Vista Account Protection Being 'Refined'

By Nate Mook | Published June 12, 2006, 3:17 PM

One of the most important features shipping in Windows Vista has also become the most contentious: User Account Control. While businesses and users alike have asked for improved security, the feature's barrage of pop-up windows has left those running beta builds simply annoyed.

In response, Microsoft says changes are on the way.

User Account Control, or UAC, is designed to limit the damage malicious software can do to a machine by requiring that all users run in standard user mode and restricting administrator privileges to authorized processes. If a user wishes to install new software or change systems settings, they will need to enter credentials and verify the process.

But the result has been less than smooth in Windows Vista builds released thus far. Users have encountered a seemingly endless stream of verification prompts when performing tasks as simple as deleting a shortcut. Vista Beta 2 also added a "Secure Desktop" mode which prevents any system interaction until the UAC prompt has been answered, adding to customer frustration.

Speaking with BetaNews at TechEd 2006 in Boston, Microsoft senior product manager for Windows Vista security Russell Humphries promised UAC would be "refined" in future builds. Beta 2 made a number of changes to reduce the number of end-user prompts, he said, and an upcoming CTP build will simplify things further.

Microsoft will not, however, utilize a "sticky" verification process. Apple's Mac OS X operating system only asks users to enter their password once and it is remembered for the rest of the time they are logged on. Humphries said this could open the door to security attacks, even if the possibility is minimal.

Secure Desktop is also here to stay, explained Humphries. Microsoft has established a "penetration testing" team to expose potential vulnerabilities in Windows Vista, and it was discovered that malicious software could be used to modify UAC prompts in extreme cases. Secure Desktop was implemented to resolve this issue.

Nonetheless, Microsoft promises it will address the feedback it has received as it prepares Windows Vista Release Candidate 1, and intends to make refinements as needed. "Security is a process," Humphries said, "not just a feature."

One change is already on the docket: deleting shared desktop shortcuts will not require UAC verification.

Comments

View comments by with a score of at least

I installed Vista Beta2 earlier this week. At first I thought it was going to be ok. Once I got online, it downloaded almost all needed drivers, a great improvement. Even though I can't get the "glass" interface, I liked the way it looked, generally. I had problems finding the right driver for my ATI Mobile 9000 AGP graphics chip, but once I did (had to uncheck box so I could search all available drivers and then found that MS had a driver on disk for the mobile 9000) it worked great. But Vista did not correctly identify the graphics chip on its own and installed a standard VGA driver.

However, the security "features" are so poorly implemented that they will drive everyone crazy, and they are the reason I no longer have Vista on my computer, and probably won't bother until there is no choice! Some kind of a bug prevented almost all my data files from opening at all in any application unless I turned off User Account Control. I had installed Vista to my empty (just formatted) C: drive but left my data on a separate partition where I had it in WinXP. I was running as an administrator, yet kept getting messages that I didn't have permission to open the files (in Word), or the applications just wouldn't open other types of files, such as my pictures, etc. It was a nightmare, with me giving broader and broader permissions to folders and still not being able to do anything. Even with UAC turned off, I couldn't copy many of the files to another partition, couldn't delete the files, couldn't change the file permissions, etc. Also, MS makes it very easy to turn UAC on, but hides where to turn it off many layers deep.

If MS doesn't find a way to correct the problems with the enhanced security, all the big computer makers better be prepared to quadruple their tech support once they start selling Vista computers! I'm a fairly experienced computer user and still found it impossible. Since other users on the MS Beta newsgroup site reported the same problems, I think that there is a pretty serious bug that needs to be solved, in addition to MS making UAC stop asking for permission to do things that are not security risks (like relocating a file, deleting a shortcut, etc.)

Score: 0

|

"refined"? great. i installed b2 on my laptop and within 10 minutes i was already sick of that crap. luckily its not that difficult to disable, you just have to reboot, which is also a slight annoyance. overall i like vista, i'm looking forward to continuing testing of it and of course, the final product. i think i'll definitely spring for Ultimate when it comes out.

Score: 0

|

they will just make a virii u dont have permission to delete lol

Score: 0

|

I will love this. I look forward to calls like, "I'm trying to install web shots/comet cursor/weather bug but it won't let me." Me: "sorry ma'am, that's not allowed."

Instead of today where I get, "My computer is really slow..." Me: "How much spyware and crap is installed on your machine?" Them: "What's that?"

I could give a rats a** how annoying it is to the end user. This is finally a step in the right direction for MS.

BOFHs rejoice! Win9x fan bois go to hell!

