administrators
2) User Account Control: Behavior of the elevation prompt for standard users
3) User Account Control: Elevate on application installs
4) User Account Control: Run all users, including administrators, as standard users
5) User Account Control: Validate signatures of executables that require elevation
6) User Account Control: Virtualize file and registry write failures to per-user locations
1) User Account Control: Behavior of the elevation prompt for administrators
Configuration options:
![]()
Prompt for consent: Default (home and enterprise): An operation that requires elevation of privilege will prompt the Consent Admin to select either “Permit” or “Deny”. If the Consent admin selects Permit the operation will continue with their highest available privilege. “Prompt for consent” removes the inconvenience of requiring that users enter their name and password to perform a privilege task.
Prompt for credentials: An operation that requires elevation of privilege will prompt the Consent Admin to enter their user name and password. If the user enters valid credentials the operation will continue with the applicable privilege.
No Prompt: This option allows the Consent Admin to perform an operation that requires elevation without consent or credentials. Note: this scenario should only be used in the most constrained environments -we will be blogging on this in the future.
2) User Account Control: Behavior of the elevation prompt for standard user
Configuration options:
Prompt for credentials: Default (home): An operation that requires elevation of privilege will prompt the user to enter an administrative user name and password. If the user enters valid credentials the operation will continue with the applicable privilege.
No Prompt (Default for enterprise): This option results in an “access denied” error message being returned to the standard user when they try to perform an operation that requires elevation of privilege. Most enterprises running desktops as standard user will configure the “No prompt” policy to reduce help desk calls.
3) User Account Control: Elevate on application installs
Configuration options:
Enabled: Default (home): Application installation packages that require an elevation of privilege to install will be heuristically detected and trigger the configured elevation prompt UX.
Disabled: (Default for enterprise): Enterprises running standard users desktops that leverage delegated installation technologies like Group Policy Software Install (GPSI) or SMS will disable this feature. In this case, installer detection is unnecessary and thus not required.
4) User Account Control: Run all users, including administrators, as standard users
Configuration options:
Enabled: Default (home and enterprise): This policy enables the “Consent Admin” user type while also enabling all other UAC policies. Changing this setting requires a system reboot.
Disabled: Disabling this policy disables the “Consent Admin” user type. Note: The security center will also notify that the overall security of the operating system has been reduced and gives the user the ability to self enable.
5) User Account Control: Validate signatures of executables that require elevation
Configuration options:
Disabled: Default (home and enterprise): This policy is disabled by default. Note: we will be blogging on this in the future.
Enabled: This policy will enforce PKI signature checks on any interactive application that requests elevation of privilege. Enterprise administrators can control the admin application allowed list thru the population of certificates in the local computers Trusted Publisher Store.
6) User Account Control: Virtualize file and registry write failures to per-user locations
Configuration options:
Enabled: Default (home and enterprise): This policy enables the redirection of legacy application write failures to defined locations in both the registry and file system. This feature mitigates those applications that historically ran as administrator and wrote runtime application data back to either %ProgramFiles%, %Windir%; %Windir%\system32 or HKLM\Software\....
Disabled: Virtualization facilitates the running of pre-Vista (legacy) applications that historically failed to run as Standard User. An administrator running only Windows Vista compliant applications may choose to disable this feature as it is unnecessary.
Comments
Anonymous
January 29, 2006
Note: LUA (Least User Access) has been
renamed UAC (User Access Control) which is a much better name...Anonymous
February 06, 2006
This capability should go a long way towards improving Windows security!Anonymous
February 15, 2006
This is really good idea and i hope they devolop this in vista server as everyone could be a standard user and it could potientaly stop iruses from corropting system files and crashing systemsAnonymous
March 02, 2006
I know you said you would be blogging on this in the future... but for option 5; I thought the idea was to ensure that permission was granted each time before anything automatically executes with admin priviledges. Why would you not want to enable this by default on either the Home or Enterprise?Anonymous
March 03, 2006
I want to touch on two comments here:
UAC actually stands for User Account Control. :-)
Setting 5 deals with the identification of signed binaries. There is different behavior for signed and unsigned executables. We'll be posting a more thorough post for this soon!
-JennAnonymous
March 08, 2006
vistaAnonymous
March 30, 2006
The comment has been removedAnonymous
May 03, 2006
Imagine stopping at a gas station to fuel up your car, selecting Standard grade unleaded gasoline, and...Anonymous
May 04, 2006
Interesting approach at security but how many home users do you really think are going to make use of this? For that matter how many home users are actually going to come here or look up how to implement this properly? My guess is the avg. home user which this OS is being marketed to is going to get frustrated, disable it all and go back to the standard windows security model, i.e.: NONE. I just see this as too little too late for home users although corporate admins and users may find this appealing they won't be migrating to Vista anytime soon.Anonymous
May 05, 2006
The comment has been removedAnonymous
May 17, 2006
another reason to try linuxAnonymous
May 18, 2006
There has been a raging debate inside and outside of Microsoft about the new security feature in Windows...Anonymous
May 22, 2006
I am currently playing with Vista and most of normal way of things have changed, some good others, too cumbersome to find. For example, it is not easy to switch the logon page. 2. How can i turn off the welcome page
3.with xp if you have local admin rights, right clicking the start button gives you option to open all users. I understand this is Beta but some things need to be easy to navigateAnonymous
May 25, 2006
The comment has been removedAnonymous
May 25, 2006
The comment has been removedAnonymous
June 23, 2006
i think the UAC is a good feature but missing one important facet. as a developer i regularly have to drop dll's and such into the system path and after some testing delete them or remove them or hey even edit some types and thier is no way to do that. do i have to reinstall windows to delete an inf or dll or ocx that i had to experiment with?
