The Great UAC Debate!


UAC  

1412 members have voted

  1. 1. Do You Use UAC?

    • Yes
      477
    • Yes, On "Silent Mode"
      91
    • No (I use an Admin Account)
      496
    • No (I use a Standard Account)
      39
    • I don't use Windows Vista
      118
  2. 2. Have You Ever Been Saved By UAC?

    • Yes
      226
    • No
      932
    • I don't use Windows Vista
      106


Recommended Posts

  • 1 month later...

UAC is the first thing i disable on every Vista system i setup... UAC is a royal pain in the *SS, and most of my clients absolutely hate UAC, because it constantly nags/annoys the user about the most trivial activities. UAC just gets in the way of getting real work done.

UAC is not a feature, it's a bug, and if microsoft was serious about securing the OS, then they would never have hacked together a crappy/half-assed/stop-gap measure like UAC.

UAC is the first thing i disable on every Vista system i setup... UAC is a royal pain in the *SS, and most of my clients absolutely hate UAC, because it constantly nags/annoys the user about the most trivial activities. UAC just gets in the way of getting real work done.

UAC is not a feature, it's a bug, and if microsoft was serious about securing the OS, then they would never have hacked together a crappy/half-assed/stop-gap measure like UAC.

Wow, I seriously pity any client you have, if that's the best you can come up with. Do us a favor and get out of the field before you do any more damage.

Ok, I'm not claiming to be an expert.

But let us say i follow the turn UAC off camp,

What's the worst that could happen considering the arguments for and against, i end up giving malware admin access that wasn't intended as mentioned above.

Now considering I don't turn it off,

I'm annoyed daily when I'm renaming files editing ini files in program files(which i now know i can find in the virtual store thanks topic :D).

considering the two worst scenario outcomes I can tell you I personally would rather be "Protected" and annoyed.

Edit: Wow 26 pages, I think this thread has gotten way too big, and i only read until page 9, and even rorm the first 3 pages just saw people repeating themselves, reckon the facts from this topic just need to be pinned, and then locked,

but its not my place to back seat mod....

Edited by ryan_the_leach

UAC in Vista was horrible, but since I moved to Windows 7, i have it turned on default settings - I only see it when a program needs to elevate itself, which hardly ever happens - and it saved my ass a couple of times too, the icon overlay usually gives you a heads up, when an app is not supposed to make use of the administrator privileges. A great thing!

  • 1 month later...

I like UAC. I run as a standard user and my Admin account has a password. Despite all of that you never know when something might get through, so UAC is turned on, just in case. It is slightly annoying but not nearly as annoying as many make it out to be.

As I stated in another thread I need an AV because all the systems at one of my client's office are infected and I have to connect my USB drive there to exchange data, I also bring back viruses/malware from there and for me the combination of Norton AV 2009 and UAC is golden.. no infections so far since I started using these 2.. UAC doesn't let the exe files run without consent and NAV cleans them off. I feel almost nothing can sneak through and infect me system (Y)

Sigh... when will that crap die.

It's a non-issue. UAC in Win7 works as intended and should be left at the default setting for most users (the UAC settings dialog explains which option you should use based on your usage habits).

Is it better to run as a standard user and elevate as necessary? I'll be reinstalling 7 when the final comes out so I'll switch to doing that if there is a genuine benefit over running as admin at max UAC settings.

The most secure thing you can do is to run as a standard user, and use Fast User Switching to switch to an administrator account for admin tasks.

A step down from that is to use OTS (Over The Shoulder) elevation, where you run as a standard user but run admin tools as an Administrator on the same desktop. To make this safer you'll want to turn on the option that requires a Ctrl+Alt+Del press before elevating, since you'll have to type a password, and you want to make sure the dialog isn't being spoofed. However, this is not a security boundary because non-admin and admin apps are sharing the same desktop.

A step down from that is UAC at the maximum setting. This is much easier to live with because you don't need to enter a password (and don't need the C+A+D press to protect from spoofing) and the apps still run with your user profile and such. Again this is not considered a security boundary because non-admin and admin apps share the same desktop.

