In-Depth

Under Secure Control

Windows Vista is a safer OS for users due to its many new features, including one that you as an admin should look at more closely: The User Account Control.

• By Zubair Alexander
• 02/01/2007

One of the major issues that most modern operating systems face today is dealing with malicious software and spyware. Whether you use Macintosh, Linux or Windows on your computer, chances are you are somehow connected to the Internet and use Web browsers, e-mail client and other Web-based applications on a regular basis. Unfortunately, most bad things happen to your computer due to Internet connectivity.

Unlike Windows XP and older Windows operating systems that require users to logon with administrative credentials to perform system-level tasks, such as installing applications, changing the system time, or modifying the registry, Windows Vista uses a new feature called User Account Control (UAC) to eliminate these restrictions. UAC, which is enabled by default, prevents users from running applications with full administrator access token unless the users explicitly agree to run these applications.

Note: User Account Control (UAC) was previously referred to as LUA (Least Privileged User Account) and User Account Protection (UAP).

Macs have used a different strategy than the PCs for years. For example, the Mac OS X operating system is known for its default secure configuration. The Mac OS X administrator account disables access to the core OS functions. This is very different than the way Windows XP computers have operated. Macintosh computers that run a Unix-based operating system have employed a feature similar to UAC for some time. With Windows Vista, the Windows OS has finally caught up with Macs and introduced this much needed feature.

UAC is not the only Windows Vista feature that seems to be “inspired” by OS X, some of the new graphical user interface enhancements and the gadgets are also part of the Mac OS X.

Figure 1 shows a Mac security dialog box, which pops up when a user tries to do something that requires administrative privileges.

Figure 1. Halt! Are you who you say you are?

Let’s take a closer look at how UAC works. As far as the user is concerned, the logon process in Windows Vista resembles the Windows XP logon. Behind the scenes, however, the logon process is very different. Let's examine how the logon process works from both administrator account as well as a standard user account perspectives.

Let's Act Like an Administrator
When you log on as a member of the local Administrators group in Windows Vista, you are granted two access tokens. One is a full administrator token and the other is a filtered, standard user token. This concept is important to understand because even when you log on as an administrator account, your administrative privileges are filtered enough to practically disable your administrative rights -- what you are left is, for all practical purposes, a standard user account. When you run an application or browse the Internet, you are using this filtered access token, which is pretty much a standard user token. If an application requires higher privileges, you are presented with an “elevation prompt” requesting your consent (see Figure 2). You may accept or reject the request.

Figure 2. Okay, Windows Vista asks the same, simple question, but in a less smug way.

Now, In the Shoes of the Standard User
When you logon as a standard user account, only the standard user access token is used. When you run an application or browse the Internet, you are using the minimum necessary privileges and therefore minimizing the risks from unauthorized installation of software or system modifications. If an application requires higher privileges, you are presented with an “elevation prompt” requesting your consent or credentials. If the application requires administrative-level permissions, UAC will require you to provide the administrator’s credentials.

Note: You can use Group Policy or Security Policy Editor to configure the behavior of the elevation prompt.

Unlike Windows XP, Power Users group is not used in Windows Vista. Instead, Microsoft has added permissions to the standard user account so users can easily perform their daily tasks. According to Microsoft, the following new permissions have been added to the standard user account.

• View system clock and calendar
• Change time zone
• Install Wired Equivalent Privacy (WEP) to connect to secure wireless networks
• Change power management settings
• Add printers and other devices that have the required drivers installed on computer or have been allowed by an IT administrator in Group Policy
• Install ActiveX Controls from sites approved by an IT administrator
• Create and configure a Virtual Private Network connection
• Install critical Windows Updates

These settings can be controlled through Group Policy settings.

The Whizbang of UAC
The UAC utilizes several different components to implement this new security model. The main components are AIS, File/Registry Virtualization, Elevation Prompt, and Installer Detection.

Application Information Service (AIS) is a new service in Windows Vista that is used to run applications that require one or more elevated privileges. Essentially, AIS starts a new process for the application with the administrator’s access token as long as the user provides credentials or gives consent. AIS runs by default and is configured to start automatically in Windows Vista.

The File System and Registry Virtualization feature provides a bridge to the legacy applications. When pre-Vista applications that are not compatible with UAC try to write to protected areas, UAC gives them a virtualized view of the resource using copy-on-write approach. This is accomplished by creating a separate copy of the virtualized file for each user under that user's profile. Virtualization takes place automatically in Windows Vista, unless you turn it off explicitly for an application.

A word of caution: Do not depend on this feature to run your legacy applications in Windows Vista as a permanent solution. Microsoft has provided this feature only as a temporary solution. Your goal should be to make your older applications Windows Vista compliant as soon as possible.

Elevation Prompt ensures that only authorized changes are made to the system. By default, this feature is turned on. The elevation prompt is color coded.

Table 1. Elevation prompts are color coded based on what privileges an application has.

Colors Used by UAC What It Means Red background and red shield icon The application is either from a blocked publisher, or it’s blocked by a Group Policy. Blue/green background The application is a Windows Vista administrative application, such as a Control Panel. Gray background and gold shield icon The application is Authenticode signed and is trusted by the local computer. Yellow background and red shield icon The application may be signed or unsigned but is not yet trusted by the local computer.

Installer Detection is responsible for detecting installation/uninstallation programs and prompts a user for elevation because only administrators are allowed to write to system areas and modify the registry. You can control the behavior of Installer Detection with a Group Policy setting. Installation detection takes place automatically in Windows Vista, unless you turn off this feature.

There's Always Another Option: Admin Approval Mode
Earlier I explained the differences between logging on as an administrator account versus a standard user account. You also have an option to run what is known as an Admin Approval Mode. In this mode you are prompted by a “consent” prompt. Because you are logged in Admin Approval Mode, you are not asked to provide credentials, as a standard user will be.

Notice that the concept of “consent prompt” is different from the “credentials prompt.” The consent prompt simply asks an administrator whether if she wants to run an application, while credentials prompt requires users to provide the name and password of an administrator account to perform a task that requires an administrator’s access token.

Tada! That's UAC
UAC is an important security feature in Windows Vista. Initially, when I used UAC in earlier betas, I found it pretty annoying. As I have grown to learn the importance of UAC and have been using Windows Vista for a while, dealing with elevation prompts is no longer such a nuisance.

UAC works at the computer level so you cannot turn it off on a user-by-user or a group-by-group basis. You must either enable or disable UAC for the entire computer. Although you can turn UAC off, I strongly recommend that you leave this feature on to prevent your computer from exposure to malware and other exploits. For more information on UAC, click here.