Для чего нужен контроль учетных записей в windows 10

From Wikipedia, the free encyclopedia

User Account Control (UAC) is a mandatory access control enforcement feature introduced with Microsoft’s Windows Vista^[1] and Windows Server 2008 operating systems, with a more relaxed^[2] version also present in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows 11. It aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorises an increase or elevation. In this way, only applications trusted by the user may receive administrative privileges and malware are kept from compromising the operating system. In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorises it.

UAC uses Mandatory Integrity Control to isolate running processes with different privileges. To reduce the possibility of lower-privilege applications communicating with higher-privilege ones, another new technology, User Interface Privilege Isolation, is used in conjunction with User Account Control to isolate these processes from each other.^[3] One prominent use of this is Internet Explorer 7’s «Protected Mode».^[4]

Operating systems on mainframes and on servers have differentiated between superusers and userland for decades. This had an obvious security component, but also an administrative component, in that it prevented users from accidentally changing system settings.

Early Microsoft home operating-systems (such as MS-DOS, Windows 95-98 and Windows Me) did not have a concept of different user-accounts on the same machine. Subsequent versions of Windows and Microsoft applications encouraged the use of non-administrator user-logons, yet some applications continued to require administrator rights. Microsoft does not certify applications as Windows-compliant if they require administrator privileges; such applications may not use the Windows-compliant logo with their packaging.

Behavior in Windows versions[edit]

• MS-DOS and Windows versions 1.0 to 3.11: all applications had privileges equivalent to the operating system;
• Windows 9x: all applications enjoyed system-wide privileges rivaling those of the operating system itself;
• All versions of Windows NT up to Windows XP: introduced multiple user-accounts, but in practice most users continued to function as an administrator for their normal operations. Further, some applications would require that the user be an administrator for some or all of their functions to work.^[5]
• Windows Vista: Microsoft developed Vista security firstly from the Limited User Account (LUA), then renamed the concept to User Account Protection (UAP) before finally shipping User Account Control (UAC).^[6] Introduced in Windows Vista, User Account Control (UAC) offers an approach to encourage «super-user when necessary». The key to UAC lies in its ability to elevate privileges without changing the user context (user «Bob» is still user «Bob»). As always, it is difficult to introduce new security features without breaking compatibility with existing applications.
  • When someone logs into Vista as a standard user, the system sets up a logon session and assigns a token containing only the most basic privileges. In this way, the new logon session cannot make changes that would affect the entire system.
  • When a person logs in as a user with membership in the Administrators group, the system assigns two separate tokens: the first token contains all privileges typically awarded to an administrator, and the second is a restricted token similar to what a standard user would receive.
    • User applications, including the Windows Shell, then start with the restricted token, resulting in a reduced-privilege environment – even when running under an Administrator account.
    • When an application requests higher privileges or when a user selects a «Run as administrator» option, UAC will prompt standard users to enter the credentials of an Administrator account and prompt Administrators for confirmation and, if consent is given, continue or start the process using an unrestricted token.^[7]
• Windows 7: Microsoft included a user interface to change User Account Control settings, and introduced one new notification mode: the default setting. By default, UAC does not prompt for consent when users make changes to Windows settings that require elevated permission through programs stored in %SystemRoot% and digitally signed by Microsoft. Programs that require permission to run still trigger a prompt. Other User Account Control settings that can be changed through the new UI could have been accessed through the registry in Windows Vista.^[8]
• Windows 8 and 8.1: add a design change. When UAC is triggered, all applications and the taskbar are hidden when the desktop is dimmed.
• Windows 10: copies the same layout as Windows 8 and 8.1, but the Anniversary Update has a more modern look. Also, Windows 10 adds support for Windows Hello in the User Account Control dialog box.

Tasks that trigger a UAC prompt[edit]

Tasks that require administrator privileges will trigger a UAC prompt (if UAC is enabled); they are typically marked by a security shield icon with the 4 colors of the Windows logo (in Vista and Windows Server 2008) or with two panels yellow and two blue (Windows 7, Windows Server 2008 R2 and later). In the case of executable files, the icon will have a security shield overlay. The following tasks require administrator privileges:^[9][10]

