Forgot your password?
typodupeerror

A Fresh Look at Vista's User Account Control 332

Posted by Zonk
from the let-me-in dept.
Art Grimm writes to mention a post at Ed Bott's Microsoft Report on ZDNet. There, he talks about Vista's User Account Control, and the issues he sees with the setup as it exists now. From the article: "The UAC prompts I depicted in the first post are those that appear when you install a program, when you run a program that requires access to sensitive locations, or when you configure a Windows setting that affects all users. But as many beta testers have discovered, UAC prompts can also show up when you perform seemingly innocent file operations on drives formatted using NTFS. In this post, I explain why these prompts appear and why some so-called Windows experts miss the obvious reason (and the obvious fix)."
This discussion has been archived. No new comments can be posted.

A Fresh Look at Vista's User Account Control

Comments Filter:
  • How annoying (Score:5, Informative)

    by kimvette (919543) on Thursday May 04, 2006 @03:15PM (#15265304) Homepage Journal
    Could they possibly make that "article" any more annoying? They'd have been better-served to turn it into a flash-animated slide show. I'm not going to click all the way through that thing.

    Either put it all on one or two pages (interspersed with ads if you must), or put it into a slide show if the article is written as a slide show.
    • When I first clicked on the article, I couldn't even figure out immediately where the rest of it was. It was like 90% crap, a tiny bit of text, and a tiny more link that disappeared amidst all of the crap.
    • Agreed. I stopped reading after three slides. Was the content on MAYBE 1/8th of the page? Screw ZDNet.
    • Re:How annoying (Score:5, Insightful)

      by causality (777677) on Thursday May 04, 2006 @03:39PM (#15265519)
      Sorry guys, I have karma to burn so take your moderator frustrations out on me if you must, but that moderation is bullshit (and damn do mods seem to dislike it when you point this out). Flamebait? What strong belief does it blatently attack in an attempt to start a verbal war? Try reading the FAQ [slashdot.org] you fucks. Articles like this are shit, and I am also not going to continue viewing this article because I do not wish to knowingly reward shit with ad revenue dollars -- yes, you see, there is a decision to make here involving voting with your feet and whether you wish or do not wish to reward something with real $$. Just think about the kind of traffic the Slashdot Effect generates for a site and its advertisers. Therefore, if anything, kimvette is doing me a favor, and I suspect I am not the only person who can say that. So anyway, it is likely that calling bullshit when I see it, in the only forum in which I can do so (seeing how I do not have mod points right now and there is no section here devoted to discussing this sort of thing) will cost me a few points, but oh well.

      Slashdot badly needs a way to moderate articles themselves, and "-1 Conflict of Interest" (for obvious attempts to drive traffic to sites that just happen to be ad-supported and also just happen to be owned by the person who submitted the article) and "-1 Excess Pagination" need to be two of the categories. I'm not even going to mention dupes.
      • Re:How annoying (Score:4, Insightful)

        by Captain Splendid (673276) <capsplendid.gmail@com> on Thursday May 04, 2006 @03:55PM (#15265654) Homepage Journal
        Kudos and and a hearty Hear hear!

        For the clueless editors, here's a good summation: If you're going to throw shit at us, expect some back.

      • If I had mod points to use, Id try to balance out that bullshit. Here is to hoping I get to do some meta ...
      • Re:How annoying (Score:3, Insightful)

        by bungo (50628)
        Slashdot badly needs a way to moderate articles themselves, and "-1 Conflict of Interest" [...] and "-1 Excess Pagination"

        That's a good idea, which many people have expressed before.

        In fact, we sort of have the ability to do it - tagging!

        Currently, the tags I see are :
        [+] vista, stupid, microsoft, vaporware (tagging beta)

        Now, if the article was tagged with something like "RevenueWhore", then everyone would be able to spot it and skip it.

