As described in previous articles, User Account Control (or UAC) is
included in Windows to help prevent unauthorized changes to your
computer. UAC notifies you when changes are going to be made to your
computer that require administrator-level permission. These types of
changes can affect the security of your computer or can affect settings
for other people that use the computer.
When you are notified by UAC that there is a pending change to your computer, you should carefully read the contents of each dialog box before allowing changes to be made to your computer. It's usually safe to allow changes to be made to Windows settings without you being notified. However, certain programs that come with Windows can have commands or data passed to them, and malicious software can take advantage of this by using these programs to install files or change settings on your computer. You should always be careful about which programs you allow to run on your computer.
In Windows 7, UAC settings has a slider to change the level of the notifications and allows you to choose one between the following four options:
Always notify - With this option, you'll be notified before programs make changes to your computer or to Windows settings that require the permissions of an administrator. When you're notified, your desktop will be dimmed, and you must either approve or deny the request in the UAC dialog box before you can do anything else on your computer. The dimming of your desktop is referred to as the secure desktop because other programs can't run while it's dimmed. This is the most secure setting, and is similar to what the Windows Vista UAC looked like.
Notify me only when programs try to make changes to my computer - You will be notified before programs make changes to your computer that require the permissions of an administrator. You will not be notified if you try to make changes to Windows settings that require the permissions of an administrator. Also, you will be notified if a program outside of Windows tries to make changes to a Windows setting. This is the default setting.
Notify me only when programs try to make changes to my computer (do not dim my desktop) - You will be notified before programs make changes to your computer that require the permissions of an administrator, and you will be notified if a program outside of Windows tries to make changes to a Windows setting.. However, you will not be notified if you try to make changes to Windows settings that require the permissions of an administrator. This setting is the same as "Notify only when programs try to make changes to my computer," but you are not notified on the secure desktop. Because the UAC dialog box isn't on the secure desktop with this setting, other programs might be able to interfere with the dialog's visual appearance. This is a small security risk if you already have a malicious program running on your computer.
Never notify - You will not be notified before any changes are made to your computer. If you are logged on as an administrator, programs can make changes to your computer without you knowing about it. If you are logged on as a standard user, any changes that require the permissions of an administrator will automatically be denied. This is actually somewhat similar to using Windows 7 in the permission model of Windows XP. This is the least secure setting. When you set UAC to never notify, you open up your computer to potential security risks.
Personally, and unlike my recommendations on disabling UAC for Vista, I now think it's a good idea to leave UAC on if possible. Adjusting your notification options can make that a little easier to do.
If you do disable UAC, be aware of which programs you run as they'll have the same access to the computer as you do. This includes reading and making changes to protected system areas, your personal data, saved files, and anything else stored on the computer. Programs will also be able to communicate and transfer information to and from anything your computer connects with, including the Internet.
There are many ways to disable UAC on your computer. Here are a few...
Go to User Account Control Settings.
Type in UAC, or go to the System and Security applet.
Click on the "Change User Account Control Settings" link.
BTW, you can also type in this command from the Run menu:
To turn UAC back on, move the slider to choose when you want to be notified, and then click OK. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
You will need to restart your computer for UAC to be turned off.
This can be done via Local Group Policy or via Active Directory-based GPO, which is much more suited for large networks where one would like to disable UAC for many computers at once.
If using Local Group Policy you'll need to open the Group Policy Editor (Start > Run > gpedit.msc).
If using in AD-based GPO, open Group Policy Management Console (Start > Run > gpmc.msc) from a Windows Vista/7/2008 computer that is a member of the domain. In the GPMC window, browse to the required GPO that is linked to the OU or domain where the computers are located, then edit it, or, if needed, create a new GPO.
In the Group Policy Editor window, browse to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
Make the following changes:
Restart the computer when done.
If prompted to enter your credentials by UAC, do so and/or press Yes to continue.
Navigate to the following registry subkey:
On the Edit menu, click Modify. In the Value data box, type 0 (zero), and then click OK.
Exit Registry Editor, and then reboot the computer.
Source: http://www.petri.co.il
When you are notified by UAC that there is a pending change to your computer, you should carefully read the contents of each dialog box before allowing changes to be made to your computer. It's usually safe to allow changes to be made to Windows settings without you being notified. However, certain programs that come with Windows can have commands or data passed to them, and malicious software can take advantage of this by using these programs to install files or change settings on your computer. You should always be careful about which programs you allow to run on your computer.