• Running an Application as an Administrator
• Changes to system-wide settings
• Changes to files in folders that standard users don’t have permissions for (such as %SystemRoot% or %ProgramFiles% in most cases)
• Changes to an access control list (ACL), commonly referred to as file or folder permissions
• Installing and uninstalling applications outside of:
  • The %USERPROFILE% (e.g. C:Users{logged in user}) folder and its sub-folders.
    • Most of the time this is in %APPDATA%. (e.g. C:Users{logged in user}AppData), by default, this is a hidden folder.
      • Chrome’s and Firefox’s installer ask for admin rights during install, if given, Chrome will install in the Program Files folder and be usable for all users, if denied, Chrome will install in the %APPDATA% folder instead and only be usable by the current user.
  • The Microsoft Store.
  • The folder of the installer and its sub-folders.
    • Steam installs its games in the /steamapps/ sub-folder, thus not prompting UAC. Some games require prerequisites to be installed, which may prompt UAC.
• Installing device drivers
• Installing ActiveX controls
• Changing settings for Windows Firewall
• Changing UAC settings
• Configuring Windows Update
• Adding or removing user accounts
• Changing a user’s account name or type
• Creating a new account or deleting a user account
• Turning on Guest account (Windows 7 to 8.1)
• Turning on network discovery, file and printer sharing, Public folder sharing, turning off password protected sharing or turning on media streaming
• Configuring Parental Controls (in Windows 7) or Family Safety (Windows 8.1)
• Running Task Scheduler
• Backing up and restoring folders and files
• Merging and deleting network locations
• Turning on or cleaning logging in Remote Access Preferences
• Running Color Calibration
• Changing remote, system protection or advanced system settings
• Restoring backed-up system files
• Viewing or changing another user’s folders and files
• Running Disk Defragmenter, System Restore or Windows Easy Transfer (Windows 7 to 8.1)
• Running Registry Editor
• Running the Windows Experience Index assessment
• Troubleshoot audio recording and playing, hardware / devices and power use
• Change power settings, turning off Windows features, uninstall, change or repair a program
• Change date and time and synchronizing with an Internet time server
• Installing and uninstalling display languages
• Change Ease of Access administrative settings

Common tasks, such as changing the time zone, do not require administrator privileges^[11] (although changing the system time itself does, since the system time is commonly used in security protocols such as Kerberos). A number of tasks that required administrator privileges in earlier versions of Windows, such as installing critical Windows updates, no longer require administrator privileges in Vista.^[12] Any program can be run as administrator by right-clicking its icon and clicking «Run as administrator», except MSI or MSU packages as, due to their nature, if administrator rights will be required a prompt will usually be shown. Should this fail, the only workaround is to run a Command Prompt as an administrator and launch the MSI or MSP package from there.

Features[edit]

User Account Control asks for credentials in a Secure Desktop mode, where the entire screen is temporarily dimmed, Windows Aero disabled, and only the authorization window at full brightness, to present only the elevation user interface (UI). Normal applications cannot interact with the Secure Desktop. This helps prevent spoofing, such as overlaying different text or graphics on top of the elevation request, or tweaking the mouse pointer to click the confirmation button when that’s not what the user intended.^[13] If an administrative activity comes from a minimized application, the secure desktop request will also be minimized so as to prevent the focus from being lost. It is possible to disable Secure Desktop, though this is inadvisable from a security perspective.^[14]

In earlier versions of Windows, Applications written with the assumption that the user will be running with administrator privileges experienced problems when run from limited user accounts, often because they attempted to write to machine-wide or system directories (such as Program Files) or registry keys (notably HKLM).^[5] UAC attempts to alleviate this using File and Registry Virtualization, which redirects writes (and subsequent reads) to a per-user location within the user’s profile. For example, if an application attempts to write to a directory such as «C:Program Filesappnamesettings.ini» to which the user does not have write permission, the write will be redirected to «C:UsersusernameAppDataLocalVirtualStoreProgram Filesappnamesettings.ini». The redirection feature is only provided for non-elevated 32-bit applications, and only if they do not include a manifest that requests specific privileges.^[15]

There are a number of configurable UAC settings. It is possible to:^[16]

• Require administrators to re-enter their password for heightened security,
• Require the user to press Ctrl+Alt+Del as part of the authentication process for heightened security;
• Disable only file and registry virtualization^[17]
• Disable Admin Approval Mode (UAC prompts for administrators) entirely; note that, while this disables the UAC confirmation dialogs, it does not disable Windows’ built-in LUA feature, which means that users, even those marked as administrators, are still limited users with no true administrative access.

Command Prompt windows that are running elevated will prefix the title of the window with the word «Administrator», so that a user can discern which instances are running with elevated privileges.^[18]

A distinction is made between elevation requests from a signed executable and an unsigned executable; and if the former, whether the publisher is ‘Windows Vista’. The color, icon, and wording of the prompts are different in each case; for example, attempting to convey a greater sense of warning if the executable is unsigned than if not.^[19]

Internet Explorer 7’s «Protected Mode» feature uses UAC to run with a ‘low’ integrity level (a Standard user token has an integrity level of ‘medium’; an elevated (Administrator) token has an integrity level of ‘high’). As such, it effectively runs in a sandbox, unable to write to most of the system (apart from the Temporary Internet Files folder) without elevating via UAC.^[7][20] Since toolbars and ActiveX controls run within the Internet Explorer process, they will run with low privileges as well, and will be severely limited in what damage they can do to the system.^[21]

Requesting elevation[edit]

A program can request elevation in a number of different ways. One way for program developers is to add a requestedPrivileges section to an XML document, known as the manifest, that is then embedded into the application. A manifest can specify dependencies, visual styles, and now the appropriate security context:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="highestAvailable" />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Setting the level attribute for requestedExecutionLevel to «asInvoker» will make the application run with the token that started it, «highestAvailable» will present a UAC prompt for administrators and run with the usual reduced privileges for standard users, and «requireAdministrator» will require elevation.^[22] In both highestAvailable and requireAdministrator modes, failure to provide confirmation results in the program not being launched.

