Windows 7 UAC

The thing is, until post #8 we didn't know how user tradetime was running. In that same post he/she said to be running as a standard user. Therefore, you couldn't just say that unless the user runs IE, that UAC is useless.

If you are an admin the virtualization is essentially useless. Yes.*
If you are a limited user, it isn't. Right? Right.

* Although, as user xxJackxx pointed out, you may run into issues if you disable UAC, once the applications have created their data in the virtualized file system and registry. I don't know how far the issues could go. So, if you (=anyone) had UAC enabled before, leave it enabled, even if just for virtualization and to keep things working... just in case.

 

I had assumed they were running according to the typical windows installation. You are correct that running as a limited user would see benefits from virtualization - I had not thought of that.

 

Though it appears that the machine "pauses" when prompted, it does not actually happen. Everything in the background running continues to do so. It just does not update the screen. If you want to see an example start a download and then start CCleaner and let it sit at the UAC prompt for a few seconds. Then click either Yes or No and see that your download still progressed while it was waiting for you to answer the prompt.

Also, if something initiates a prompt while you are away from the machine (not likely) the UAC prompt only hangs around for about 30 seconds (a guess, I have not actually timed it). After that it assumes no and just times out. It does not wait forever for an OK.

-Also, this unnamed program you say "falls foul of it", do you know what it is trying to do? If it is trying to write to an area that does not have permission to the standard user, you may consider give the standard user account write permission to that resource, if it is reasonably safe to do so.

 

If you really want to bypass UAC, while still running as a standard user, you could give BeyondTrust PowerBroker Desktops a try.

-http://www.beyondtrust.com/Products/PowerBroker-Desktops-Windows-Edition/

I haven't used it, yet. So, I don't know all of its potential, but take a look at the website.

 

Hi guys, thanks once again for all the input, appologies for not providing enough info, I saw a similar question asked on another forum

and the answer.....

However that does not stop popups in my test case of ccleaner, but I thought the solution to my problem would be equally simple...but work.

So I'll endevour to fill in any blanks that people haven't worked out yet.

Just been using Windows 7 Home Prem 64 on a new machine for a couple of days, so still getting familiar. still using XP 32bit and Vista 64 on other machines. I'm no computer expert, as I'm sure most of you have already worked out.

My computers are mainly "working computers" that is to say, not used for surfing dodgy sites etc. They run various derivative trading programs 24 hrs a day 5 days a week, as such they operate unattended for periods of time, (ie it's 3am here and I've just got up, as was catching a few hours sleep, hence leaving you guys to chat amonst yourselves for a while)
Anyways, I noticed that some programs initiate UAC popups, and windows seems to "pause" until the user responds. One such program so far, is GFT's Dealbook 360 platform. (That's a trading platform for Global Forex and Futures) So I think to myself wouldn't it be nice if I could make an exception for this program and any others like it.
Now I don't know exactly what it is doing that windows doesn't like, but I don't care as long as it is allowed to do what it wants to do when it wants to do it. I figured since I trust these programs, rather than spend the next few weeks discovering that they variously fall foul of windows, I could just give them permission to do whatever it is they want, and be done with it. Whilst keeping UAC around for all those programs that I might not want to do whatever they want

 

Thanks m00nbl00d, I will have a look at that.

 

Put it in quiet mode. You don't want UAC off because of virtualization which has been discussed and if using IE you lose protected mode. If you don't want the popups, best bet is to stick it into quiet mode, UAC protection without the popups. hxxp://www.tweak-uac.com/home/

 

Unfortunately, the user has stated to be running as a standard user; therefore, configuring UAC in quiet mode won't have any effect. It only affects (protected) administrator accounts.

The best bet would be the tool I previously mentioned. That's the free version.

Another possible solution, if one won't require the software in question to interact with the user, is to schedule a task to run that application has an administrator.
It will work. But, if you do require some sort of interaction with it, then you're out of luck.

 

btw one of the reasons microsoft introduced UAC was to force developers to create applications that worked with standard user accounts. if you use an application that you feel shouldn't need administrator rights then contact the developers to sort out the issue.

 

It would be easy enough to change the account type to Administrator.

 

Easy, yes. The solution? Not really, IMHO.

Sure, anyone can run in a protected administrator account, using UAC that way, but the user should have knowledge on how to tweak the operating system to mitigate the danger of running UAC that way; or use third-party applications that would do the work, which would also require knowledge to operate them.

If UAC Virtualization is the only thing one would care about... why not, right?

But now, that you actually mentioned it, it got me to think about something...

@ tradetimer

I don't know if the application you're working with truly needs administrator privileges or if it simply wasn't coded from scratch to work with reduced rights and it's trying to save configuration settings, etc into secure locations, where a standard user has no access.

So, you could try the following...

1. Go to the Start Menu and type regedit. Open it.
2. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers.
3. Right-click that entry and Export to create a backup of that entry;
4. Then right-click the right pane, and create a new Chain Value (I'm not on a english Windows, so it may differ from what I said.). You should get a new REG_SZ type value.
5. Go to the application's folder and right-click the main process name and choose Copy as path.
6. Right-click the REG_SZ entry previously created and Modify name. Paste the path of step 5. into there. Make sure you remove the quotes ("") from the path. Press Enter.
7. Right-click it again and click Modify....
8. Type RUNASINVOKER in step 7. Press Enter.

What this will do, if the application doesn't do it by default, is to make it use UAC Virtualization. If all the applications needs is to store settings, and that kind of stuff, then UAC Virtualization should take care of it, and the application would no longer ask for administrator privileges. That's what should happen, anyway.

Unless the application needs to load some driver, which in that case it truly needs administrator privileges.

I suppose you won't lose anything if you try it. If the application fails to run, just delete the REG_SZ entry.

Hopefully all the application needs is store/modifiy configuration.