        I know that I normally read the comments first before lookin
    • by oringo (848629) on Thursday May 04, 2006 @04:03PM (#15265736)
      You took this wrong, mate. The author is a genius and he's giving you a preview of how annoying the Vista UAC is going to be through a web simulation!
    • Re:How annoying (Score:4, Informative)

      by scumdamn (82357) on Thursday May 04, 2006 @05:53PM (#15266698)
      I'm replying to this thread because it's at the top. The article says that the reason that you get all of those messages is that the standard user token doesn't have access to the files that you're trying to change. So as soon as you get your Vista system, add your user token to the Program Files folder and stuff so you don't get those damn messages. I'm not sure what implications that has for security since you wouldn't give your user priveledges to the Windows folder where the registry is, but if you're worried about security, it sucks to be you, pretty much.
    • Quick fix for the annoying article. Change the page id in the URL to "all" as in http://blogs.zdnet.com/Bott/?page_id=all [zdnet.com]
  • by jawtheshark (198669) * <slashdotNO@SPAMjawtheshark.com> on Thursday May 04, 2006 @03:15PM (#15265305) Homepage Journal
    Franky... Nobody is "Administrator" of the machine anymore? (Administrators Group is not enough) Really? So essentially, they reduced the "Administrators" groups to "Well, you can admin, but you have to know what you do, and we'll annoy the hell out fo you".

    The whole point of Administrator is that you know what you do and you can Admin a machine securely. I know Joe Sixpack doesn't know how to, but doing this will put Admins all over the world in the place of "Limited User". In the end our Dear Joe Sixpack will just click and click until the task is done anyway. He will be frustrated and will get spyware anyway.

    What we need is the equivalent of a Car Mechanic for administration. You call your mechanic and he'll do the maintenance for a fee. Frankly, it's the only way for home users.

    Oh, and those that say that you can't run in Limited User on XP (as in the fine article is stated) are completely ignorant. I'm running Limited right now, and I have no problem. Granted, I have to set the ACLs on both directories and registry settings, but it's never been very hard. The only program I've never been able to run as non-admin is a game called "Children Of The Nile", and I still don't know how to run it as a Limited User. The user that needed it got the "Run As" option checked in the shortcut. Sure she has Admin access that way, but she's my sister and knows that she shouldn't run Admin.

    No, all problems are just the cause of the legacy of poor security in the past. Nagging dialogboxes won't help.

    • And, it's unlikely that Quickbooks will run as Limited User in Vista. See the URL in my sig (it is not my site, just conveniently appropriate for this thread)
      • Since you brought it up, why not make your sig a real hyperlink? It'll save hundreds if not thousands of people a couple of seconds.

        <a href="linkURL">linkDescription</a>

    • by khasim (1285) <brandioch.conner@gmail.com> on Thursday May 04, 2006 @03:27PM (#15265426)
      Oh, and those that say that you can't run in Limited User on XP (as in the fine article is stated) are completely ignorant.
      What the article actually said was:
      When you use Windows XP, you are almost certainly using an account that belongs to the Administrators group. (The challenges of running as a Limited user in XP are well documented.)
      What was that about "ignorant"?
      Granted, I have to set the ACLs on both directories and registry settings, but it's never been very hard.
      Go ahead and ask 100 people on the street whether they use Windows and whether they know what an ACL is and how to change it.

      Running as a Limited User is not impossible.

      It just requires spending a LOT of time and effort to LEARN how to do so ...

      and that pre-supposes that the person understands the risk of running as Administrator.

      So, someone has to already be aware of the threat ...
      Then that person has to choose to try to avoid that threat ...
      Then, then that person has to spend time becoming further educated ...
      Then, then, then that person has to spend time fixing the ACL's and such.

      Or just choose to run as Administrator and all those problems go away (and you get new problems, but all your apps run).
      • Go ahead and ask 100 people on the street whether they use Windows and whether they know what an ACL is and how to change it.
        Running as a Limited User is not impossible.
        It just requires spending a LOT of time and effort to LEARN how to do so ...
        and that pre-supposes that the person understands the risk of running as Administrator.


        Here's a wildly divergent idea ... what if Windows by default forces the person using the computer to run as a limited user? This could be accomplished by a forced username creatio
    • Two Words (Score:4, Insightful)

      by SuperKendall (25149) on Thursday May 04, 2006 @03:33PM (#15265471)
      Granted, I have to set the ACLs on both directories and registry settings, but it's never been very hard.

      Your Momma.

      As in, ask Your Momma to do that.

      You see, my mother uses a Mac and is able to install updates herself and keep things running just fine, all without knowing what an ACL is much less how to set it.

