User Account Control (UAC) is a technology and security infrastructure introduced with Microsoft's Windows Vista and Windows Server 2008 operating systems, with a more relaxed^[1] version also present in Windows 7 and Windows Server 2008 R2. It aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorizes an increase or elevation. In this way, only applications trusted by the user may receive administrative privileges, and malware should be kept from compromising the operating system. In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorizes it.

To reduce the possibility of lower-privilege applications communicating with higher-privilege ones, another new technology, User Interface Privilege Isolation is used in conjunction with User Account Control to isolate these processes from each other.^[2] One prominent use of this is Internet Explorer 7's "Protected Mode".^[3]

History[link]

Operating systems on mainframes and on servers have differentiated between superusers and userland for decades. This had an obvious security component, but also an administrative component, in that it prevented users from accidentally changing system settings.

Early Microsoft home operating systems (such as MS-DOS, Windows 95, Windows 98 and Windows Me) did not have a concept of different user accounts on the same machine, and all actions were performed as super user / an administrator^{[clarification needed]}. Windows NT introduced multiple user accounts, but in practice most users continued to operate as an administrator for their normal operations. Further, some applications would require the user be an administrator for some or all of their functions to work.^[4] Subsequent versions of Windows and Microsoft applications encouraged the use of non-administrator user logons, yet some applications continued to require it. To be certified Windows compliant by Microsoft, and be able to use the Windows compliant logo with their packaging, applications had to not require administrator privileges.

Introduced in Windows Vista, User Account Control (UAC) is an integrated, more balanced approach to encourage "super-user when necessary". Linux and Unix users will be familiar with this, as UAC's functionality is very similar to the "sudo" command. The key to UAC lies in its ability to elevate privileges without changing the user context (user "Bob" is still user "Bob"). As always, it is difficult to introduce new security features without breaking compatibility with existing applications.

When logging into Vista as a standard user, a logon session is created and a token containing only the most basic privileges is assigned. In this way, the new logon session is incapable of making changes that would affect the entire system. When logging in as a user in the Administrators group, two separate tokens are assigned. The first token contains all privileges typically awarded to an administrator, and the second is a restricted token similar to what a standard user would receive. User applications, including the Windows Shell, are then started with the restricted token, resulting in a reduced privilege environment even under an Administrator account. When an application requests higher privileges or "Run as administrator" is clicked, UAC will prompt for confirmation and, if consent is given, start the process using the unrestricted token.^[5]

In Windows 7, Microsoft updated UAC in several ways. By default, UAC does not prompt when certain programs included with Windows make changes requiring elevated permissions. Other programs still trigger a UAC prompt. The strictness of UAC can be changed to either always prompt, or to never do so.

Tasks that trigger a UAC prompt[link]

Tasks that require administrator privileges will trigger a UAC prompt (if UAC is enabled); they are typically marked by a security shield icon with the 4 colors of the Windows logo (in Vista and Windows Server 2008) or with two panels yellow and two blue (Windows 7 and Server 2008 R2). In the case of executable files, the icon will have a security shield overlay. The following tasks require administrator privileges:^[6]

• Running an Application as an Administrator
• Changes to system-wide settings or to files in %SystemRoot% or %ProgramFiles%
• Installing and uninstalling applications
• Installing device drivers
• Installing ActiveX controls
• Changing settings for Windows Firewall
• Changing UAC settings
• Configuring Windows Update
• Adding or removing user accounts
• Changing a user’s account type
• Configuring Parental Controls
• Running Task Scheduler
• Restoring backed-up system files
• Viewing or changing another user’s folders and files
• Running Disk Defragmenter

Common tasks, such as changing the time zone, do not require administrator privileges^[7] (although changing the system time itself does, since the system time is commonly used in security protocols such as Kerberos). A number of tasks that required administrator privileges in earlier versions of Windows, such as installing critical Windows updates, no longer do so in Vista.^[8] Any program can be run as administrator by right-clicking its icon and clicking "Run as administrator", except MSI or MSU packages as, due to their nature, if administrator rights will be required a prompt will usually be shown. Should this fail, the only workaround is to run a Command Prompt as an administrator and launch the MSI or MSP package from there.

Features[link]

User Account Control asks for credentials in a Secure Desktop mode, where the entire screen is temporarily dimmed, Windows Aero disabled, and only the authorization window at full brightness, to present only the elevation user interface (UI). This is to prevent spoofing of the UI or the mouse by the application requesting elevation.^[9] If an administrative activity comes from a minimized application, the secure desktop request will also be minimized so as to prevent the focus from being lost. It is possible to disable Secure Desktop, though this is inadvisable from a security perspective.^[10]

Applications written with the assumption that the user will be running with administrator privileges experienced problems in earlier versions of Windows when run from limited user accounts, often because they attempted to write to machine-wide or system directories (such as Program Files) or registry keys (notably HKLM).^[4] UAC attempts to alleviate this using File and Registry Virtualization, which redirects writes (and subsequent reads) to a per-user location within the user’s profile. For example, if an application attempts to write to “C:\program files\appname\settings.ini” and the user doesn’t have permissions to write to that directory, the write will get redirected to “C:\Users\username\AppData\Local\VirtualStore\Program Files\appname\settings.ini”.

