Welcome back to your free training course for Windows 7. In this video I will look at
user account control. At feature that first appear in Windows Vista and has improved in
Windows 7. If you go back to the old days of computing
there was not much need for security. Back in the dos days computers were not even networked.
Now days the majority of computers are networked and most of these are connected to the internet.
As new operating systems came out like Windows XP, they allowed you to create users administrator
rights or user rights. The idea being that you would log in as a
user when you wanted to do your day to day activities and log in as an administrator
when you wanted to perform a task that required more access. The problem with this approach
was that the user often just logged in as an administrator and stayed logged in as an
administrator for their day to day activities. The reason they did this is that it saved
them having to log off and log back on when they needed to perform an administrator task.
Being logged in as an administrator now gave malware access to your system so spyware,
adware and viruses could easily infect your system without the users knowledge.
Now this may seem to you just laziness and not wanting to switch users to perform administrator
tasks, but the problem also occurs with poorly written software. This software would often
require the user to have administrator access. Often a help desktop support person would
change the users access level to administrator to allow the software to run.
This is not the best security. Also when you look at how often actual an administrator
function is required even when the user is an enterprise admin it is often very rare.
What I am getting at is that when you are logged in as administrator, the software you
are using may perform an administrator function and then not require any additional administrator
functions for a long time. For example, just say the files associated
with a log are protected. When software to read these logs is first run the software
needs additional access to read these log files. As soon as the log files are read into
memory it no longer requires that access. All in all, the time required to access the
files may be a split second, but the user could be looking at the logs for minutes if
not hours, all this time logged in as the administrator.
Also since the user is logged is an administrator, any software currently running can access
the system using administrator rights. Even though the user may have only logged in with
the intent of only using one piece of software with administrator rights.
User account control attempts to fix these problems. First it solves the issue of having
users logged in as administrators by having two security identifiers. A security identifier
or SID for short, is basically a unique identifier. Here are some examples of SID’s. It is beyond
the scope of this course to go too much detail into SID’s, but understanding the layout
of the tokens does help you understand them better.
You can see from the sid’s listed that they come in different lengths but they always
start with a S. The next value is the revision number. The value after that is the authority
that issued the SID. The last number or sets of numbers are the identifiers. These identifies
are the unique part of the SID. Each user has one of these and although the start of
the SID may be the same, the last part of SID will always be different.
When an administrator account is created in Windows 7 it is given two SIDS, a general
user SID and a administrator SID. To demonstrate how this work, I switch to my Windows 7 computer.
First to show you how user account control works I will show you how to configure it.
First open the control panel and then select system and security. From system and security
select the option change user account control settings from under the action center. This
setting determines how many UAC prompts you will receive. By default Windows will only
notify you when programs try to make changes to the computer.
When Windows Vista came out a UAC prompt would be displayed for any changes made on the computer.
This annoyed a lot of people as it seemed anything you did would trigger a UAC prompt.
Even with the reduced amount of prompts that you get on Windows 7, you can disable them
completely by sliding the bar down to the bottom. This of course is not recommended
as it completely disables UAC.
If I put the slider to the top, this will enable UAC for any time a change is made to
the computer no matter how small. This is the same behavior as Windows vista. If you
look at the o k button, you will notice that there is a small shield next to the button.
This means that when you select this button a change will be made to your computer.
Since I have changed the UAC to always prompt, when I press the O.K. button I will put into
secure desktop. While is secure desktop, input can only be done through the keyboard and
the mouse. Program such as malware cannot accept the prompts for you. This gives you
more security, but also means that you will get a prompt every time you try and change
sometimes which can become annoying. You will notice you can see the background is greyed
out. Windows takes a snap shot of the back ground and puts a secure dialog box on top
of it. This is more noticeable when you have a video running in the background and the video
will appear to stop.
When I press o.k. the actual change will be made using the administrator SID and not the
user SID. The effect of this is not that noticeable in this case. If I accept the prompt and open
Windows Explorer I have a share mapped to anther server. If I now run some software
from the network this will illustrate the two sids better. When I attempt to install
the software from the network, I will once again get a UAC prompt asking me if I want
to proceed. Notice that when I press yes I now get a prompt asking me for a username
and password.
What has happened is that UAC has changed to the administrator SID to perform the action.
