View Single Post
  #4 (permalink)  
Old September 17th 06, 09:07 PM posted to microsoft.public.windows.vista.security
Jimmy Brush
external usenet poster
 
Posts: 827
Default Disabling UAC doesn't actually decrease security?

Hello,

This actually does disable UAC.

The security loss comes into play because all programs now silently run with
the full privileges of the user. When logged in as an administrator, all
programs run with full admin privileges, even the ones that don't need it.
This is bad news in today's world, regardless of operating system.

UAC does three things for you, and you see the most benefit when running
under the admin account, but this also benefits normal users by allowing
them to elevate:

1) Programs run only with the least privileges necessary. Notepad shouldn't
be able to take control of your domain and format all the hard drives on
your network. Why give it so much power?

2) Programs that NEED admin access MUST be approved to run by YOU at the
time that they start, every time. So, if somehow some nasty software burrows
onto your system and gets itself to start somehow, you can stop it from
starting. There is no way to bypass this behavior with UAC enabled - if you
allow something to run elevated, you can no longer blame Windows for the
intrusion.

3) UAC provides the infrastructure for more advanced security controls such
as Internet Explorer protected mode. I would expect that future versions of
windows will add more security controls based on the core UAC model.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/