There are a number of configurable UAC settings. It is possible to:^[11]

• Require administrators to re-enter their password for heightened security;
• Require the user to press Ctrl+Alt+Del as part of the authentication process for heightened security;
• Disable only file and registry virtualization ^[12]
• Disable Admin Approval Mode (UAC prompts for administrators) entirely; note that, while this disables the UAC confirmation dialogs, it does not disable Windows' built-in LUA feature, which means that users, even those marked as administrators, are still limited users with no true administrative access.

Command Prompt windows that are running elevated will prefix the title of the window with the word "Administrator", so that a user can discern which instances are running with elevated privileges.^[13]

A distinction is made between elevation requests from a signed executable and an unsigned executable; and if the former, whether the publisher is 'Windows Vista'. The color, icon, and wording of the prompts are different in each case; for example, attempting to convey a greater sense of warning if the executable is unsigned than if not.^[14]

Internet Explorer 7's "Protected Mode" feature uses UAC to run with a 'low' integrity level (a Standard user token has an integrity level of 'medium'; an elevated (Administrator) token has an integrity level of 'high'). As such, it effectively runs in a sandbox, unable to write to most of the system (apart from the Temporary Internet Files folder) without elevating via UAC.^[5][15] Since toolbars and ActiveX controls run within the Internet Explorer process, they will run with low privileges as well, and will be severely limited in what damage they can do to the system.^[16]

Requesting elevation[link]

A program can request elevation in a number of different ways. One way for program developers is to add a requestedPrivileges section to an XML document, known as the manifest, that is then embedded into the application. A manifest can specify dependencies, visual styles, and now the appropriate security context:

<source lang="xml"> <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

 <v3:trustInfo xmlns:v3="urn:schemas-microsoft-com:asm.v3">
   <v3:security>
     <v3:requestedPrivileges>
       <v3:requestedExecutionLevel level="highestAvailable"/>
     </v3:requestedPrivileges>
   </v3:security>
 </v3:trustInfo>

</assembly> </source>

Setting the level attribute for requestedExecutionLevel to "asInvoker" will make the application run with the token that started it, "highestAvailable" will present a UAC prompt for administrators and run with the usual reduced privileges for standard users, and "requireAdministrator" will require elevation.^[17] In both highestAvailable and requireAdministrator modes, failure to provide confirmation results in the program not being launched.

An executable that is marked as "requireAdministrator" in its manifest cannot be started from a non-elevated process using CreateProcess(). Instead, ERROR_ELEVATION_REQUIRED will be returned. ShellExecute() or ShellExecuteEx() must be used instead. If an HWND is not supplied, then the dialog will show up as a blinking item in the taskbar.

Inspecting an executable's manifest to determine if it requires elevation is not recommended, as elevation may be required for other reasons (setup executables, application compatibility). However, it is possible to programmatically detect if an executable will require elevation by using CreateProcess() and setting the dwCreationFlags parameter to CREATE_SUSPENDED. If elevation is required, then ERROR_ELEVATION_REQUIRED will be returned.^[18] If elevation is not required, a success return code will be returned at which point you can use TerminateProcess() on the newly created, suspended process. This will not allow you to detect that an executable requires elevation if you are already executing in an elevated process, however.

A new process with elevated privileges can be spawned from within a .NET application using the "runas" verb. An example using C#: <source lang="csharp"> System.Diagnostics.Process proc = new System.Diagnostics.Process(); proc.StartInfo.FileName = "C:\\Windows\\system32\\notepad.exe"; proc.StartInfo.Verb = "runas"; // Elevate the application proc.Start(); </source> In a native Win32 application the same "runas" verb can be added to a ShellExecute() or ShellExecuteEx() call.^[5] <source lang="cpp"> ShellExecute(hwnd, "runas", "C:\\Windows\\Notepad.exe", 0, 0, SW_SHOWNORMAL); </source> In the absence of a specific directive stating what privileges the application requests, UAC will apply heuristics, to determine whether or not the application needs administrator privileges. For example, if UAC detects that the application is a setup program, from clues such as the filename, versioning fields, or the presence of certain sequences of bytes within the executable, in the absence of a manifest it will assume that the application needs administrator privileges.^[19]

Criticism[link]

There have been complaints that UAC notifications slow down various tasks on the computer such as the initial installation of software onto Windows Vista.^[20] It is possible to turn off UAC while installing software, and reenable it at a later time.^[21] However, this is not recommended since, as File & Registry Virtualization is only active when UAC is turned on, user settings and configuration files may be installed to a different place (a system directory rather than a user-specific directory) if UAC is switched off than they would be otherwise.^[22] Also Internet Explorer 7's "Protected Mode", whereby the browser runs in a sandbox with lower privileges than the standard user, relies on UAC; and will not function if UAC is disabled.^[15]