-- The above two options are safest at times when there are no admin apps are running --

A small step down from that is the default Win7 configuration where you aren't prompted for changes to Windows settings. This reduces the barrier between non-admin and admin applications, but maintains the same barrier between protected applications (like the IE Protected Mode and Chrome sandboxes) and normal applications.

There's another notch below that where the secure desktop switch is not enabled, opening up the possibility that someone could tamper with the consent dialog.

Below that is disabling UAC entirely. This is a very bad idea because it removes the "low integrity" option used for things like IE's Protected Mode and Chrome's sandbox. That is a very important and useful security feature for mitigating the impact of exploits against the most common attack surfaces.

Across these options you have trade-offs between safety and useability. The default option is meant to provide the best balance for most users.

A step down from that is UAC at the maximum setting. This is much easier to live with because you don't need to enter a password (and don't need the C+A+D press to protect from spoofing) and the apps still run with your user profile and such.

that's right and this way it was done in Vista.

Again this is not considered a security boundary because non-admin and admin apps share the same desktop.

Yes it it. The IL levels prevent you from attacking an admin app from a non-admin app.

Across these options you have trade-offs between safety and useability. The default option is meant to provide the best balance for most users.

no, it only opens a security whole which can be used very easy run apps with admin rights without accepting the UAC prompt. If Average Joe got a mail with a link to get a free cool game and the chance to win a few bucks he will download the tool and try to run it. Under Vista UAC prompt was shown and this unsettles him and de doesn't accept it. With Win7 the apps can use the Explorer, DWM or several other MS apps to bypass the UAC prompt and still get admin rights.

And this is WRONG!

The IL levels prevent you from attacking an admin app from a non-admin app.

No, this is not the purpose of IL levels (in every Windows NT version any admin app can't be attacked by a non-admin app). The purpose of IL levels is preventing an app1 to attack another app2 which runs with the same privileges of app1 i.e. app1 and app2 are running with the same privileges but different integrity levels.

Edited by jamesVault
  • 2 months later...
I'm hoping future versions will not have an option to disable UAC, any insider info on that possibility?

That should NOT happen. People should have the ability to customize they're computer, I personally don't like **** popping up whenever I click to run programs, it happens everytime firefox starts up, some java **** or something.

That should NOT happen. People should have the ability to customize they're computer, I personally don't like **** popping up whenever I click to run programs, it happens everytime firefox starts up, some java **** or something.

It should have happened in Windows 7. Microsoft should have hard coded UAC at default with NO way to change it period. I have never ever had a UAC prompt for Firefox ever if you are getting them you have something on your end.