No a common user should not have this ability.
YES a developer or true admin level should.
YES this means that the ability to do this should be in place for every owner of a machine. warn them that its dangerous and not supported. warn them with all the popups you need to. make it so that that level access is not installed without going to add/remove and adding the feature or just a user account type not used unless user specifically goes there.
i cannot express how important that is.Anonymous
June 26, 2006
The comment has been removedAnonymous
July 07, 2006
I guess I'm a little late coming to this particular party - but I just found out about UAC.
How to console based applications work with UAC? Does the GUI prompt appear for them too when they are launched?Anonymous
August 05, 2006
The comment has been removedAnonymous
September 03, 2006
User account control is awful. It's horribly annoying. I'm turning it off.Anonymous
September 08, 2006
I think this may be missing the main practical corporate requirement.
Many standard users have requirements for particular admin tasks where they Always need the permission to do the work - ie. changing the system clock.. or performing an ipconfig /release..
This is what I would like as an admin to grant them to be able to do without them having to hassle me each time..Anonymous
September 24, 2006
The comment has been removedAnonymous
October 10, 2006
I'd like to see a per-application setting that allows the user to select the desired elevation level, similar to the opt-in settings for IE browser hosts. I really would like to launch Visual Studio with a double-click, like I used to do, rather than right-click and "Run as administrator." (Without full access rights, VS can't self-register DLLs that it compiles.) I don't care if there isn't a pretty UI for this feature. In fact, I would rather have it hidden in the bowels of the Security Policy Manager. But, the fact that some of the applications that I use every day will always require extra privileges, means that I will always need to remember to launch them from a right-click...and click again to respond to UAC. Windows Vista--building new habits of interaction.Anonymous
October 10, 2006
The comment has been removedAnonymous
October 31, 2006
The comment has been removedAnonymous
November 27, 2006
I agree, UAC is &^%#^%#(@^%(@%^@. One should be able to this of with just one setting somewhere. It's not up to MS to decide what I do on my system. I wonder how common user are going to experience this, al this extra clicking around, I wonder if this will generate more RSI .......................... Microsoft, please solve this issue, at least for system admins. BertAnonymous
November 27, 2006
I agree, UAC is &^%#^%#(@^%(@%^@. One should be able to this of with just one setting somewhere. It's not up to MS to decide what I do on my system. I wonder how common user are going to experience this, al this extra clicking around, I wonder if this will generate more RSI .......................... Microsoft, please solve this issue, at least for system admins. BertAnonymous
December 04, 2006
PingBack from http://itsvista.com/2006/12/learn-how-to-disable-vistas-uac-and-why-you-shouldnt/Anonymous
January 01, 2007
How can I off in Vista all administrative polices for Running program and work with program as Administrator.Anonymous
January 11, 2007
Please tell me why i am not able to create folder inside program files using "mkdir" command in command prompt which i was able to do earlier with XP , 2000 ... I am facing real Problems even if i have logged in as administrator its saying access denied ... So all my applications are going for a toss now ..... Will it be changed in near future???Anonymous
January 19, 2007
The sad thing is that there is a perfectly good model for doing this on other operating systems already. In reinventing UAC Microsoft decided to go with the "Lets annoy the user until they turn the feature off" design. Why not do what everyone else does. Ask the user to Authenticate (password required) and then allow all activity for the next X (usually 5) minutes to work at Admin level. This avoids 90% of the problems that users encounter. See how much easier that is? Is there a requirement at MS to only implement solutions that treat the users as idiots?Anonymous
February 12, 2007
every time I want to download and install something a window pops up asking for the administrator password. My sister won't give me the password so each time I have to bother her to type it in. It's annoying and I'd like to know how to turn it off.Anonymous
February 14, 2007
I'm a setup developer, so this is a pain in my neck professionally, but it isn't much better personally. After having used Vista for a just an hour or so, I was already completely fed up with the UAC features. There are entirely too many prompts! Just to create a text file on C: (a logfile, I believe) and then delete it a moment later, I had to clear four warning dialogs. If I know myself, it won't take long before I stop seeing or reading those dialogs, click "Allow" to everything, and sooner or later defeat the whole purpose of this exercise in security. Shannon: The root of the C: drive has never been a good place to write files. A lot of apps fail to work correctly as standard user because the developer thought it was always safe to write files there. Try creating the log file in the current user's Documents or Temp folders instead. HTH -- Aaron MargosisAnonymous
February 24, 2007
The comment has been removedAnonymous
February 24, 2007
John: Try running secpol.msc. HTH -- Aaron MargosisAnonymous
February 25, 2007
Aaron, Thanks for the reply. After looking into it further I found out that secpol.msc is not availiable on the home editions of vista. I am able to turn UAC on and off though. I have read mixed reviews on turning it off altogether though. I am pretty computer savy but far from an expert. UAC is quite annoying especially when you get a warning every time you try to copy files. Am I missing somthing about UAC? or is it really necessary.Anonymous
February 25, 2007
The comment has been removedAnonymous
February 28, 2007
PingBack from http://www.ghacks.net/2007/02/28/vista/