      Saying the average user needs the equivilent of a car mechanic to deal with computers is just sweeeping the issue under the rug and letting Microsoft off the hook for a half-assed solution to the problem. And also ignoring there are a hell of a lot more people that can fix thier own car problems than computer issues.
      • And it will probably be the same on Vista. The average user will only be dealing with data within their home directory, which they will have ownership of. The idea of worrying about the ACLs on removeable devices is crazy because they all use FAT or FAT32, not NTFS, and there is no reason to expect this to change any time in the future.
  • by jeblucas (560748) <jeblucas@NOsPAM.gmail.com> on Thursday May 04, 2006 @03:15PM (#15265309) Homepage Journal
    I went to the first three pages, which corresponds to about the first 19 words of this "article". He has room for about a sentence and a half and a graphic of the windows he's complaining about before you have to click (more) or Next >>. In fact, I can confidently say

    (more) [jebshouse.com]

  • by Giant Ape Skeleton (638834) on Thursday May 04, 2006 @03:15PM (#15265311) Homepage
    With more and more people using Firefox, all those popups had to go somewhere...
  • by Oldsmobile (930596) on Thursday May 04, 2006 @03:16PM (#15265316) Journal
    I wish they would work a bit on account control on WinXP, it is a total disaster. I WANT to use my computer as a limited user, but when I need to do something in Administrator, I shouldn't be bothered to switch users. Why oh why can't they just make it so that is asks for the admin password like with every other goddamned OS!?!

    Vista is nice and all that, but how about fixing XP first!!!!
    • There is no need to switch users.

      - You can right-click on any program and select "Run As", type the admin credentials.

      - For systems functions, "Run As" IE (as an admin) and change to the Control Panel in the address bar.

      - From the command prompt, you can use the "runas" command.

      • by afidel (530433) on Thursday May 04, 2006 @05:53PM (#15266695)
        You can't do this in a network environment because you can only have one set of ACL's between your machine and a server or other workstation. This is a fundamental problem with the way ACL's and GUID's work currently with SMB and the windows workstation client, does anyone know if Vista fixes this?
    • RunAs does that pretty much for you. For example: I want to run Programs->Administrtive Tools->Computer Management. I navigate to that option, hold down shift and right-click and then I select "Run as". The system asks me my Administrator password and I don't have to log off.

      This also works with Internet Explorer, which gives you pretty much access to the full file system... Including ACLs (if you run XP Pro... else you'll need to learn the cacls command on the command line)
      You can also invoke r

  • by Virtual Karma (862416) on Thursday May 04, 2006 @03:16PM (#15265318) Homepage
    I didnt quiet like the dialoge boxes because all of those are jarred on the right and bottom borders, as if someone has tore them off..... oh! wait...
  • by Anonymous Coward on Thursday May 04, 2006 @03:17PM (#15265324)
    "I explain why these prompts appear and why some so-called Windows experts miss the obvious reason (and the obvious fix)."

    Well, good thing MS targets this OS exclusively to Windows experts. What utter fools we've all been for assuming this would effect our non-expert friends and families!
  • bitter irony? (Score:4, Insightful)

    by Burlap (615181) on Thursday May 04, 2006 @03:22PM (#15265370)
    anyone else see the irony in an article talking about annoying click-throughs needing so many bloodly clicks to read?
  • Just wonderful (Score:3, Insightful)

    by Tibor the Hun (143056) on Thursday May 04, 2006 @03:22PM (#15265371)
    fucking teriffic...
    3 series of articles, half a dozen pages each, just to tell me why I have to slow down my workflow when deliting or renaming files.

  • How innovative. (Score:2, Insightful)

    by C10H14N2 (640033)

    The 70's called. They want their security model back.

    Yawn. ...and yeah, these damned one-paragraph-per-page ad-whoring blog articles suck big time.
  • The options (Score:5, Funny)

    by eclectro (227083) on Thursday May 04, 2006 @03:25PM (#15265402)
    This is the crux from the end of the article;

    "How do you work around this annoyance? You have three choices:

            * You can take ownership of the files on the external drive. That gives your account Full Control permissions at all times and prevents other users on the same computer from changing the files unless they do so as an administrator.
            * Or you can change the permissions assigned to the Users group so that members of that group have Write or Full Control permissions. That solution allows everyone with a user account on the computer to manage files without having to OK a consent dialog box."
            * Or you can play a Sony music CD with a rootkit."
    • Re:The options (Score:5, Insightful)

      by jandrese (485) <kensama@vt.edu> on Thursday May 04, 2006 @03:44PM (#15265555) Homepage Journal
      Those sounded like terrible solutions to me. Basically: manually adjust the permissions of every file you create or turn off the security stuff and pray.