Score: 0

|

It IS a great step but it really does need refinement. I've tried Vista and it's just damn annoying the amount of popups you have to click through to do anything. The Unix way is much smoother where root control is only an su command away, but Vista just bombards you with popups. Even when your logged in as an admin you get bombarded. However, I'll take that over what Windows has right now which is essentially useless.

Score: 0

|

Agreed 100%, this will make sys admins lives easier!

Score: 0

|

One, maybe two prompts and i would be OK with that. As a SYS admin i deal with security everyday. It's a wonderfull plus for IT admin's in certain areas. But as for home use, i have found it really, really annoying too go through 3-5 prompts before installing something. So for computer "GEEKS" i could see where we find it annoying. As for JOE BLOW they really have no clue, and it will eventually annoy the piss out of them. Eventually they will want too go back too their old O/S and consider VISTA crap becuase they can't figure it out. And they have not the first clue on how too disable it, or where too go to find out how too disable it. SO IE bring on the support team, becuase the flood will soon come in, if not relaxed. Now on another note, I'm not a MAC junky, but i do own a few. And i would go as far as too say i would prefer it as a desktop. Only if i could transition alot quicker than what it would take me now = \

Score: 0

|

"Apple's Mac OS X operating system only asks users to enter their password once and it is remembered for the rest of the time they are logged on."

Umm, no it doesn't. Try opening some "click the lock to make changes" preference panel such as User Accounts. Quit System Preferences. Open it again, and you'll see you need to re-enter credentials.

Score: 0

|

Exactly. The sticky part of it is that it does remember your (sudo) password for 5 minutes if you don't click the lock. Which is very convenient standard Unix behaviour, but probably to simple to graps for MS developers.

Score: 0

|

"Microsoft will not, however, utilize a "sticky" verification process. Apple's Mac OS X operating system only asks users to enter their password once and it is remembered for the rest of the time they are logged on. Humphries said this could open the door to security attacks, even if the possibility is minimal."

Open to attacks because Vista is less secure?

Score: 0

|

As a user of OS X (and XP), when I install a program I am asked for my password before the actual installation begins. When I install another program I have to provide my password again before it can be installed. I don't know where Humphries got this information from but I think he is incorrect.

He maybe referring to something else like accessing System Preferences under a limited account. When you try to change certain settings you are asked for an Administrator password to make the changes, but you have to do that for each setting. It doesn't unlock everything after entering the password once. Under an Administrator account you don't have to enter a password each time you change a setting unless you lock it yourself.

What do you think?

Score: 0

|

The UAC is super annoying, but you can turn it off.

Score: 0

|

IE Keeps giving me a message that it stops responding!! Firefox works fine!

Score: 0

|

Windows Vista Release Candidate 1 = Windows Vista Really Beta This Time 1

Score: 0

|

Oh my God!!!!! So freaking funny!!!!!! Hahahahahahhahahaah.
Go back to Linux, stupid!

Score: 0

|

Actually, the guy is pretty accurate. And all you can do is choose to insult?

I think it's ridiculous that Microsoft are changing major features and parts of the OS at this stage of the process. This stage is meant for refining, bug fixing and performace issues. Not changing major features. I agree with the poster saying the next version will be the Beta because the current Beta, just isn't a beta.

Score: 0

|

That was my intended point. Vista beta 2 is nowhere near RC ready, I had loads of issues with it on a 6 month old PC, and I'm not going to bother to try vista again until SP1... I saw all I need to see: Microsoft is going to cut corners to get this out the door in ~6 months (for corporate lapdogs)

Score: 0

|

Have you tried Beta 2 yet? I think it's very stable already - at least for me. I can do software development, play warcraft, watch movies (ok, this one is not 100% smooth) without encountering any significant issue.

Most of my Vista issues are with third party device drivers, not with Vista itself. There are not many good drivers available for Vista as of now.

And refining UAC isn't really a major feature change at all. I lost you there.

Score: 0

|

Linux? Isn't that that toy-OS with the penguin logo that bearded, filthy, lazy, unemployed geeks ply around with?

Score: 0

|

To be honest Slasher, Microsoft can redefine their OS when they want, their obviously making this change from receipt of beta 2 that people have been testing. But they had always said they would be tweaking UAC to be less annoying.

Only reason people are getting in such a state is it's not usual for them, but it's up to MS to really define a proper OS rather than their big open 'platform of unconformity'.

Score: 0

|

Is your childish flame really necessary?

Score: 0

|

Linux Bigots are some of the most illogical people on the planet. Belittling others, using insulting comments and acting immature is not the way to sway someone to see your point of view.

