Labs Drills Down Into Vistas UAC Feature

Amid the hullabaloo about how intrusive Vistas User Account Control feature will be to the average user, Microsoft has been quietly ramping up the support infrastructure needed to help companies adopt it. eWEEK Labs work with UAC shows that more work lies ahead, however.

With Vistas UAC, Microsoft has finally gotten serious about securing the Windows operating system by limiting a users rights during day-to-day computer usage. UAC also finally brings the Windows operating system up to speed with just about every other major operating system available today.

UAC enables the concept of LUP (least user privilege), where users run with limited privileges for the bulk of their interaction with the desktop. User rights are elevated only when necessary to perform certain administrative tasks. By limiting the users normal permissions, there is less attack surface on the operating system and less chance for the user to inadvertently—how should we put this—screw things up.

Under UAC, both administrators and standard (limited rights) users operate with the Standard User security token. When a process requiring elevated permissions is initiated, Vista may ask users to confirm their intention to run the process or ask for administrative credentials to perform the act (depending on the configuration). This interaction—be it a confirmation or a credentialing—occurs in the Secure Desktop, where users cant interact with the desktop, and vice versa—until the questions are answered.

Organizations that have already implemented LUP with current Windows versions will likely have the easiest transition to Vista and UAC, as the hard work of getting users accustomed to limited rights and making applications work correctly with those limited rights has already been done. (And we expect that these organizations will quickly remove the annoying credential request for standard users, replacing it with a stock denial message.)

However, organizations unfamiliar with the LUP concept are likely to disable the UAC feature in Vista altogether—at least for the short term—as they begin the arduous task of evaluating their software stable for security compliance with the new operating system. (Vista is expected to be released by the end of 2006.)

Helpful Tools

Whether administrators are familiar with LUP or not, they will need tools to configure Vista across the enterprise and to evaluate their applications Vista proclivity. With Group Policy and the Standard User Analyzer, Microsoft aims to do just that.

In Vista, Group Policy includes nine new policy settings that control the behavior of UAC, and these settings can be applied either in the local Group Policy Object or in a Windows Server 2000 or 2003 domain-based GPO. These settings control whether domain-based and built-in local administrators run by default with the Standard User token or with the Administrator privilege token. In the former case, the settings determine if admins can simply approve privilege escalation or if they must provide their credentials to run a protected task. Other settings dictate whether standard users have the option to enter administrator credentials or if they are simply denied access.

As long as IT managers are administering GPOs from a Vista-based machine, each of these policy objects can be found at Computer Configuration/Windows Settings/Security Settings/Security Options. Because Vista uses new XML-based ADMX templates with Group Policy, legacy Windows machines cannot edit or take advantage of these new policy settings.

Next Page: Enabling virtualization via Group Policy.