An executable that is marked as «requireAdministrator» in its manifest cannot be started from a non-elevated process using CreateProcess(). Instead, ERROR_ELEVATION_REQUIRED will be returned. ShellExecute() or ShellExecuteEx() must be used instead. If an HWND is not supplied, then the dialog will show up as a blinking item in the taskbar.

Inspecting an executable’s manifest to determine if it requires elevation is not recommended, as elevation may be required for other reasons (setup executables, application compatibility). However, it is possible to programmatically detect if an executable will require elevation by using CreateProcess() and setting the dwCreationFlags parameter to CREATE_SUSPENDED. If elevation is required, then ERROR_ELEVATION_REQUIRED will be returned.^[23] If elevation is not required, a success return code will be returned at which point one can use TerminateProcess() on the newly created, suspended process. This will not allow one to detect that an executable requires elevation if one is already executing in an elevated process, however.

A new process with elevated privileges can be spawned from within a .NET application using the «runas» verb. An example using C#:

System.Diagnostics.Process proc = new System.Diagnostics.Process();
proc.StartInfo.FileName = "C:\Windows\system32\notepad.exe";
proc.StartInfo.Verb = "runas"; // Elevate the application
proc.StartInfo.UseShellExecute = true;
proc.Start();

In a native Win32 application the same «runas» verb can be added to a ShellExecute() or ShellExecuteEx() call:^[7]

ShellExecute(hwnd, "runas", "C:\Windows\Notepad.exe", 0, 0, SW_SHOWNORMAL);

In the absence of a specific directive stating what privileges the application requests, UAC will apply heuristics, to determine whether or not the application needs administrator privileges. For example, if UAC detects that the application is a setup program, from clues such as the filename, versioning fields, or the presence of certain sequences of bytes within the executable, in the absence of a manifest it will assume that the application needs administrator privileges.^[24]

Security[edit]

UAC is a convenience feature; it neither introduces a security boundary nor prevents execution of malware.^{[25][26][27][28]}

Leo Davidson discovered that Microsoft weakened UAC in Windows 7 through exemption of about 70 Windows programs from displaying a UAC prompt and presented a proof of concept for a privilege escalation.^[29]

Stefan Kanthak presented a proof of concept for a privilege escalation via UAC’s installer detection and IExpress installers.^[30]

Stefan Kanthak presented another proof of concept for arbitrary code execution as well as privilege escalation via UAC’s auto-elevation and binary planting.^[31]

Criticism[edit]

There have been complaints that UAC notifications slow down various tasks on the computer such as the initial installation of software onto Windows Vista.^[32] It is possible to turn off UAC while installing software, and re-enable it at a later time.^[33] However, this is not recommended since, as File & Registry Virtualization is only active when UAC is turned on, user settings and configuration files may be installed to a different place (a system directory rather than a user-specific directory) if UAC is switched off than they would be otherwise.^[14] Also Internet Explorer 7’s «Protected Mode», whereby the browser runs in a sandbox with lower privileges than the standard user, relies on UAC; and will not function if UAC is disabled.^[20]

Yankee Group analyst Andrew Jaquith said, six months before Vista was released, that «while the new security system shows promise, it is far too chatty and annoying.»^[34] By the time Windows Vista was released in November 2006, Microsoft had drastically reduced the number of operating system tasks that triggered UAC prompts, and added file and registry virtualization to reduce the number of legacy applications that triggered UAC prompts.^[5] However, David Cross, a product unit manager at Microsoft, stated during the RSA Conference 2008 that UAC was in fact designed to «annoy users,» and force independent software vendors to make their programs more secure so that UAC prompts would not be triggered.^[35] Software written for Windows XP, and many peripherals, would no longer work in Windows Vista or 7 due to the extensive changes made in the introduction of UAC. The compatibility options were also insufficient. In response to these criticisms, Microsoft altered UAC activity in Windows 7. For example, by default users are not prompted to confirm many actions initiated with the mouse and keyboard alone such as operating Control Panel applets.

In a controversial article, New York Times Gadgetwise writer Paul Boutin said «Turn off Vista’s overly protective User Account Control. Those pop-ups are like having your mother hover over your shoulder while you work.»^[36] Computerworld journalist Preston Gralla described the NYT article as «…one of the worst pieces of technical advice ever issued.»^[37]

See also[edit]

• Comparison of privilege authorization features
• Features new to Windows Vista
• Polkit
• runas
• Secure attention key (SAK)
• Security and safety features new to Windows Vista
• sudo – A similar feature in UNIX-like operating systems

References[edit]

External links[edit]

• Turning UAC On or Off in Windows 7
• Documentation about UAC for Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista
• UAC Understanding and Configuring More Information at Microsoft Technet
• Development Requirements for User Account Control Compatibility More information at Microsoft Developer Network
• UAC Team Blog

From Wikipedia, the free encyclopedia

User Account Control (UAC) is a mandatory access control enforcement feature introduced with Microsoft’s Windows Vista^[1] and Windows Server 2008 operating systems, with a more relaxed^[2] version also present in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows 11. It aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorises an increase or elevation. In this way, only applications trusted by the user may receive administrative privileges and malware are kept from compromising the operating system. In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorises it.