      I'm hoping that these articles are hyperbole and in fact when you create your own files you are marked as the owner with read/write/execute permissions on them. Granted, administration looks like a total nightmare, but MS has been working for years to make administration as hard as possible so this is no big surprise.

      What I think the real fix should be: When you get a dialog box like this, there's a "validate me for X minutes" option that you can check to tell the machine that you're going to be administrating for some minutes and stop showering me with dialog boxes. Sort of like how most modern operating systems work.
    • Wasn't Microsoft's line for years: But UNIX permissions aren't finely grained enough?

      Simplicity is the hallmark of genius. User, Group, Other. Read, Write, Execute.
  • Summary... (Score:5, Insightful)

    by MosesJones (55544) on Thursday May 04, 2006 @03:25PM (#15265404) Homepage
    If you made your user "superuser" on a Linux box, the did a kernel upgrade and decided this was stupid so just allowed you to sudo certain commands then you'd have a devil of a time accessing all those files that you created while you were the super user.

    Or put more simply

    XP didn't have sudo so you were always admin, Vista has sudo, enabled via annoying popups rather than a config file.
    • Close, but no.

      XP didn't have sudo so you were always admin, Vista has sudo, enabled via annoying popups rather than a config file.

      It's not the config file part that is broken, it's the UI part.

      You see, first of all sudo specifies you want the permissions up front rather than asking for permission after the fact. If you try to do something using the legacy windows APIs, and you don't have permission, you shouldn't get a series of popups, the program's system call should fail, and the program should die. Prog
    • Actually, Windows has always had SUDO. A limited user can right-click the icon and select "run as." It will then prompt them for credentials. It really isn't that different from how other OS's work. You can also do it from the command-line.

      To modify Windows to operate the way other OSs do (prompt you the password at the right time) is trivial. They could just modify the user interface to prompt when you run the app. I modified the shortcuts in my "Administrative tools" folder to do this.

      Microsoft's bo
    • XP has an equivilent to sudo. Right-Click - Run As. Or, at the command prompt runas /user:domain\username CommandToRun.exe
      The problem is that everyone is used to just being a local admin on their box, so we get what we have today, malware ridden computers.
      The alternative is unacceptable to a lot of people. XP has some good security features, the problem, as always, is the interface between the chair and the keyboard.

      • The problem is that everyone is used to just being a local admin on their box,

        That, and programs that shouldn't require admin do require admin. This is partially the fault of developers but MS is also to blame for not enforcing such things or at least making them clear in the API.

        XP has some good security features, the problem, as always, is the interface between the chair and the keyboard. XP has some good security features, the problem, as always, is the interface between the chair and the keyboard.

        Seriou
  • Executive Summary: (Score:5, Insightful)

    by darkonc (47285) <stephen_samuel.bcgreen@com> on Thursday May 04, 2006 @03:25PM (#15265413) Homepage Journal
    The new Windows 'protection' scheme will browbeat the user until they disable the security system (in some way or another).
    That way, when the inevitable virus and spyware hits the system, Microsoft can wash their hands and say that it's all the user's fault for making use of their computer bearable.
    • What's worse is that there is no way to distiguish between authentic "User Account Control" dialog and a fake one that is poped up by a malicious application trying to collect admin credentials.

      Unless Vista allows customizing generic "UAC" dialog (with an image or a text) or easily authenticate it in some other way, UAC being ON appears to pose a greater risk to a system security then when it is OFF.

    • Too bad the consumers will still blame Microsoft. Why do you think IE gets blamed for identity theft when (dumb) people click on emails from "the bank" asking for their PIN?
  • by ausoleil (322752) on Thursday May 04, 2006 @03:26PM (#15265419) Homepage
    Microsoft is trying to make users have good hygiene -- that is, don't run as a super-user unless you need to. Well-meaning and well intended -- and a good idea. Ultimately, however, Aunt Sally is not going to deal with it for long, and you, the unofficial family Helpdesk tech, are not going to like all of the calls you get from apoplectic relatives dismayed that they suddenly can't open this that or the other because they do not understand the paradigm.

