Compartilhar via

Can I customise UAC?

  • Artigo

I had some interesting questions today from customers about the level of customization an IT guy can do regarding which areas of functionality are protected by UAC.  I.e. if I don't want the Firewall protected by UAC can I change a setting in Group Policy?  The answer is unfortunately no, you can't customize the individual bits of functionality protected by UAC.

I guess the reason for this is that we've done some pretty extensive user testing, beta feedback analysis and security threat modeling and found the right amount of features that require protection and those that don't.  I guess what I'm saying is "trust us - we've done it right", which judging from customer and user feedback was the right thing to do - it works well and we've struck a good balance that allows the user to carry out their day to day tasks free from UAC interruption whilst maintaining security on important areas like firewall et al.

There are however some settings in Group Policy that enable to tweak your UAC experience:

1) User Account Control: Behavior of the elevation prompt for administrators
2) User Account Control: Behavior of the elevation prompt for standard users
3) User Account Control: Elevate on application installs
4) User Account Control: Run all users, including administrators, as standard users
5) User Account Control: Validate signatures of executables that require elevation
6) User Account Control: Virtualize file and registry write failures to per-user locations

These are described in great detail on the UAC Team blog over here, so I won't try and paraphrase I'll just recommend you take a look.

Other things I would read are the TechNet resources on UAC: Understanding and Configuring User Account Control in Windows Vista

Technorati tags: Vista, Security, UAC, Group Policy, Management, IT Pro, Technet

Comments

  • Anonymous
    January 01, 2003
    James gave me some hassle the other day for not referencing his blog (which is a valid thing to do),

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    May 22, 2007
    While I'll generally agree that UAC works pretty well, there are a few areas in which improvements may be in order. For example, the creation of a new folder in a restricted location and emptying the Recycle Bin of certain protected files. In the first instance, the creation of a new folder (with something other than a "New Folder" name) requires no less than 4 mouse clicks (two sets of UAC prompts), one set for the folder creation and yet another for the folder rename operation. On rare occasions, emptying the Recycle Bin of certain files generates a UAC prompt. Seems akin to your garbage man ringing your doorbell and asking your permission to throw away one of your items of trash. :)

  • Anonymous
    June 20, 2007
    I have to disagree significantly with this post. While the UAC presents a much needed change to keeping users hands out of the O/S and making my life easier, it has thusfar not done so, and Microsoft is part of that reason. A prime example are the ActiveX control settings in IE7. While our users are attempting a Webinar with clients present, the ActiveX pops up and now they need it gone immediately leaves me with no choice but to give them the passwords and then remote in and change it. Other factors, such as software which requires certain permission levels to operate (such as Autocad, Fishbowl and other LOB's), now require me to make the user an admin, or I get to be at their side 8 hours a day watching over them for every prompt. As I said, the UAC is awesome in its initial form. What's missing? The UAC's customization based on software/security permissions. And, it should not take Microsoft a lot to modify this. The UAC does not have to be completely re-written, but it can be adapted to work closely with the other built-in options. For instance, if it was designed to use the exception list available in Windows Firewall, or apply its security settings based on the Windows Trusted zone and not pop up when an internal network ActiveX control request pops up. I am amongst the first to congratulate Microsoft and the whole team for a great job on Vista. I can spend a year tearing it apart, but all things considered - I've spent my time breaking and fixing and am already implementing it across entire networks for our clients. However, the UAC is one area where Microsoft needs to not toot its own horn, but look at the fact there are areas outside of the single 'focus group' that should be given consideration. Keep the UAC as it is for those who like it - but don't destroy an administrator's ability to customize, lest you take away the tools they need to do their job right.