  • 6 months later...
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Just pull a 4Chan and ignore the UK gov, or better troll them. It's not like they can enforce the fine across border.
    • It has NEVER been shown that all these overreaching creepy methods of surveillance have ever saved a child or prevented a terrorist attack. Not a single one. It's the kind of people like you who just wave it away as "paranoid conspiracy" that makes big tech and governments this creepy mass data hoarding entities. Not only that, 3/4 of these surveillance ideas undermine the very foundations of safe online communication because they always want to have a backdoor in everything "just in case" they might need it to... checks the notes "save the children". If you put a backdoor into encryption chain there is no encryption chain anymore. You know what encryption keeps safe? Your medical records, your online shopping and credit card during payment, your photos in the cloud, your emails, your passwords, everything. There is ZERO guarantee only the good guys will use it. And if you think police suddenly can't apprehend child abusers because of encryption, Epstein was running his entire sex trafficking ring using GMail which is not even encrypted end to end. Or to make matters even worse, USA has a **** and a good buddy of Epstein as a president. Absolutely NOTHING has been done to address it. Maxwell just got a better "hotel" room as a reward. This clearly shows how they absolutely don't really care about the children but they care about the absolute control over all of us. And you're defending them here. Good grief. On top of constant attempts to insert backdoors into encryption chain, the entire age verification nonsense is again entirely over reaching, creepy, invades everyone's privacy with premise of yet again "protecting the children" instead of demanding device makers to provide simple and powerful tools for PARENTS to control how their children use devices and what they do on them. THIS would be the way, not the stupid age verification for everyone. Imagine if government would be dictating companies how their phones work and not the company's IT department. The parents should be the IT department to their children. And for everyone excusing "they are not knowledgeable enough" buuuuuulsheat. We live in a digital age, if you have children now, you absolutely are well versed in digital everything at least to basic extent. If you're not, how do you even function in these times then? Reality is that parents are just lazy and don't want to deal with this. They want government to raise their kids because they are too busy scrolling stupid Instagram and Tiktok or some bs.
    • You could make the argument that K should not be included, but FC, the fried chicken, is not the framework, it's the product. It's the Paint in Paint.NET. A closer analogy is if KFC included the name of the deep fryer they used. HennyPennyFC.
    • Flying as the central point eh... As a massive Spyro fan who has replayed the Reignited Trilogy three times and the originals 4 times... I have some doubts, but maybe...
    • Apple is expanding Private Cloud Compute beyond its own data centers by Pradeep Viswanathan At WWDC 2026, as part of the improved Apple Intelligence capabilities, Apple today announced that it is expanding Private Cloud Compute (PCC), its privacy-focused cloud infrastructure for Apple Intelligence, beyond its own data centers for the first time. Private Cloud Compute was designed to handle Apple Intelligence requests that are too complex to run fully on-device. The PCC system does not store user data and does not allow Apple or anyone else to access user requests. Last year, Apple also expanded its Security Bounty program with rewards of up to $1 million for researchers who could find serious vulnerabilities in PCC. Until now, Apple's PCC data centers were using Apple's own silicon. As part of the expansion, Apple is working with Google and NVIDIA to run new Apple Intelligence workloads on Google Cloud systems powered by NVIDIA GPUs. Apple will be using this new infrastructure to execute more demanding AI tasks while maintaining the same privacy and security guarantees of PCC. The new implementation uses NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs with TDX, and Google’s Titan chip. Apple says it has worked with Google to build additional protections beyond a traditional confidential computing deployment. Despite the expansion to third-party data centers, Apple claims that its core PCC requirements remain unchanged, including stateless computation, no privileged runtime access, non-targetability, and verifiable transparency. The company highlighted that it will continue to control the PCC software stack, and Apple devices will only trust PCC software that has been cryptographically approved by Apple. To take security to the next level, Apple mentioned that it is maintaining an append-only ledger of Google Cloud hardware that is part of the PCC fleet. The company claims this will help reduce the risk of supply chain attacks. In addition to AI infrastructure, Apple also worked with Google to use technologies behind the Gemini family of models to build the next generation of Apple Foundation Models to power Apple Intelligence features across on-device and cloud workloads. As expected, for more demanding AI tasks like agentic tool use and complex reasoning, Apple will rely on the expanded PCC infrastructure running on Google Cloud. The expansion of PCC on Google Cloud will gradually ramp toward the full set of protections during the summer preview period. As before, Apple will also publish binaries for public inspection, provide research tooling, and give researchers access to live PCC nodes in research mode through the Apple Security Bounty Program.
  • Recent Achievements

    • Very Popular
      Captain_Eric earned a badge
      Very Popular
    • One Month Later
      amusc earned a badge
      One Month Later
    • One Month Later
      DJC50PLUS earned a badge
      One Month Later
    • Week One Done
      DJC50PLUS earned a badge
      Week One Done
    • Proficient
      Eric Biran went up a rank
      Proficient
  • Popular Contributors

    1. 1
      +primortal
      506
    2. 2
      PsYcHoKiLLa
      222
    3. 3
      ATLien_0
      92
    4. 4
      +Edouard
      86
    5. 5
      Steven P.
      81
  • Tell a friend

    Love Neowin? Tell a friend!