The User Account Control feature in Windows Vista has been known to drive normally level-headed people over the edge with frustration. If you find it annoying, you might be tempted to turn it off. According to Microsoft research, somewhere between 12 and 16 percent of all Windows Vista users do exactly that. But before you take such a radical step, it helps to understand what UAC is actually doing on your behalf and how you can tone down its hard edges without sacrificing its protection.

The biggest misconception I hear about UAC is that it’s just another silly “Are you sure?” dialog box that users will quickly learn to ignore. That’s only one small part of the overall UAC system. The point of UAC is to allow you to run as a standard user, something that is nearly impossible in Windows XP and earlier Windows versions. In fact, with UAC enabled (the default setting) every user account in Windows Vista runs as a standard user. When you try to do something that requires administrative privileges, you see a UAC consent dialog box. If you’re an administrator, you simply have to click Continue when prompted. If you’re running as a standard user, you have to provide the user name and password of a member of the Administrators group.

	Image Gallery: I’ve created a walkthrough gallery that shows how to tone down the hard edges of UAC without sacrificing its protection.

UAC has four major benefits:

1. On a shared computer, you can set up standard user accounts for users who don’t have the experience or training to make smart decisions about installing software or making system changes. As a result, they won’t be able to do any damage if a malicious website fools them into trying to install a piece of spyware or a Trojan.
2. As an administrator, you get a warning before a piece of software attempts to make a change that can adversely affect the system. In Windows XP, clicking OK to a single malicious installer program could install a dozen programs in the background, with no warning to you. In Vista with UAC, you’ll have to give consent to each installation (and presumably will say No, early and often.)
3. Badly written programs sometimes try to write user data to system areas, such as the Windows or Program Files folder or a registry key that affects all users. In Windows XP, running this type of program as a standard user would probably cause the program to fail. With Vista, those operations are intercepted and written to a virtualized location in your user profile. The program thinks it wrote a file to the Windows folder, but the actual file appears in your profile.
4. Internet Explorer 7 runs in Protected Mode when UAC is on. That causes processes in a browser window to run at a low integrity level, where they’re blocked from interacting with processes that have a higher integrity level. The net effect is to stop entire classes of web-based attacks in their tracks.

Microsoft product unit manager David Cross made some remarks several weeks ago that have been widely misinterpreted. He was quoted as saying that the reason Microsoft added UAC to Windows Vista was “to annoy users.” The reality is that UAC shouldn’t be annoying, and consent dialog boxes shouldn’t be common. If you’re being pestered with UAC prompts all day long, you should be annoyed at the software developer that wrote the crappy program that’s responsible for those prompts, and you should in turn annoy them until they fix it.

But if you do find UAC annoying in day-to-day use, I recommend that you try one or more of the alternatives described in this post before resorting to the “nuclear alternative” of completely disabling it. The three techniques I outline here (with illustrations in the accompanying screenshot gallery) can help cut the annoyance factor dramatically

http://blogs.zdnet.com/Bott/?p=436

Create a UAC-free Administrator account

Linux users are familiar with the concept of a Root account, which has untrammeled access to the entire system but is not intended for day-to-day use. You can accomplish the same thing in Windows Vista by using standard accounts for day-to-day work, setting up a single Administrator account for those occasions when you want to tinker with the system, and then disabling UAC prompts for Administrators.

The secret involves changing a setting that controls how elevation prompts work for Administrators. You can do this in either of two ways:

• Using Vista Business, Ultimate, or Enterprise, open the Local Group Policy Editor (gpedit.msc), and then drill down through Computer Configuration to Windows Settings, Security Settings, Local Policies, and finally to Security Options. In the list of Policies in the right-hand pane, double-click User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode. Change the setting from its default, Prompt for consent, to Elevate without prompting. Click OK to close the dialog box.

• Using Vista Home Basic or Home Premium, the Local Group Policy Editor is not available. Instead, you’ll need to edit the registry. Open Regedit.exe (the usual disclaimers apply: if you screw something up, it’s not my fault). Locate this key:
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Policies\System

   

  In the right-hand pane, double-click ConsentPromptBehaviorAdmin and change its value from the default 2 to 0. Click OK to save the change.