UAC uses Mandatory Integrity Control to isolate running processes with different privileges. To reduce the possibility of lower-privilege applications communicating with higher-privilege ones, another new technology, User Interface Privilege Isolation, is used in conjunction with User Account Control to isolate these processes from each other.^[3] One prominent use of this is Internet Explorer 7’s «Protected Mode».^[4]

Operating systems on mainframes and on servers have differentiated between superusers and userland for decades. This had an obvious security component, but also an administrative component, in that it prevented users from accidentally changing system settings.

Early Microsoft home operating-systems (such as MS-DOS, Windows 95-98 and Windows Me) did not have a concept of different user-accounts on the same machine. Subsequent versions of Windows and Microsoft applications encouraged the use of non-administrator user-logons, yet some applications continued to require administrator rights. Microsoft does not certify applications as Windows-compliant if they require administrator privileges; such applications may not use the Windows-compliant logo with their packaging.

Behavior in Windows versions[edit]

• MS-DOS and Windows versions 1.0 to 3.11: all applications had privileges equivalent to the operating system;
• Windows 9x: all applications enjoyed system-wide privileges rivaling those of the operating system itself;
• All versions of Windows NT up to Windows XP: introduced multiple user-accounts, but in practice most users continued to function as an administrator for their normal operations. Further, some applications would require that the user be an administrator for some or all of their functions to work.^[5]
• Windows Vista: Microsoft developed Vista security firstly from the Limited User Account (LUA), then renamed the concept to User Account Protection (UAP) before finally shipping User Account Control (UAC).^[6] Introduced in Windows Vista, User Account Control (UAC) offers an approach to encourage «super-user when necessary». The key to UAC lies in its ability to elevate privileges without changing the user context (user «Bob» is still user «Bob»). As always, it is difficult to introduce new security features without breaking compatibility with existing applications.
  • When someone logs into Vista as a standard user, the system sets up a logon session and assigns a token containing only the most basic privileges. In this way, the new logon session cannot make changes that would affect the entire system.
  • When a person logs in as a user with membership in the Administrators group, the system assigns two separate tokens: the first token contains all privileges typically awarded to an administrator, and the second is a restricted token similar to what a standard user would receive.
    • User applications, including the Windows Shell, then start with the restricted token, resulting in a reduced-privilege environment – even when running under an Administrator account.
    • When an application requests higher privileges or when a user selects a «Run as administrator» option, UAC will prompt standard users to enter the credentials of an Administrator account and prompt Administrators for confirmation and, if consent is given, continue or start the process using an unrestricted token.^[7]
• Windows 7: Microsoft included a user interface to change User Account Control settings, and introduced one new notification mode: the default setting. By default, UAC does not prompt for consent when users make changes to Windows settings that require elevated permission through programs stored in %SystemRoot% and digitally signed by Microsoft. Programs that require permission to run still trigger a prompt. Other User Account Control settings that can be changed through the new UI could have been accessed through the registry in Windows Vista.^[8]
• Windows 8 and 8.1: add a design change. When UAC is triggered, all applications and the taskbar are hidden when the desktop is dimmed.
• Windows 10: copies the same layout as Windows 8 and 8.1, but the Anniversary Update has a more modern look. Also, Windows 10 adds support for Windows Hello in the User Account Control dialog box.

Tasks that trigger a UAC prompt[edit]

Tasks that require administrator privileges will trigger a UAC prompt (if UAC is enabled); they are typically marked by a security shield icon with the 4 colors of the Windows logo (in Vista and Windows Server 2008) or with two panels yellow and two blue (Windows 7, Windows Server 2008 R2 and later). In the case of executable files, the icon will have a security shield overlay. The following tasks require administrator privileges:^[9][10]

• Running an Application as an Administrator
• Changes to system-wide settings
• Changes to files in folders that standard users don’t have permissions for (such as %SystemRoot% or %ProgramFiles% in most cases)
• Changes to an access control list (ACL), commonly referred to as file or folder permissions
• Installing and uninstalling applications outside of:
  • The %USERPROFILE% (e.g. C:Users{logged in user}) folder and its sub-folders.
    • Most of the time this is in %APPDATA%. (e.g. C:Users{logged in user}AppData), by default, this is a hidden folder.
      • Chrome’s and Firefox’s installer ask for admin rights during install, if given, Chrome will install in the Program Files folder and be usable for all users, if denied, Chrome will install in the %APPDATA% folder instead and only be usable by the current user.
  • The Microsoft Store.
  • The folder of the installer and its sub-folders.
    • Steam installs its games in the /steamapps/ sub-folder, thus not prompting UAC. Some games require prerequisites to be installed, which may prompt UAC.
• Installing device drivers
• Installing ActiveX controls
• Changing settings for Windows Firewall
• Changing UAC settings
• Configuring Windows Update
• Adding or removing user accounts
• Changing a user’s account name or type
• Creating a new account or deleting a user account
• Turning on Guest account (Windows 7 to 8.1)
• Turning on network discovery, file and printer sharing, Public folder sharing, turning off password protected sharing or turning on media streaming
• Configuring Parental Controls (in Windows 7) or Family Safety (Windows 8.1)
• Running Task Scheduler
• Backing up and restoring folders and files
• Merging and deleting network locations
• Turning on or cleaning logging in Remote Access Preferences
• Running Color Calibration
• Changing remote, system protection or advanced system settings
• Restoring backed-up system files
• Viewing or changing another user’s folders and files
• Running Disk Defragmenter, System Restore or Windows Easy Transfer (Windows 7 to 8.1)
• Running Registry Editor
• Running the Windows Experience Index assessment
• Troubleshoot audio recording and playing, hardware / devices and power use
• Change power settings, turning off Windows features, uninstall, change or repair a program
• Change date and time and synchronizing with an Internet time server
• Installing and uninstalling display languages
• Change Ease of Access administrative settings