Think of it as two users. The standard SID has the drive mapped to the network share
while the administrator SID does not. When the administrator SID attempted to take over
it could not access the mapped drive and this is why Windows has asked you for a username
and password to connect to the network drive.
Once the username and password has been entered, the administrator SID will now be able to
access the mapped drive and install the software. Sometimes you may find that software on a
network drive does not install correctly with UAC. A work around for this problem is to
copy the software from the network drive to the local computer and install it from there.
I have already shown you how to change the amount of prompts that you will get in UAC.
If you want more control over UAC you can do this with group policy. The settings for
UAC are found in computer configuration, Windows settings, security settings, local policies
and then security options. You can also access the options through the local security settings
for the computer through the control panel.
Regardless of where you change the settings they are essential the same because they are
the same settings. Local security settings are the local group policy filtered down to
the settings that only apply to security. If I change back to my Windows 7 computer
I can configure the UAC group policy settings.
To change the settings, I will open control panel and open system and security. From system
and security select administrative tools at the bottom. From administrative tools select
the option local security policy.
This will show a filtered down view of the local group policy. The UAC settings are found
under local polices and then security options. At the bottom of the list is the UAC Settings.
The first setting controls admin approval mode for the built in administrator account.
When you install Windows 7, a built in administrator account is created and then disabled. If you
enable this account and start using it, by default you will not get any UAC prompts before
performing a function that requires additional rights.
If you ever need more information about what a setting does, you can select the explain
tab. This will tell you what the setting does. The next UAC setting you can set for user
interface accessibility or UIA. When this setting is enabled and UIA software is used,
a standard prompt will be displayed rather than the secure desktop prompt.
UIA is often used by remote control software. Since secure desktop can only be accept or
declined using the local keyboard and mouse, without this setting on means a remote user
using remote assistance could not accept a secure desktop prompt. However enabling this
option does weaken security.
The next option determines what will happen when admin approval mode is used. Admin approval
mode is when you are asked to confirm a request or asked for a username and password. It is
possible to disable the secure desktop and use the regular desktop allowing it to work
better with remote control software. If you do this, you may want to consider setting
this setting to always ask for a username and password.
Even if you are the administrator logged in, doing this will force the person to enter
in a username and password and thus get back some of the security lost by disabling the
secure desktop. If you wanted to, you could change the setting to bypass admin approval
mode all together. Doing this means you will not be prompted when the computer needs to
elevator rights.
The next option determines if user account control will prompt for elevation when it
detects an application is being installed. On a home pc, this is set to enable as this
will either be done by a user or malware. If you add your computer to a domain, this
option will be disabled. In an enterprise environment software is often managed from
remote. Having this setting enabled in an enterprise environment will stop remote software
management systems from working.
The next setting will make it so only executable that are signed and validated will be able
to elevate. If you need very strict control over software used in the environment you
may want to enable this setting. If you do enable this setting, then any software you
download from the internet will need to be signed and trusted by your certificate authority.
This is a lot more work, but does give you better security.
The next option determines if the user interface accessibility elevation will occur only when
the executable is in a secure area. This basically means if it is in the Windows system 32 directory
or the program files directory. This prevents malware from installing itself in other locations
bypassing security.
This setting determines if any user with administrator rights can bypass admin approval mode. By
default only the built in administrator account will bypass admin approval mode, however if
you enable this setting, any person with administrator rights will not be given any admin approval
prompts. This does weaken security.
The next setting determines is user account control will switch to secure desktop when
prompting for elevation. By disabling this you will still get the prompts however it
will use the standard Windows interface. Doing this does mean that malware could accept the
prompts for you and by pass the security. It is recommend you leave this setting to
enabled, however if you have software like remote control software that does not work
with secure desktop you may need to configure this setting.
The last setting determines if user account control will use the virtual file and registry
service. When a program attempts to write to a secure area of the hard disk or registry,
it is silently redirected to a virtual area of the user profile. This fools the program
into thinking that it is writing to the protected area when it does not have access. If you
disable this setting some legacy software may stop working.
This concludes user account control. In the next video I will look at Authentication and
authorization the 40th free video in this free series for Windows 7. We hope you have
enjoyed this free training video on Windows 7 so far. For the completed course have a
look at our web site or you tube channel. Thanks for watching.