Yankee Group analyst Andrew Jaquith stated that "while the new security system shows promise, it is far too chatty and annoying."^[23] However, this statement was made over six months before Vista was actually released (even before Beta 2 was released). By the time Windows Vista was released in November 2006, Microsoft had drastically reduced the number of operating system tasks that triggered UAC prompts, and added file and registry virtualization to reduce the number of legacy applications that trigger UAC prompts.^[4] However, David Cross, a product unit manager at Microsoft, stated during the RSA Conference 2008 that UAC was in fact designed to "annoy users," and force independent software vendors to make their programs more secure so that UAC prompts would not be triggered.^[24] In response to these criticisms, Microsoft has altered UAC activity in Windows 7. For example, by default users are not prompted to confirm actions initiated with the mouse and keyboard alone such as operating Control Panel applets. New York Times Gadgetwise writer Stephen Williams says: "One recommended way to wring more speed from Vista is to turn off the overly protective User Account Control whose pop-ups are like having your mother hover over your shoulder while you work.".^[25]

See also[link]

• Comparison of privilege authorization features
• Features new to Windows Vista
• runas
• Security and safety features of Windows Vista

References[link]

External links[link]

• Turning UAC On or Off
• Documentation about UAC for Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista
• UAC Understanding and Configuring More Information at Microsoft Technet
• Development Requirements for User Account Control Compatibility More information at Microsoft Developer Network
• UAC Team Blog

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. (November 2010)

A user is an agent, either a human agent (end-user) or software agent, who uses a computer or network service. A user often has a user account and is identified by a username (also user name). Other terms for username include login name, screen name (also screenname), nickname (also nick), or handle, which is derived from the identical Citizen's Band radio term.

Users are also widely characterized as the class of people that use a system without complete technical expertise required to understand the system fully.^[1] In hacker-related contexts, such users are also divided into lusers and power users.

In projects in which the actor of the system is another system or a software agent, it is quite possible that there is no end-user for the system. In this case, the end-users for the system would be indirect end-users.^{[clarification needed]}

End user[link]

The term end-user refers to the ultimate operator of a piece of software, but it is also a concept in software engineering, referring to an abstraction of that group of end-users of computers (i.e. the expected user or target-user). The term is used to distinguish those who only operate the software from the developer of the system, who knows a programming language and uses it to create new functions for end-users.

This abstraction is primarily useful in designing the user interface, and refers to a relevant subset of characteristics that most expected users would have in common. In user-centered design, several fictional Personas are created to represent the archetypal end users, which may include differences concerning which computer interfaces with which each persona is comfortable (due to experience or their inherent simplicity), and the persona's technical expertise and degree of knowledge in specific fields or disciplines.

When few constraints are imposed on the end-user category, especially when designing programs for use by the general public, it is common practice to expect minimal technical expertise or previous training in end users (the general meaning associated with the term end-user).^[2] In this context, easy-to-learn GUIs (possibly with a touchscreen) are usually preferred to more sophisticated command line interfaces for the sake of usability.

The end-user development discipline blurs the typical distinction between users and developers. It designates activities or techniques in which people who are not professional developers create automated behavior and complex data objects without significant knowledge of a programming language.

User account[link]

A user's account allows a user to authenticate to system services and be granted authorization to access them; however, authentication does not imply authorization. To log in to an account, a user is typically required to authenticate oneself with a password or other credentials for the purposes of accounting, security, logging, and resource management.

Once the user has logged on, the operating system will often use an identifier such as an integer to refer to them, rather than their username, through a process known as identity correlation. In Unix systems, the username is correlated with a user identifier or user id.

Computer systems are divided into two groups based on what kind of users they have:

• Single-user systems do not have a concept of several user accounts.
• Multi-user systems have such a concept, and require users to identify themselves before using the system.

User accounts on multi-user systems typically include a home directory, in which to store files pertaining exclusively to that user's activities, which is protected from access by other users (though a system administrator may have access). User accounts often contain a public user profile, which contains basic information provided by the account's owner.

In online communities, screen names can become a mark of persona, some of them acquiring a certain level of fame from the contributions of their holders. Some famous screen names :

• CmdrTaco, of Rob Malda, founder of the website Slashdot.
• lcamtuf, of Michał Zalewski, a security expert.

Criticism[link]

Some usability professionals have expressed their dislike of the term "user", proposing it to be changed. ^[3]

Don Norman stated:

One of the horrible words we use is "users". I am on a crusade to get rid of the word "users". I would prefer to call them "people".^[4]

See also[link]

• Anonymous post
• End-user computing, systems in which non-programmers can create working applications.
• End-user database, a collection of data developed by individual end-users.
• End-user development, a technique that allows people who are not professional developers to perform programming tasks, i.e. to create or modify software.
• End-User License Agreement (EULA), a contract between a supplier of software and its purchaser, granting the right to use it.
• User error

References[link]

This article is based on material taken from the Free On-line Dictionary of Computing prior to 1 November 2008 and incorporated under the "relicensing" terms of the GFDL, version 1.3 or later.

External links[link]

• computer.yourdictionary.com