User Account Control

Overview

Before Windows XP was released, previous versions of Windows targeted at the consumer audience (such as Windows 95, Windows 98 and Windows Me) were all single user operating systems where the user had super user rights. Windows XP, on the other hand, is a multi-user operating system based on Windows NT. This allowed for different user levels and permissions.

However, in Windows XP the first user created when installing the operating system is given administrative privileges by default. As such, most users would use this account for everyday use. This ensured that all software, including malware, was also running with administrator privileges as well, thereby giving it full access to the operating system.

Many legacy Windows applications and even new Windows applications were or are not designed to work without full administrator privileges.^[3] Running these as a standard user or even as a power user could lead to errors or strange behavior. As such, it was often normal practice to give users full administrator access when running normally.

With User Account Control in Windows Vista and Windows Server 2008, actions that can affect the security and stability of the operating system require the input of an administrator name and password before they are executed. If the user is an administrator, they are not asked to re-enter their password. Instead, a dialog box is shown with the choices to allow or deny the action.

When logging into Windows as a standard user, a logon session is created and a token containing only the most basic privileges is assigned. In this way, the new logon session is incapable of making changes that would affect the entire system. When logging in as a user in the Administrators group, two separate tokens are assigned. The first token contains all privileges typically awarded to an administrator, and the second is a restricted token similar to what a standard user would receive. User applications, including the Windows Shell, are then started with the restricted token, resulting in a reduced privilege environment even under an Administrator account. When an application requests higher privileges or "Run as administrator" is clicked, UAC will prompt for confirmation and, if consent is given, start the process using the unrestricted token.^[4]

Features

User Account Control asks for credentials in a Secure Desktop mode, where the entire screen is temporarily darkened and only the authorization window is enlightened, to present only the elevation UI. This is to prevent spoofing of the UI or the mouse by the application requesting elevation.^[8] If an administrative activity comes from a minimized application, the secure desktop request will also be minimized so as to prevent the focus from being lost. It is possible to disable Secure Desktop, though this is inadvisable from a security perspective.^[9]

Applications written with the assumption that the user will be running with administrator privileges experienced problems in earlier versions of Windows when run from limited user accounts, often because they attempted to write to machine-wide or system directories (such as Program Files) or registry keys (notably HKLM)^[3] UAC attempts to alleviate this using File and Registry Virtualization, which redirects writes (and subsequent reads) to a per-user location within the user’s profile. For example, if an application attempts to write to “C:\program files\appname\settings.ini” and the user doesn’t have permissions to write to that directory, the write will get redirected to “C:\Users\username\AppData\Local\VirtualStore\Program Files\appname\.”

There are a number of configurable UAC settings. It is possible to:^[10]

• Require administrators to re-enter their password for heightened security
• Require the user to press Ctrl+Alt+Del as part of the authentication process for heightened security
• Disable Admin Approval Mode (UAC prompts for administrators) entirely

Command prompt windows that are running elevated will prefix the title of the window with the word "Administrator", so that a user can discern which command prompts are running with elevated privileges.^[11]

A distinction is made between elevation requests from a signed executable and an unsigned executable; and if the former, whether the publisher is 'Windows Vista'. The color, icon, and wording of the prompts are different in each case; for example, attempting to convey a greater sense of warning if the executable is unsigned than if not.^[12]

Internet Explorer 7's "Protected Mode" feature uses UAC to run with a 'low' integrity level (a Standard user token has an integrity level of 'medium'; an elevated (Administrator) token has an integrity level of 'high'). As such, it effectively runs in a sandbox, unable to write to most of the system (apart from the Temporary Internet Files folder) without elevating via UAC.^[4][13] Since toolbars and ActiveX controls run within the Internet Explorer process, they will run with low privileges as well, and will be severely limited in what damage they can do to the system.^[14]