And although the security software has improved in leaps and bounds since Vista, it\u2019s still far from perfect \u2013 particularly for bigger enterprises with a large number of endpoints.<\/p>\n\n\n\n
UAC and its quirks are a big reason why software like Admin By Request exists \u2013 we saw the need to be able to do a lot more that what UAC could deliver out of the box: compliance, management, logging, granularity and more, all rolled into a good user experience.<\/p>\n\n\n\n
So let\u2019s take a look into what UAC is and isn\u2019t, and why it\u2019s an important (albeit, clumsy) part of Windows security.<\/p>\n\n\n\n
The Idea Behind It<\/h2>\n\n\n\n UAC exists to prevent illegitimate changes to the computer system \u2013 changes that could be made by apps, users, or malware.<\/p>\n\n\n\n
The security feature also aims to enable users to elevate in flow from a standard user account to an administrator account; to run common processes as a standard or administrative user without logging off, switching users, or using Run As.<\/p>\n\n\n\n
How It Works:<\/h2>\n\n\n\n With UAC, the system creates an access token for a user at log in, which contains specific data for authorisation purposes, such as the level of access that the user is granted.<\/p>\n\n\n\n
This data is used by Windows to track what resources a user can and can\u2019t access.<\/p>\n\n\n\n
Standard User<\/h3>\n\n\n\n Standard user access tokens have the least amount of privileges on the device possible.<\/p>\n\n\n\n
On a standard user account, apps can only be launched with the standard user access token, and these apps are only able to operate within the bounds of the access rights granted to a standard user.<\/p>\n\n\n\n
Administrative User<\/h3>\n\n\n\n A full administrator access token, on the other hand, includes Windows privileges and SIDs.<\/p>\n\n\n\n
A user account that belongs to the local administrator group has Windows privileges assigned to it. However, all apps launched by this user will run in the security context of a standard user by default; that is, unless an administrator specifically authorises the app to gain admin-level access to the system.<\/p>\n\n\n\n
When an app does need to run with more than standard user rights, UAC will prompt the user to provide consent or input administrator credentials via the pop-up UI.<\/p>\n\n\n\n
When consent is given or credentials submitted successfully, UAC allows the app to make use of a full administrative token, and the user to then have explicit control of apps that are making system level changes on their device.<\/p>\n\n\n\n
Quirks and Questions<\/h2>\n\n\n\n Firstly, there\u2019s question of whether UAC offers too much flexibility.<\/p>\n\n\n\n
Being user-driven, the low-compliance software can be circumvented by impatient users thanks to some much-too-lenient setting levels available for selection with the UAC settings page:<\/p>\n\n\n\n
Of the four levels of UAC settings, the lower two allow for changes to be made to Windows settings without the consent or credentials pop-up being displayed \u2013 with the lowest also allowing for installations without approval.<\/p>\n\n\n\n
Even if policies in the workplace require UAC settings to be set at the highest level (default), what\u2019s to stop a user circumventing UAC controls on a home device that has access to company resources?<\/p>\n\n\n\n
As the saying goes, \u201cIf you know what\u2019s good for you\u201d. The truth is, most users don\u2019t. And with UAC, underqualified users can still end up making decisions that compromise the system and network.<\/p>\n\n\n\n
But on the other side of the fence, sticking to the recommended default UAC settings leads instead to users pulling hair, gnashing teeth, and demanding blood (or at least, a little bit of independence).<\/p>\n\n\n\n
Paul Boutin, Gadgetwise writer with the New York Times, described the UAC experience accurately: \u201cThose (UAC) pop-ups are like having your Mother hover over your shoulder while you work.\u201d<\/p>\n\n\n\n
And user\u2019s far and wide have resonated this cry, citing intrusive repetitiveness and disruption as the bane of their Window\u2019s user experience.<\/p>\n\n\n\n
Intrusive Repetitiveness<\/h3>\n\n\n\n At the default setting level, UAC will more than likely be prompting both administrative and standard users to the point where it disrupts productivity.<\/p>\n\n\n\n
In order to gain elevation when prompted with the credential UI, standard users would require their own separate admin credentials, someone else\u2019s admin credentials, or for an IT tech to physically come and enter credentials on their machine.<\/p>\n\n\n\n
In an enterprise with 25,000+ endpoints, you can imagine the chaos:<\/p>\n\n\n\n