Common tasks, such as changing the time zone, do not require administrator privileges^[11] (although changing the system time itself does, since the system time is commonly used in security protocols such as Kerberos). A number of tasks that required administrator privileges in earlier versions of Windows, such as installing critical Windows updates, no longer require administrator privileges in Vista.^[12] Any program can be run as administrator by right-clicking its icon and clicking «Run as administrator», except MSI or MSU packages as, due to their nature, if administrator rights will be required a prompt will usually be shown. Should this fail, the only workaround is to run a Command Prompt as an administrator and launch the MSI or MSP package from there.

Features[edit]

User Account Control asks for credentials in a Secure Desktop mode, where the entire screen is temporarily dimmed, Windows Aero disabled, and only the authorization window at full brightness, to present only the elevation user interface (UI). Normal applications cannot interact with the Secure Desktop. This helps prevent spoofing, such as overlaying different text or graphics on top of the elevation request, or tweaking the mouse pointer to click the confirmation button when that’s not what the user intended.^[13] If an administrative activity comes from a minimized application, the secure desktop request will also be minimized so as to prevent the focus from being lost. It is possible to disable Secure Desktop, though this is inadvisable from a security perspective.^[14]

In earlier versions of Windows, Applications written with the assumption that the user will be running with administrator privileges experienced problems when run from limited user accounts, often because they attempted to write to machine-wide or system directories (such as Program Files) or registry keys (notably HKLM).^[5] UAC attempts to alleviate this using File and Registry Virtualization, which redirects writes (and subsequent reads) to a per-user location within the user’s profile. For example, if an application attempts to write to a directory such as «C:Program Filesappnamesettings.ini» to which the user does not have write permission, the write will be redirected to «C:UsersusernameAppDataLocalVirtualStoreProgram Filesappnamesettings.ini». The redirection feature is only provided for non-elevated 32-bit applications, and only if they do not include a manifest that requests specific privileges.^[15]

There are a number of configurable UAC settings. It is possible to:^[16]

• Require administrators to re-enter their password for heightened security,
• Require the user to press Ctrl+Alt+Del as part of the authentication process for heightened security;
• Disable only file and registry virtualization^[17]
• Disable Admin Approval Mode (UAC prompts for administrators) entirely; note that, while this disables the UAC confirmation dialogs, it does not disable Windows’ built-in LUA feature, which means that users, even those marked as administrators, are still limited users with no true administrative access.

Command Prompt windows that are running elevated will prefix the title of the window with the word «Administrator», so that a user can discern which instances are running with elevated privileges.^[18]

A distinction is made between elevation requests from a signed executable and an unsigned executable; and if the former, whether the publisher is ‘Windows Vista’. The color, icon, and wording of the prompts are different in each case; for example, attempting to convey a greater sense of warning if the executable is unsigned than if not.^[19]

Internet Explorer 7’s «Protected Mode» feature uses UAC to run with a ‘low’ integrity level (a Standard user token has an integrity level of ‘medium’; an elevated (Administrator) token has an integrity level of ‘high’). As such, it effectively runs in a sandbox, unable to write to most of the system (apart from the Temporary Internet Files folder) without elevating via UAC.^[7][20] Since toolbars and ActiveX controls run within the Internet Explorer process, they will run with low privileges as well, and will be severely limited in what damage they can do to the system.^[21]

Requesting elevation[edit]

A program can request elevation in a number of different ways. One way for program developers is to add a requestedPrivileges section to an XML document, known as the manifest, that is then embedded into the application. A manifest can specify dependencies, visual styles, and now the appropriate security context:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="highestAvailable" />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Setting the level attribute for requestedExecutionLevel to «asInvoker» will make the application run with the token that started it, «highestAvailable» will present a UAC prompt for administrators and run with the usual reduced privileges for standard users, and «requireAdministrator» will require elevation.^[22] In both highestAvailable and requireAdministrator modes, failure to provide confirmation results in the program not being launched.

An executable that is marked as «requireAdministrator» in its manifest cannot be started from a non-elevated process using CreateProcess(). Instead, ERROR_ELEVATION_REQUIRED will be returned. ShellExecute() or ShellExecuteEx() must be used instead. If an HWND is not supplied, then the dialog will show up as a blinking item in the taskbar.

