Windows Vista Secret: Disabling UAC
If you're a reader of this blog, I'm going to take a low-risk
gamble and assert that you probably consider yourself a power user.
You pride yourself in the responsibility of having full and
absolute control over your machine environment and anything that
comes between that perfect human-machine symbiosis is to be
spurned. If only there were a way to turn User Account Control off
on a Windows Vista machine, you'd upgrade immediately. Well, dear
reader, I'm here to help.
Firstly, it's worth a brief digression into the benefits of this
feature. Running as admin is a bad thing, as most of us know. Aaron
Margosis has blogged extensively on this issue, and I won't rehash
it here. But for reasons of compatibility, running as a standard
user can still be a somewhat painful proposition. Windows Vista
attempts to give you the benefits of both worlds by allowing
administrators to execute most processes in the context of a
standard user and only elevating the privileges on their user token
by consent, in addition to allowing standard user accounts to
perform administrative tasks by selectively elevating a process to
use administrator-level credentials.
In general, UAC has turned out pretty well. It was pretty intrusive
in early builds, prompting often and sometimes capturing focus at
the wrong time. For the vast majority of users, UAC will offer a
valuable level of security protection that will protect against
malware: it simply won't have the rights to perform invasive
actions like installing device drivers or services. Once a system
is configured, you'll rarely see UAC prompts unless you're an
inveterate settings tweaker. Incidentally, you can find out a great
deal more about how UAC works, what you need to do to your own
applications so that they co-operate well with UAC, and the
rationale for its design at the official UAC blog.
It is possible to switch UAC off. I really don't recommend it - if
you like full control over your machine, surely you want to know
when something is attempting to perform an administrative-level
action? Nevertheless, I'd prefer to have you run Windows Vista
without UAC than having you run a different operating system.
There are two ways to disable UAC. The easy solution is through
Control Panel. Type "UAC" into the search bar at the top of the
screen and you'll see this task presented:
This approach is pretty brute-force, though. It just switches
the whole thing off. There's a more subtle configuration choice
that gives you some of the benefits of UAC without any of the
prompting. You'll need to edit the local security policy to control
this, as follows:
From the Start search bar, type "Local Security Policy"
Accept the elevation prompt
From the snap-in, select Security Settings -> Local Policy ->
Security Options
Scroll down to the bottom, where you'll find nine different group
policy settings for granular configuration of UAC.
Perhaps the best choice to select is to change the setting:
User Account Control: Behavior of the elevation prompt for
administrators in Admin Approval Mode
from Prompt for consent to Elevate without prompting.
What does this do? Despite the warning from the Windows Security
Center, UAC isn't actually switched off. It's still there, and all
your processes will still run as a standard user. To prove this,
open a command prompt and try to save a file to the c:\ directory.
You'll get an access denied error message. However, when a process
is marked for elevation, instead of getting the secure desktop
elevation prompt, the request will be silently approved. To show
this in action, right click on a command prompt shortcut and choose
"Run as Administrator". You'll see the command prompt open without
elevation, but the window title will show that you're running with
full administrative privileges.
Using this approach is better than nothing, but it's a bit like
relying on everyone else having a vaccination against measles to
protect yourself from infection. Read the explanations on the
second page of the property sheet for each policy setting before
tinkering, and be careful!
