January 30th, 2009

Microsoft neuters UAC in Windows 7

Posted by Adrian Kingsley-Hughes @ 3:45 am

Categories: Windows 7

Tags: Microsoft Windows 7, Microsoft Corp., UAC, Microsoft Windows, Operating Systems, Software, Adrian Kingsley-Hughes

In an attempt to make Windows 7 generate fewer UAC (User Account Control) prompts Microsoft has neutered the mechanism to the point where it’s next to useless.

Here’s Long Zheng’s take on the issue:

The Achilles’ heel of this system is that changing UAC is also considered a “change to Windows settings”, coupled with the new default UAC security level, would not prompt you if changed. Even to disable UAC entirely.

Now you might not think that this is all that important since this setting cannot be changed unless the user chooses to do so. Wrong.

With the help of my developer side-kick Rafael Rivera, we came up with a fully functional proof-of-concept in VBScript (would be just as easy in C++ EXE) to do that - emulate a few keyboard inputs - without prompting UAC. You can download and try it out for yourself here, but bear in mind it actually does disable UAC.

Fortunately, there’s a simple workaround:

Until when Microsoft decides to fix this, if they do at all, beta users of Windows 7 can also apply a simple fix. Changing the UAC policy to “Always Notify” will force Windows 7 to notify you even if UAC settings change. Annoying, but safe.

What’s also annoying is that this issue has already been reported to Microsoft which claims that the way it works is “by design.” If that’s “by design” then it’s also bad design. I think that Microsoft’s gone too far to please the anti-UAC crowd with this change.