    What will happen is what always happens: when there is a "problem" someone "fixes" it. In this case, the "problem" is the security model. I suspect that there will be a 3rd party "fix" that blasts through all the well-meaning security and basically restores the user-as-root scenario that Windows has operated in since forever.

  • Damn, that's annoying.. having to click next a zillion times to "read" (mostly pictures) the "article".. And the remarkable revelation? You'll be getting popups because of restrictive file permissions! Well, gee, I would certainly never have figured out THAT was the reason for popups that say "you lack the required permissions"....
  • by flakier (177415) on Thursday May 04, 2006 @03:31PM (#15265451) Homepage
    So, in the end he recomends giving Users full control or write access as means to get around the annoyance. Hell, why dont we just chmod -R 777 /* and end all the "annoyances" of my Linux box too while we're at it?

    Can't he just suggest that application designers get a clue and write apps that don't write uneccesarily to sensitive areas of the system? Hopefully annoyed end users will "motivate" lax companies when this happens instead of working around the issue.
    • Maybe he doesn't bother because he know what I've been preaching:

      Windows developers are always willing to trade end-user security for fewer support calls.

      Meanwhile, as an admin, I have to try to make these crapola, "we still live in a Windows 95 world" applications work with limited user accounts.

      Heck, I've heard IE not working right if your not admin. (I would know directly myself, I use FF under Limited User)
  • I'm glad windows is finally gonna know how to say "I need credentials, please provide an administrator password" when you want to do something that requires said permissions.

    OSX's been doing this for 6+ years. It's annoying to always be hit with a "permission denied" error when trying to do things as a limited user, then realizing that I've gotta log out and back in as an admin.

    all I can say is FINALLY.
  • Flamebait (Score:5, Insightful)

    by ewhac (5844) on Thursday May 04, 2006 @03:37PM (#15265501) Homepage Journal
    So how is it that running as a "limited user" under Windows is an arcane, difficult process, whereas doing so under UNIX is nearly trivial?

    I'm not saying UNIX is "better," since the primary issue here is social, not technical. If UNIX were in Windows' shoes, then third-party applications and slickly packaged malware would be popping up dialogs reading, "This application requires root priviliges to install. Please enter the root password: _____" So UNIX's user model doesn't really solve the base problem. However, I've been using Windows (mostly for gaming) for a while now, and I run with administrative privs all the time, because running as a limited user (in the UNIX sense) just doesn't work. Or, perhaps more precisely, it doesn't Just Work.

    So what's the deal?

    Schwab

    • The reason that "limited user" operation works on Unix is that most software is ported.

      To AIX, Solaris, HP/UX, IRIX, Linux.

      It isn't limited to a single user environment (the bigger boxes support many users).

      Administrators would have fits if the software required access to priviledged directories and resources, beyond what is vital. That includes NOT writing into your own program directory.

      Linux can then leverage from this. The rule is: /usr and /opt should be mountable READ ONLY. /bin and /sbin should also
    • DOS and Windows 9x did not have multiple user support because they were simply badly designed, ignoring Unix design concepts. As a result, developers got used to assuming the user had administrator access because that was the only kind. (Doing things like storing data in c:\program files\program name\data instead of %appdata%, not having a concept of per-user settings, making installations outside of the program files directory (ex. single user install) difficult, etc.) On the other hand, the Windows NT lin
  • Games -vs- firewalls (Score:3, Interesting)

    by MobyDisk (75490) on Thursday May 04, 2006 @03:41PM (#15265536) Homepage
    I'm curious how this handles applications that constantly modify system settings inappropriately. Does it prompt you every time, or just once? Does it remember the setting? Ex: Most games still save their save files into C:\Program Files. When I save my game, am I booted from my DirectX environment back to the desktop to answer the prompt? If so, does it happen every time I save? Or can it work like a firewall and say "let me do this every time."
  • Oh No... (Score:2, Funny)

    by googleaseerch (682399)
    The UAC's involved in this now, too? All hell's gonna break loose.
  • Here are the simple solutions all the windows experts are missing:

    Set yourself up as the owner of all files on the drive.
    Set full permissions to all files to the "user" group.