Inspecting an executable’s manifest to determine if it requires elevation is not recommended, as elevation may be required for other reasons (setup executables, application compatibility). However, it is possible to programmatically detect if an executable will require elevation by using CreateProcess() and setting the dwCreationFlags parameter to CREATE_SUSPENDED. If elevation is required, then ERROR_ELEVATION_REQUIRED will be returned.^[23] If elevation is not required, a success return code will be returned at which point one can use TerminateProcess() on the newly created, suspended process. This will not allow one to detect that an executable requires elevation if one is already executing in an elevated process, however.

A new process with elevated privileges can be spawned from within a .NET application using the «runas» verb. An example using C#:

System.Diagnostics.Process proc = new System.Diagnostics.Process();
proc.StartInfo.FileName = "C:\Windows\system32\notepad.exe";
proc.StartInfo.Verb = "runas"; // Elevate the application
proc.StartInfo.UseShellExecute = true;
proc.Start();

In a native Win32 application the same «runas» verb can be added to a ShellExecute() or ShellExecuteEx() call:^[7]

ShellExecute(hwnd, "runas", "C:\Windows\Notepad.exe", 0, 0, SW_SHOWNORMAL);

In the absence of a specific directive stating what privileges the application requests, UAC will apply heuristics, to determine whether or not the application needs administrator privileges. For example, if UAC detects that the application is a setup program, from clues such as the filename, versioning fields, or the presence of certain sequences of bytes within the executable, in the absence of a manifest it will assume that the application needs administrator privileges.^[24]

Security[edit]

UAC is a convenience feature; it neither introduces a security boundary nor prevents execution of malware.^{[25][26][27][28]}

Leo Davidson discovered that Microsoft weakened UAC in Windows 7 through exemption of about 70 Windows programs from displaying a UAC prompt and presented a proof of concept for a privilege escalation.^[29]

Stefan Kanthak presented a proof of concept for a privilege escalation via UAC’s installer detection and IExpress installers.^[30]

Stefan Kanthak presented another proof of concept for arbitrary code execution as well as privilege escalation via UAC’s auto-elevation and binary planting.^[31]

Criticism[edit]

There have been complaints that UAC notifications slow down various tasks on the computer such as the initial installation of software onto Windows Vista.^[32] It is possible to turn off UAC while installing software, and re-enable it at a later time.^[33] However, this is not recommended since, as File & Registry Virtualization is only active when UAC is turned on, user settings and configuration files may be installed to a different place (a system directory rather than a user-specific directory) if UAC is switched off than they would be otherwise.^[14] Also Internet Explorer 7’s «Protected Mode», whereby the browser runs in a sandbox with lower privileges than the standard user, relies on UAC; and will not function if UAC is disabled.^[20]

Yankee Group analyst Andrew Jaquith said, six months before Vista was released, that «while the new security system shows promise, it is far too chatty and annoying.»^[34] By the time Windows Vista was released in November 2006, Microsoft had drastically reduced the number of operating system tasks that triggered UAC prompts, and added file and registry virtualization to reduce the number of legacy applications that triggered UAC prompts.^[5] However, David Cross, a product unit manager at Microsoft, stated during the RSA Conference 2008 that UAC was in fact designed to «annoy users,» and force independent software vendors to make their programs more secure so that UAC prompts would not be triggered.^[35] Software written for Windows XP, and many peripherals, would no longer work in Windows Vista or 7 due to the extensive changes made in the introduction of UAC. The compatibility options were also insufficient. In response to these criticisms, Microsoft altered UAC activity in Windows 7. For example, by default users are not prompted to confirm many actions initiated with the mouse and keyboard alone such as operating Control Panel applets.

In a controversial article, New York Times Gadgetwise writer Paul Boutin said «Turn off Vista’s overly protective User Account Control. Those pop-ups are like having your mother hover over your shoulder while you work.»^[36] Computerworld journalist Preston Gralla described the NYT article as «…one of the worst pieces of technical advice ever issued.»^[37]

See also[edit]

• Comparison of privilege authorization features
• Features new to Windows Vista
• Polkit
• runas
• Secure attention key (SAK)
• Security and safety features new to Windows Vista
• sudo – A similar feature in UNIX-like operating systems

References[edit]

External links[edit]

• Turning UAC On or Off in Windows 7
• Documentation about UAC for Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista
• UAC Understanding and Configuring More Information at Microsoft Technet
• Development Requirements for User Account Control Compatibility More information at Microsoft Developer Network
• UAC Team Blog

В Windows множество средств защиты от внесения нежелательных изменений в настройки компьютера, реестр и другие параметры, которые могут кардинальным образом сказаться на работоспособности операционной системы. Одним из таких средств защиты является контроль учетных записей (UAC). Как это часто бывает с подобными системными функциями, при всей своей пользе они могут надоедать, постоянно напоминая о себе, что может мешать пользователю при работе с компьютером. В рамках данной статьи мы рассмотрим, как отключить контроль учетных записей в Windows 10 и более ранних версиях операционной системы.

