oreilly.comSafari Books Online.Conferences.


AddThis Social Bookmark Button

An Overview of UAC in Windows Vista
Pages: 1, 2

UAC for Home Users

What's the optimal (i.e. secure) configuration of UAC for home users? UAC is controlled by Group Policy, or on stand-alone machines by Local Security Policy (secpol.msc), and there are currently six UAC policy settings found under Computer Configuration\Security Settings\Local Policies\Security Options:

Thumbnail, click for full-size image.
Figure 3: User Account Control policy settings on a stand-alone machine--click for full-size image.

The behavior of UAC on a stand-alone (workgroup) machine is as follows. If the logged-on user is using an administrator account, the default is that a prompt appears whenever they need to elevate their privileges to perform some system-level task. If mom is an administrator on the computer, she'll probably get frustrated with this setting and change the policy to No Prompt, but that's a bad idea because one of the basic ideas of UAC is to alert the user when an application is trying to perform something system-level. On the other hand, if the logged-on user has only a standard account, then the default is that mom will have to walk over and say "Turn your head Bobby" and type her password so Bobby can perform the task he wants to do. Sure it's a pain, but the alternative (letting Bobby install anything he wants to) is out of the question for most parents.

UAC for Enterprise Users

Now let's look at Joe's Vista machine, which is joined to a domain at work. The UAC settings on his machine should probably look more like this:

Thumbnail, click for full-size image.
Figure 4: UAC policy settings appropriate for a machine belonging to a domain--click for full-size image.

In other words, a domain machine should probably have UAC configured differently from a home machine so that standard users are never even prompted for admin credentials (OTS is inappropriate in a work environment) and elevation is not required for app installs since tools like Group Policy and SMS are used to deploy apps instead. Of course, if you simply join a Vista box to a W2K3 domain you presently don't get these settings since Group Policy in downlevel platforms doesn't support Vista's new security settings yet, but presumably with Longhorn Server on the back end this is essentially what you get (though I haven't tested this yet).


Regardless of the frustration users (and kids and parents especially) may feel with UAC, it's definitely a step in the right direction for security of Windows machines. But how legacy apps will work with this feature is another issue, and something I'll look at in a future article soon.

Mitch Tulloch is the author of Windows 2000 Administration in a Nutshell, Windows Server 2003 in a Nutshell, and Windows Server Hacks.

Return to the Windows DevCenter.