Score: 0

|

yeah the uac is nice but I too had to turn it off as it was quite bothersome I have everything running including sound (onboard audio but its better then nothing) only office 2007 installed and aim triton which has serious issues with vista...also my one real gripe is IE still has poor password saving abilities

Score: 0

|

General comment -- I'm glad it's there. I probably won't disable it, but it is also great that that option is available. Tell you the truth, everytime I see the dialog box I "feel" more protected... It's a tough balance - too much security and it gets in the way of the end-userp; too little and you open yourself up to attacks. In the end, I think this is a step in the right direction.

Score: 0

|

Glad to hear they're still working on it.

Had to disable it here. I didn't mind the interruptions so much as teh fact that it seemed to be a bit problematic as of yet.

Damn thing would lock every 10 UAC windows or so.

consent.exe seems to have a few issues yet as of Beta 2.

Score: 0

|

I'm just glad it can be disabled.

Score: 0

|

"penetration testing"

as in "probing"

this type of terminology scares me ....

makes me never want to turn my "back" on any OS

(for those considering witty replys, just shove them ..... is 12:30, havent had lunch, is monday and im tired, dont expect A material alright)

altho, in a more serious note, regarding this article....
this windows protection is ridiculous ....
7 clicks for a damn shortcut ...
i hope something is done

http://www.noob.us/humor...-just-a-few-clicks-away/

Score: 0

|

msconfig, last tab, disable UAP.

Score: 0

|

The shortcut was *purposely* altered. It would never have been marked 'system' otherwise.

90% of the files can be *permenantly* deleted with 2 clicks. Select the file, press s***-delete.

Problem solved.

I'm running the Beta 2. Have been for over a week. Other than seriously lacking support for my soundcard, it's been quite solid.

Admitttedly, I'm not being stupid and expecting it to allow me to ALT-Tab between simultaneously running DX games.

I have WinRAR, Foobar2000 (0.8.3 works beautifully), Office 2007, Firefox, and several other apps installed....with Aero interface.

All runs great.

All on a 1.5 Ghz Intel box with 768MB RAM, and an ATI Radeon 9600 (128MB). A true PoS, if ever there was one.

Back to UAC.

Folks need to understand that once the apps and such are installed, the prompts become relatively infrequent. You have to keep in mind that most the folks out there who are going to be using vista will *not* be hitting the Control Panel every 5 minutes.

...and those who do, will know how to disable it. ;)

Score: 0

|

Feh...

Control Panel, User Accounts, Change Security Settings.

:P

More than one way to skin a cat.

Score: 0

|

*More than one way to skin a cat.*

Really? I thought the end justified the means? The only good cat, is a DEAD cat.

skin, fillet, simmer, boil, whatever it takes!

And if there are any members of the ASPCA.. No animals were harmed in the making of this post.. YET!

Score: 0

|

Well, it looks like you and I agree that we don't like cats. It could be my allergies, it could be that they are snobby :) Either way, we've found common ground on this subject, which seems rare of late that you and I are on the same page. Though I'm not saying they should all be dead :)

Score: 0

|

cats yes. kitties no.

Score: 0

|

I ALT-Tab between simultaneously running DX games in Windows 2000. ;-(

Score: 0

|

PDC 2009: What have we learned this week?

There was the freebie that no one will forget, the heebie-jeebies courtesy of Scott Guthrie, and a teensy bit clearer picture of how this cloud thingie should work.

Live report: Will Google Chrome OS change Linux?

The mysteries of just what Chrome OS is, and how much of an operating system it truly is, may be resolved today.

PDC 2009: Microsoft cares about Web browser performance

The effort to give users of the world's dominant Web browser the impression of quality, is a personal one for the man who leads that battle.

Nokia re-affirms its commitment to Symbian, sort of

Maemo won't necessarily be replacing Symbian in the Nokia N-Series, but that's definitely a place where it will be found.

E-book readers will be in short supply this holiday season

E-readers are hot this year, and a lot of compelling new products have been released, but are there enough electrophoretic displays to go around?

Sony looks to finally open a single storefront for downloads

Sony has had many different download portals for movies, music, e-books, and games, and now it's looking to make a single shop for all of it.

Tuning out the tablet: Time to give the endless speculation a rest

Wide Angle Zoom: Wishing and hoping and thinking and praying....won't put an iTablet on the market.

Five improvements for IT managers in 2010

If businesses are to improve their efficiency for next year, they need to stop and reassess the basic tenets of their job.

AOL's spinoff from Time Warner to shed 2,500 jobs

As AOL moves toward become an independent company again, it will cut nearly a third of its workforce.

Gartner: SMS-based money transfer will be bigger than mobile browsing, search

Gartner issues its predictions for the 10 things our phones will be doing in 2012.

Don't forget to upgrade to Firefox 3.6 beta 3 today

Mozilla has released the latest beta its Firefox 3.6 browser software, just over one week after beta 2.