Что такое контроль учетных записей (UAC) в Windows

Контроль учетных записей – это утилита по безопасности, встроенная в операционную систему Windows. Впервые она появилась в Windows Vista, и сохраняется в современных вариациях системы, вплоть до Windows 10. Отключение утилиты контроля учетных записей серьезно снизит уровень защиты компьютера, поэтому выполнять данные действия необходимо осознанно.

Данная утилита проявляет себя окном, которое возникает при установке на компьютер программы или игры, а также при внесении кардинальных изменений в настройки компьютера. Пользователю сообщается, что при инсталляции данного файла издатель может внести необратимые изменения в работу компьютера, что небезопасно. В зависимости от настройки UAC, утилита может срабатывать на все приложения или, например, только на подозрительные программы от непроверенных издателей.

Грамотное использование функции контроля учетных записей Windows позволяет защитить компьютер от проникновения вирусных приложений, программ-шпионов, троянов, malware и adware программ и так далее.

Как настроить контроль учетных записей в Windows 10

Контроль учетных записей в Windows рекомендуется отключать только в крайних случаях, гораздо лучше данную опцию настроить, чтобы она напоминала о своем присутствии только тогда, когда имеется действительно реальная угроза заражения. По умолчанию в Windows утилита выставлена на высокий уровень защиты, но это легко исправить.

Чтобы настроить контроль учетных записей в Windows 10, нажмите правой кнопкой мыши по меню пуск и во всплывающем окне выберите «Панель управления». В верхней части окна установите режим просмотра «Значки» и перейдите к пункту «Учетные записи пользователей».

Откроется окно, где необходимо выбрать пункт «Изменить параметры контроля учетных записей».

После этого откроется окно, где и происходит настройка утилиты контроля учетных записей. Всего работать система безопасности может в 4 режимах:

• Максимальный. В данном режиме пользователя будут уведомлять обо всех попытках приложений установиться на компьютер, а также обо всех ситуациях, когда вносятся серьезные изменения в настройки операционной системы. Если установить данный режим, то пользователи без прав администратора для внесения подобных серьезных изменений должны будут вводить специальный пароль. Администраторам компьютера будет достаточно просто подтверждать свое желание выполнить установку/настройку приложения или системы.
• Высокий. При внесении изменений в параметры Windows со стороны пользователя, он не будет получать соответствующее уведомление. Контроль учетных записей будет срабатывать в ситуации, когда изменения в систему могут быть внесены в результате установки/работы определенного приложения.
• Средний. Данный пункт отличается от высокого уровня защиты только тем, что при предупреждении пользователя о попытке со стороны приложения внести изменения в параметры системы, рабочий стол не будет затемняться. Данный вариант рекомендуется выбирать только в тех ситуациях, когда затемнение рабочего стола занимает много времени, например, на малопроизводительных компьютерах.
• Низкий. Полное отключение контроля учетных записей. Пользователя не будут уведомлять о его самостоятельных попытках внести изменения в настройки Windows, а также о попытках это сделать со стороны приложений.

Обратите внимание: Снижая уровень контроля учетных записей до минимального, возникает риск внесения сторонними приложениями необратимых последствий в параметры Windows. В том числе это чревато потерей данных.

Как отключить контроль учетных записей в Windows 10 через реестр

Все параметры контроля учетных записей можно настроить через реестр, если по каким-то причинам не подходит вариант настройки через «Панель управления», описанный выше. Чтобы настроить через реестр, нужно запустить реестр, нажав на клавиатуре сочетание Windows+R и прописав команду regedit. Далее в реестре проследуйте по следующему пути:

HKEY_LOCAL_MACHINE SOFTWARE Microsoft Windows CurrentVersion Policies System

В правой части окна реестра будет множество параметров. За работу функции контроля учетных записей отвечают следующие 3 параметра:  PromptOnSecureDesktop, EnableLUA, ConsentPromptBehaviorAdmin. Соответственно, от их настройки будет зависеть итоговая работа утилиты. Чтобы настроить параметр, нужно нажать на него дважды левой кнопкой мыши и ввести соответствующие значения.

Приведем базовые значения для различных уровней безопасности контроля учетных записей:

• Максимальный – 1, 1, 2;
• Высокий – 1, 1, 5;
• Средний – 0,1, 5;
• Низкий – 0, 1, 0.

Важно: Удалять данные параметры реестра запрещено. При их удалении возможна некорректная работа системы.

Загрузка…

Для того чтобы ответить на вопрос, как включить или отключить контроль учётных записей в Windows, нужно понять, что это такое. UAC — это защитная опция операционной системы, поддерживаемая всеми последними версиями Windows (Vista, 7, 8, 10). Независимо от того, какую учётную запись использует пользователь, система выдаёт запрос о разрешении запускаемому приложению внести изменения.

Если владелец ПК Администратор, то он может разрешить или нет этой программе войти в ОС и изменить параметры, лишь нажав кнопки «Да» или «Нет». В ином случае придётся вводить пароль. Причины для отключения контроля учётных данных могут быть разные, но иногда это действительно необходимо.

