User Account Control (UAC) was developed to address concerns that viruses and malware can do much more damage to a system when a user is logged on with administrative rights on the local machine, than when the user is logged on as a limited or “standard” user. With UAC turned on, even when you are logged on as a local administrator, you do not normally execute processes with administrative privileges.
If you try to perform an action that does require such privileges, UAC prompts you for confirmation, before elevating your privileges. If you are logged on as a standard user, and you try to do something that requires admin rights, by default, you will be prompted to provide credentials of an account that has such rights. The idea is to prevent rogue software from doing things you don’t want it to do – and, incidentally, to make administrators stop and think for a second before executing potentially damaging tasks.
You can change this behavior through Group Policy so that non-administrators are simply denied, rather than prompted for, credentials. You can modify UAC prompt behavior for the built-in administrator account, as opposed to other non-built-in accounts that you create and make part of the Administrators group. And you can turn UAC completely off, if you find that the bother outweighs the benefit.
One little setting in this category has an intriguing name: “Virtualize file and registry write failures to per-user locations.” This is on by default, and it allows Vista and Windows Server 2008 to provide greater compatibility with legacy applications by redirecting certain kinds of writes that are now forbidden (such as to C:Program Files) to special locations in the user profile, to avoid program errors. I’m not quite sure why it’s under UAC, nor can I imagine why anyone would want to turn it off, but it is worth a mention.
Recent blog posts…
WS 2008 Troubleshooting and Diagnostic Tools
Printer Driver Installation Delegation & Hybrid Hard Disk in WS 2008