    Oh gosh gee. I don't know how we could have been so stupid. Please forgive us for doubting the security, power, and flexibility of Microsoft operating systems.

    Dear Microsoft "experts": You just permanently lost the user privilege security argument, and you probably don't even know why.
  • easy to fix (Score:2, Funny)

    by rcamans (252182)
    I got this from somewhere:

            Start an elevated command prompt window, and from that window run secpol.msc.

            Find all the policies that start with "User Account Control" (there are only, like, six of them) and set them to either no prompt or disabled.
    That's all there is to it. You'll never need to "run elevated" and you'll never be bothered by those pop-ups again

    Thank you, whoever posted this fix.

  • uh.. (Score:2, Interesting)

    by DoctorDyna (828525)
    But, if you disable the run elevated functions, wont the popup be replaced with a dialog that says "This program needs administrator priveleges to run. Unfortunatly, you disallowed elevating you, dumbass. please log on using an account capable of running this."
  • by fortinbras47 (457756) on Thursday May 04, 2006 @04:07PM (#15265786)
    Windows is continuing its transition to the Unix user/security model, but your average user (and many IT people) neither understand the user/admin distinction nor permissions.

    As I understand the article, EVERYONE in Vista is a normal user. Administrators have the ability though to take administrator actions on a case by case basis after supplying credentials.

    To me, this sounds exactly like "sudo" under unix/linux or the "Authenticate: blahblah requires that you type your password" under Mac OS X. This model is more secure and works great, but there are some legacy transition issues.

    For you unix people, the problem the article describes is, "what if you mount an old drive, the drive has restrictive permissions, and the file owner UIDs don't match the new system?" (your user account doesn't have permission to do anything on the drive)

    NTFS has file permissions, but they rarely came up in practice because everyone in Windows was doing everything as the Unix equivalent of root. In Unix, the obvious fix is to do a sudo chown -R newuser /mnt/olddrive (or an ultraghetto sudo chmod -R o+rwx /mnt/olddrive) . The user/permission concept is totally foreign to your average windows user though, and hence the problem.

    • NTFS has file permissions, but they rarely came up in practice because everyone in Windows was doing everything as the Unix equivalent of root. In Unix, the obvious fix is to do a sudo chown -R newuser /mnt/olddrive (or an ultraghetto sudo chmod -R o+rwx /mnt/olddrive) . The user/permission concept is totally foreign to your average windows user though, and hence the problem.

      Foreign is the right word, but the problem is more extensive and pervasive than familiarity or experience. First there is that mess
  • lol.. (Score:3, Insightful)

    by DoctorDyna (828525) on Thursday May 04, 2006 @04:09PM (#15265807)
    Windows experts explain how to disable security features, how quaint. Honestly, the whole time i was using Vista it never occured to me to turn this "feature" off.

    Anybody who needs instructions on how to disable something using gpedit has no business running a beta operating system that was intended for a serious testing audience.

    Come to think of it, having a meaningful conversation about an un-finished product is also quite silly. Ok, so in the light of this, I offer this comparison / excersize.

    Test 1.) In Windows Vista, make a shortcut to a program you know needs admin to run. Time this part Click the icon, then click the resulting dialog as quickly as you normally would to grant it permission.

    Test 2.) In Linux (for argument, lets say Ubuntu) pop open a term. Think in your head the name of an app or process / shell script that needs root or super user to run. Time this part type sudo then the name of the program or command.

    Did clicking the box take longer than typing SUDO? meh. what a shame were wasting so much of slashdot's disk space on a coversation over a few milliseconds.

  • Obvious choices (Score:5, Insightful)

    by Smorkin' Labbit (930740) on Thursday May 04, 2006 @04:21PM (#15265939)
    I like the options "Continue" / "Skip" / "Cancel". Very obvious for a normal user what the difference between Skip & Cancel is ;-)
  • Terrifying (Score:3, Funny)

    by bcmm (768152) on Thursday May 04, 2006 @04:28PM (#15265999)
    I really cannot think of a scarier idea than Microsoft working with the Union Aerospace Corporation [wikipedia.org].

Truth is free, but information costs.

Working...