На что нужно обратить внимание при появлении консоли

При загрузке приложения в появившемся окне уведомления 10 ОС имеется информация об имени программы, её издателе и источнике файла. Всё это даёт полную картину о запускаемом софте. Поэтому, когда приложение не имеет названия, у пользователей должен возникнуть вопрос о его «добропорядочности». Таким образом, вместе с установочным файлом очень часто проникают и вирусы. Если же программа проверена или вы полагаетесь на антивирус, в любом случае есть возможность отключить защиту.

ВАЖНО. UAC в системе Windows 10 включён по умолчанию. После его отключения всегда можно включить контроль заново. 

Отключение контрольной функции

Способ 1.

Чтобы вызвать уведомление контроля в Windows 10, можно попробовать загрузить установочный файл любой простой программки, например, Media Player. Для этого у пользователей должен быть доступ к записи Администратором. В нижнем правом углу появившегося сообщения щёлкнуть по «Настройке выдачи таких уведомлений». Отредактировать функцию по своему усмотрению.

Способ 2.

В меню «Пуск» ввести слово «UAC». Далее выбрать «Изменение параметров контроля учётных записей». В настройках сообщения установить селектор на нижний уровень «Никогда не уведомлять».

Способ 3.

В меню «Пуск» найти вкладку «Панель управления». В правой части окна открыть «маленькие значки» и выбрать строчку «Учётные записи пользователей». Затем нажать на пункт «Изменить параметры контроля учётных записей». Также настроить работу опции или вовсе отключить её.

Способ 4.

На клавиатуре набрать Win+R. В открывшейся консоли прописать «UserAccountControlSetting» и ввод. В появившихся параметрах произвести отключение опции.

Способ 5.

Кликнуть по клавишам Win+R. В окне «Выполнить» ввести слово «regedit» и «ок». В левой части редактора реестра найти «Sistem». В открывшейся правой консоли кликнуть двойным нажатием мыши по надписи «EnableLUA». В появившемся окошке поменять значение «1» на «0» и «ок». Для сохранения изменений выскочит уведомление о перезагрузке компьютера.

Для того чтобы включить контрольную защиту в ОС Windows 10, в его настройках следует вернуть селектор в исходное положение. Также можно настроить функцию под свои параметры, где наилучшим вариантом может считаться второе положение селектора сверху.

Что означают 4 положения UAC

1. Всегда уведомлять — самый безопасный и оптимальный вариант. То есть любое несанкционированное действие программы будет вызывать появление окна с уведомлением.
2. Уведомлять при попытке приложения внести изменения (по умолчанию). Обычно включается при загрузке программы.
3. Уведомлять о внесении изменений без затемнения и блокировки экрана. Такое положение не препятствует вторжению троянов.
4. Не уведомлять никогда, то есть полное отключение функции.

Если всё же было решено отключить защитную опцию в Windows 10, следует быть готовым к атакам вредоносного ПО. В этом случае нужно быть особо внимательным к запускаемым приложениям, так как они имеют такой же доступ к информации на компьютере, как и у пользователей с правами Администратора. Поэтому, если вы отключили UAC только для того, чтобы он не мешал, то это очень неправильная тактика. В этом случае лучше установить защитную функцию по умолчанию.

Друзья, контроль учётных записей – это та функция, которая разграничивает тип учётных записей администратора и обычного пользователя. Последний без пароля от учётной записи администратора не сможет запустить не только программу, которая сама изначально для инсталляции или запуска требует разрешение UAC, но любую программу, которая такого разрешения изначально не требует. Для этого в её свойствах необходимо настроить запуск от имени администратора.
И тогда, будучи администратором компьютера, мы сможем контролировать запуск таких программ пользователями, работающими с обычной учётной записи. Им каждый раз для запуска таких программ потребуется наше присутствие, дабы мы ввели пароль от своей учётной записи администратора. И вот таким образом UAC нас также защищает от неопытных действий пользователей, а, возможно, даже их действий осознано злонамеренных.

А как выполнить отключение UAC? Эта функция крайне полезна для новичков в компьютерном деле, опытные же пользователи в ней обычно не нуждаются. Опытные, продолжая ей пользоваться, будут попросту тратить время на выполнение рутинных операций по отдаче разрешения UAC каждый раз при запуске любой мало-мальски значимой программы. Если вы, друзья, достаточно опытны, чтобы распознать вредоносное ПО и не запускать его, можете отключить UAC.

Отключение UAC – это выставление ползунка на уровне уведомлений этой функции в самый низ, т.е. на первый уровень. Выставляем, жмём «Ок», подтверждаем внесение настроек с правами администратора.
И всё: более в учётной записи администратора окно запроса UAC мы не увидим. Однако, друзья, в чём плюс этой функции: отключение UAC будет применено только для администратора. В обычных учётных записях Windows окно UAC при инсталляции или запуске программ, требующих прав администратора, будет по-прежнему появляться. И таким образом, если у нас на компьютере есть пользователи с обычными учётными записями, мы всё равно сможем контролировать их. Без нашего пароля они не смогут запустить ни одну серьёзную программу.