After making this change, you’ll discover that User Account Control is still on, but clicking a shortcut that previously required elevation now takes you straight to the option you chose, with no intervening UAC dialog boxes.

This is a significant improvement over disabling UAC completely, because file and registry virtualization still work, and so does Protected Mode IE7. But if you can put up with occasional UAC prompts, you’ll be even better off using a standard account and saving your one (and only one) Administrator account for administrative tasks.

In this example, I started with an account called edbott, which I use for everyday computing.

1. First step is to open Control Panel, type new account in the search box, and open the Create New Account dialog box shown here. In this case, I’m creating an account called eb-admin, which I assign as an Administrator.

2. After creating that account, I select my everyday user account (edbott) and click Change the account type.

3. To demote the account, click Standard user and then click Change Account Type.

After all the configuration is complete, I have the list of accounts shown here: one (and only one) administrator account, plus several standard accounts.

To perform administrative tasks without being bothered by UAC, I can press Windows logo key + L and log on to the eb-admin account. Because I enabled the Elevate without prompting option earlier, any task that would normally require UAC consent goes through on the very first click.

Do you think Windows Vista is slow, crash-prone, or unreliable? Join the crowd.

Over the past year, reviews of Windows Vista by mainstream media outlets, the technical press, bloggers, and ordinary users have been, for the most part, scathing. And many of those bad reviews were absolutely accurate. My co-authors and I just completed an extensive post-Service Pack 1 revision of our book Windows Vista Inside Out. Over the past year, we installed, upgraded, and used Windows Vista on a broad cross-section of hardware designs from nearly a dozen manufacturers. During that time, we experienced some of those same performance, reliability, and compatibility issues ourselves. What we found was simple: With a clean install on well-supported hardware, everything worked just fine. But toss in an incompatible application or a flaky video, storage, or network driver, and performance could suffer. Badly.

Over the past year or so, we have also observed steady and occasionally dramatic improvements in the Windows ecosystem. Most of the large issues in Windows Vista were effectively resolved by a series of updates delivered via Windows Update, including more than 500 fixes that were rolled up into Service Pack 1. Third-party hardware makers, many of whom were slow to get working Vista drivers out the door, have since released updates that can make a huge difference in the Vista experience.

Today’s conventional wisdom, based on more than a year’s worth of relentless negative publicity, says Vista is hopelessly broken. In fact, my experience says the exact opposite is true. I proved the point in the first installment of this series, where I restored a sluggish $2500 Sony Vaio notebook to peak performance in a few hours. And I think anyone with a modicum of PC smarts can do the same.

In 2008, there is no excuse for a PC maker to ship a Vista-based system that is anything less than fast and reliable. Sadly, many of them still do a terrible job, loading new PCs (especially notebooks) with outdated drivers, crapware, and overbearing security software that can result in a terrible Vista experience.

If you unbox a new PC and it performs like a slug, you’re likely to just live with the frustration (and maybe even blog about it), because everyone knows that Vista sucks. Right?

Wrong.

I believe you have every right to expect excellent performance from Windows Vista, and I’m going to back that conclusion in today’s post, the latest in my Fixing Vista series, with details on how to use Vista’s built-in tools to find and fix the problems that stand between you and an excellent Vista experience. Specifically, I believe all of the following statements should be true:

• On a new PC built with up-to-date hardware, Windows Vista should start up in a minute or less and shut down in 30 seconds or less.
• Video performance and audio playback should be smooth and glitch-free.
• Programs should open quickly and do their work without affecting your ability to perform other tasks.
• File transfer speeds should be limited only by the capabilities of your hardware (disk, controller, and network).
• System crashes should be nonexistent, and application crashes should hang the faulting program only, without affecting other programs.

If any of those conditions fail, you have a PC that needs fixing. Despite what you might read from self-proclaimed experts, there is no secret formula, magic bullet, or special MakeRocketShipGoFast registry hack that will suddenly send your system zooming into warp speed, nor do you need third-party diagnostic or repair software. Instead, the formula for getting excellent performance out of a Windows Vista PC is much more prosaic: start with quality components, make sure every piece of hardware has the right drivers and every piece of software is up to date, and fix any performance bottlenecks.

In this post and its accompanying image gallery, I’ll introduce you to four built-in tools you can use to track down and fix performance problems.

http://blogs.zdnet.com/Bott/?p=437