UAC

[popeiler]

Hi all,

I upgraded to seven from XP about a week ago and found that UAC, rather than being an annoying warning, is actually pretty useful. Instead of doing the default deal where an 'okay' click gives authentication, I set my user account to standard user and made it use the the actual administrator account for administrative privileges. This makes it sort of like the UNIX security model.

The problem is that when a program is executed as an administrator, it does more than just execute it with administrator permissions. It uses the administrator environmental variables, home directory (app data), and the administrator registry. The whole point of using a non-administrator account for daily use was to keep the administrator account non-cluttered.

Anyway, is it possible to tweak UAC so that it will use the current users settings (app data, registry, etc) when providing elevated privileges, while still prompting for a password? (meaning, make it just like sudo)

Thanks!

 

[smah]

There's a wealth of info on Technet (like

http://technet.microsoft.com/en-us/library/cc709628(WS.10).aspx)

for Vista which for the most part, is still applicable to Win7.

Although there will still be several differences, to get UAC to behave similarly to sudo, unfortunately you would use an administrative priveledged user account. Depending on what you're trying to acomplish there might also things that you can do. For example, standard users that are also members of the 'backup operators' group have some additional priveledges (which still require a UAC elevation prompt).

 

[linney]

A little bit of further information here.

How To Run As Different User When Executing Programs in Windows 7

http://www.mydigitallife.info/2009/...nt-user-when-executing-programs-in-windows-7/

At a Command Prompt type RunAs /? and see if there are any viable options via that.

I run as a Standard user most of the time (an old XP habit) but on my standalone machine to make things easier for me I find that I end up giving the Standard user full control of many folders that by default they should not have.

 

[dilettante]

The use of the term "elevation" may have been a bad choice on Microsoft's part.

It somewhat implies that the current user gains elevated access rights. What it actually does is elevate a user who is in the Administrators group, but for a standard user it initiates a temporary session under another (administrative) user, elevated.

I don't think there is a simple way for a standard user to actually gain elevated rights as you might expect.

 

[manhunter2826]

What it actually does is elevate a user who is in the Administrators group, but for a standard user it initiates a temporary session under another (administrative) user, elevated."

^^Now I really am confused

 

[linney]

even administrators run with limited Windows privileges and user rights by default."

Built-in Administrator Account Disabled

http://blogs.msdn.com/windowsvistasecurity/archive/2006/08/27/windowsvistasecurity_.aspx

"Elevated" to my understanding means running with the highest possible Privileges not normally assigned to any type of logged on user.

 

[dilettante]

A standard user can never actually gain admin privileges.

Instead when such a user must perform an admin action, a process can be started with "over the shoulder" elevation, i.e. an admin comes over and types in his user/pw and the process starts and runs as that admin - not the original user.

This is much like the older "runas" mode in XP.