The Disclaimer:
The following tip is a small no-no on a development / home machine but a huge one on, say, a production server.
Some Background:
In Vista and up (Server 2008 etc) there are three desktops available at any one time:
- User desktop – what a normal user would interact with
- System desktop – what the system account (and any services) interact with. This is the desktop that pops up when you run a non-Vista ready service that tries to pop up a window
- Login desktop – this is what you see when you hit Ctrl+Alt+Del
Funnily enough it is quite easy (given administrator permissions) to launch windows on both the System and the Login desktop, but more on that in a later post.
The Problem
The UAC (User Account Control) prompt actually launches on the System desktop for security reasons (programs running on one desktop can’t interact with programs on another desktop, thus reducing the chances of a program that automatically clicks “Allow” on UAC prompts). It firsts grabs a screen shot of the current desktop, applies the grey alpha and then pops up the window – all of which can take a bit of time, depending on the available resources on your computer.
The Workaround
Luckily there is a handy way to tell Windows to launch UAC prompts on the current desktop, meaning it only pops up the UAC prompt, without incurring extra penalties. Here’s how:
- Start->Run->secpol.msc (hit “Allow” on the UAC prompt)
- Local Policies -> Security Options
- Scroll down to the second last option “User Account Control: Switch to the secure desktop when prompting for elevation”
- Double click -> select “Disabled”
Why Not Just Disable UAC?
Let’s face it – UAC under Vista was in your face annoying. Now that SP1 is out in the wild though, the amount of prompts has been drastically reduced (just try creating a directory in an area requiring elevation and notice that there is only one dialog, down from three!) and UAC can get on doing what it does best – protecting you from malware.
On a single person machine, where you don’t have to worry about multiple users accessing things they shouldn’t touch, the main concern is malware. A malicious piece of software will not be able to execute anything requiring elevation without your say so – and with the lower amount of prompts, if Word suddenly starts requiring elevation you know something is wrong.
As Above, but for the Anti-UAC *nix Geek
UAC is sudo. You would never run your *nix box as root so why run your Win* box as administrator?
Does This Disable UAC?
No. It may seem as though this makes it way easier for any malware to click a button, but the UAC prompt is still a secure UI element. For an automated piece of software to click on it, it requires UI access via the exe’s embedded manifest (more on that later when we tackle writing UI Automation which needs to handle UAC) and a valid digital signature. To run, the automated software itself would require elevation – and you have already elevated a piece of malware, then it already has full access to the system anyway (it can just load a kernel driver and start mucking around in kernel space which you have no control over but has full control over you).
So to keep it basic: this will still give you 99% of the security that the previous UAC prompt gave you (just without the pretty graphics) and if you make sure to never elevate a process you aren’t sure requires elevation you will be fine.
Notes
Unlike fully disabling UAC, there will be no security centre warning messages when you disable this prompt – just a speed up.
Fallen behind on your Windows 7 news? Or wondering where to go to hear the latest from key Windows Engineers and IT Professionals on their opinions and insights into the next version of Windows? Perhaps you have something to say to the guys building Windows 7?
I came across an interesting thing today while wandering around the web (as you do…).