In Windows 7, UAC settings has a slider to change the level of the notifications and allows you to choose one between the following four options:
Always notify - With this option, you'll be notified before programs make changes to your computer or to Windows settings that require the permissions of an administrator. When you're notified, your desktop will be dimmed, and you must either approve or deny the request in the UAC dialog box before you can do anything else on your computer. The dimming of your desktop is referred to as the secure desktop because other programs can't run while it's dimmed. This is the most secure setting, and is similar to what the Windows Vista UAC looked like.
Notify me only when programs try to make changes to my computer - You will be notified before programs make changes to your computer that require the permissions of an administrator. You will not be notified if you try to make changes to Windows settings that require the permissions of an administrator. Also, you will be notified if a program outside of Windows tries to make changes to a Windows setting. This is the default setting.
Notify me only when programs try to make changes to my computer (do not dim my desktop) - You will be notified before programs make changes to your computer that require the permissions of an administrator, and you will be notified if a program outside of Windows tries to make changes to a Windows setting.. However, you will not be notified if you try to make changes to Windows settings that require the permissions of an administrator. This setting is the same as "Notify only when programs try to make changes to my computer," but you are not notified on the secure desktop. Because the UAC dialog box isn't on the secure desktop with this setting, other programs might be able to interfere with the dialog's visual appearance. This is a small security risk if you already have a malicious program running on your computer.
Never notify - You will not be notified before any changes are made to your computer. If you are logged on as an administrator, programs can make changes to your computer without you knowing about it. If you are logged on as a standard user, any changes that require the permissions of an administrator will automatically be denied. This is actually somewhat similar to using Windows 7 in the permission model of Windows XP. This is the least secure setting. When you set UAC to never notify, you open up your computer to potential security risks.
Personally, and unlike my recommendations on disabling UAC for Vista, I now think it's a good idea to leave UAC on if possible. Adjusting your notification options can make that a little easier to do.
If you do disable UAC, be aware of which programs you run as they'll have the same access to the computer as you do. This includes reading and making changes to protected system areas, your personal data, saved files, and anything else stored on the computer. Programs will also be able to communicate and transfer information to and from anything your computer connects with, including the Internet.
There are many ways to disable UAC on your computer. Here are a few...
Option A - Disable UAC Through User Account Control Settings
This is the method that should be used by most users wanting to disable UAC.Go to User Account Control Settings.
Type in UAC, or go to the System and Security applet.
Click on the "Change User Account Control Settings" link.
BTW, you can also type in this command from the Run menu:
C:\Windows\System32\UserAccountControlSettings.exeTo turn off UAC, move the slider to the Never notify position, and then click OK. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
To turn UAC back on, move the slider to choose when you want to be notified, and then click OK. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
You will need to restart your computer for UAC to be turned off.
Option B - Disable UAC Through Group Policy
This is the method that should be used by administrators wanting to disable UAC across several computers at once.This can be done via Local Group Policy or via Active Directory-based GPO, which is much more suited for large networks where one would like to disable UAC for many computers at once.
If using Local Group Policy you'll need to open the Group Policy Editor (Start > Run > gpedit.msc).
If using in AD-based GPO, open Group Policy Management Console (Start > Run > gpmc.msc) from a Windows Vista/7/2008 computer that is a member of the domain. In the GPMC window, browse to the required GPO that is linked to the OU or domain where the computers are located, then edit it, or, if needed, create a new GPO.
In the Group Policy Editor window, browse to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
Make the following changes:
- User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - Set its value to Elevate without prompting.
- User Account Control: Detect application installations and prompt for elevation - Set its value to Disabled.
- User Account Control: Only elevate UIAccess applications that are installed in secure locations - Set its value to Disabled.
- User Account Control: Run all administrators in Admin Approval Mode - Set its value to Disabled.
Restart the computer when done.
Option C - Disable UAC Through the Registry
Another method to disable UAC is through the computer's Registry.Warning!Click Start, click Run, type regedit, and then click Enter.
This document contains instructions for editing the registry. If you make any error while editing the registry, you can potentially cause Windows to fail or be unable to boot, requiring you to reinstall Windows. Edit the registry at your own risk. Always back up the registry before making any changes. If you do not feel comfortable editing the registry, do not attempt these instructions. Instead, seek the help of a trained computer specialist.
If prompted to enter your credentials by UAC, do so and/or press Yes to continue.
Navigate to the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
In the details pane, locate the EnableLUA key (REG_DWORD type).
On the Edit menu, click Modify. In the Value data box, type 0 (zero), and then click OK.
Exit Registry Editor, and then reboot the computer.
Source: http://www.petri.co.il
0 comments:
Post a Comment