Unnecessary admin accounts littering the workplace.<\/em><\/p>\n\n\n\nThe potential for administrative credentials to be stolen or compromised soaring every time an IT admin enters their details for a frustrated standard user trying to do a simple, everyday task.<\/em><\/p>\n\n\n\nAdministrative users (who need frequent elevation) feeling justifiably frustrated at continuously having to enter their details throughout the day when they have already been approved within the workplace to make changes to the system.<\/em><\/p>\n\n\n\nAnd so on and so forth.<\/p>\n\n\n\n
Window\u2019s UAC dream of a \u2018seamless approval flow\u2019 experience, that a large organisation needs to function effectively, isn\u2019t achieved.<\/p>\n\n\n\n
But, despite complaints, disabling UAC would result in even worse situations than those described above.<\/p>\n\n\n\n
So what does an organisation do when a necessary security tool doesn\u2019t quite strike the right balance between security and flexibility?<\/p>\n\n\n\n
Finding the Balance with Admin By Request<\/h2>\n\n\n\n They find a user access security tool that delivers the whole package of tight security and good useability in one.<\/p>\n\n\n\n
Admin By Request\u2019s high-compliance, policy-driven Privileged Access Management (PAM) solution, suitable for enterprises with any number of endpoints, addresses the need for UAC \u2013 and refines the solution.<\/p>\n\n\n\n
1. Elevating processes and not the end user.<\/strong><\/p>\n\n\n\nThe \u2018seamless approval flow\u2019 experience is achieved without compromising security, with Admin By Request allowing for on-demand elevation of applications \u2013 not users.<\/p>\n\n\n\n
When the software grants administrator access, the app gains elevation while in use, but the user account never gets full administrator access to the system.<\/p>\n\n\n\n
This method ensures the Principle of Least Privilege (POLP) and Just-in-Time elevation (JIT) \u2013 granting users the minimum privileges necessary, and only when necessary \u2013 are adhered to at all times.<\/p>\n\n\n\n
2. A customised consent.exe<\/strong><\/p>\n\n\n\nWhen a user requires elevation, a customised Admin By Request version of UAC\u2019s Consent UI displays the PAM software\u2019s default \u2018Confirm\u2019 pop-up to the user.<\/p>\n\n\n\n
The software can also be configured to display a credentials pop-up.<\/p>\n\n\n\n
The settings that determine which pop-up is displayed to different groups of users can be configured within the Admin By Request user portal, under global and sub-settings:<\/p>\n\n\n\n3. Whitelisting<\/strong><\/p>\n\n\n\nAdmin By Request allows for the whitelisting of applications known to be safe, so that users aren\u2019t interrupted every time they need access to common processes.<\/p>\n\n\n\n
When configuring whitelisting in the Admin By Request user portal, if you leave \u2018User Confirmation\u2019 toggled off, the app in question will start as admin:<\/p>\n\n\n\nThis highly productive feature allows for common, approved apps to simply start as admin, meaning your once frustrated developers don\u2019t have to confirm every time they want to start Visual Studio.<\/p>\n\n\n\n
Essentially the solution takes a user-driven, self-elevation approach \u2013 but only within the bounds of policies and security settings set out within the Admin By Request user portal.<\/p>\n\n\n\n
None but your IT admins are able to make any changes to Admin By Request settings, and all elevated activity is monitored and logged within the Admin By Request Auditlog, giving compliance the tick.<\/p>\n\n\n\n
The scale is never tipped in favour of flexibility over security or vice versa \u2013 as is often the case with our fair-weathered friend, UAC.<\/p>\n\n\n\n
Summary<\/h2>\n\n\n\n Microsoft\u2019s UAC is a necessity and certainly carries some benefits in desktop management.<\/p>\n\n\n\n
Admin By Request takes the best bits of UAC \u2013 and then adds more.<\/p>\n\n\n\n
Download<\/a>\u00a0the\u00a0latest version of Admin By Request\u00a0today.<\/p>\n","protected":false},"excerpt":{"rendered":"Although necessary, the user experience with Window\u2019s User Account Control has never been smooth. Admin By Request adds flexibility to the UAC experience to provide a solution that achieves everything the Microsoft security tool aims for in a comprehensive, user-friendly solution straight out of the box.<\/p>\n","protected":false},"author":2,"featured_media":3711,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[106,62,220,222,221,179],"ppma_author":[10],"class_list":["post-3710","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","tag-features","tag-microsoft","tag-uac","tag-uac-prompt","tag-user-account-control","tag-windows","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t
![\"\"](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/UAC%20Prompt.png\")
<\/p>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/WinMac.JPG\")
<\/a><\/figure>\n\n\n\n![\"\"](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/UAC%20Settings2.png\")
<\/p>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/UAC%20Settings.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/www.adminbyrequest.com\/Images\/Blogs\/User%20Conf.png\")
<\/figure>\n\n\n\n