Single account for admin/non-admin use?

[littlebigman]

Hello

I reinstalled someone's Vista host the other day. To increase the odds of her computer remaining safe from viruses, I created two user accounts ("admin" and "jane"), and told her to use the former only when she wanted to perform major activities like installing a new application or updating Vista.

Unfortunately, she found this confusing, and ultimately, decided on 1) upgrading "jane" into an admin account, and removing "admin" entirely, and 2) installing an antivirus. I told her she was on her own and not to call me if her Vista host got hosed again ;-)

... which brings me to ask the questions:

1. What is the purpose of UAC, since it's triggered even when logged on as admin?

2. From what I remember, MacOS uses "sudo" so that users are prompted for the admin's password when performing sensitive tasks: Is there an equivalent for Windows, so that users only have to use a single account and avoid getting confused?

Thank you.

[MANEMAN]

so that users only have to use a single account and avoid getting confused?

There is a very high percentage of people who if you give them just about anything to "use" will fast become confused.

I'm not just being cynical here. - Unfortunately It's a truth.

1. What is the purpose of UAC, since it's triggered even when logged on as admin?

Question 1: The best and safest way to answer this is to take the Microsoft line on the subject. - In that way you can never be wrong.

"As a Consumer Support Technician, it’s likely that you’ve heard about the User Account Control (UAC) feature of Windows Vista. The primary purpose of UAC is to ensure that users and applications are granted the lowest level of permission they require to complete their tasks. The benefits include ensuring that people and programs cannot make potentially disastrous changes to their systems."

If anyone wants even more information, head them off over to the "Technet Library", where they can get a full breakdown about Vista and the UAC process. ( http://technet.micro...y/cc505883.aspx )

2. From what I remember, MacOS uses "sudo" so that users are prompted for the admin's password when performing sensitive tasks: Is there an equivalent for Windows, so that users only have to use a single account and avoid getting confused?

Question 2: "Runas" is the closest equivalent for Windows, though how explaining this to the average computer user would avoid them becoming confused is questionable.

I have found with the "confused" the easiest way around the problem is to install something like, Returnil, Time Freeze, or Shadow Defender on their computer and then password lock it so that they cannot turn it off. Any write action on their part then becomes "Virtual."

They are then unleashed to press every single button on the internet that says "Free", alter every important setting of the Windows operating system that is required for smooth running, and let their kids run riot on the thing. - A simple reboot and they are presented with the same clean computer that they had before they went on a rampage of destruction.

Any Major system changes or application installations are done by me(or hopefully someone similarly "not confused") by remote, and a short and swift exchange of conversation by telephone.

There comes a time when you have to ask yourself " If I really want to deal with confused people all of the time, why dont I just go help dementia or alzheimers patients ? " :)

If you would like a less cynical look at the world of servicing and computer repair, try heading off over on the following link: http://www.technibble.com/

Thanks for the post.

John.

[MANEMAN]

I just remembered this article from the same website. :)

http://www.technibbl...pair-customers/

[littlebigman]

As a Consumer Support Technician, it’s likely that you’ve heard about the User Account Control (UAC) feature of Windows Vista. The primary purpose of UAC is to ensure that users and applications are granted the lowest level of permission they require to complete their tasks. The benefits include ensuring that people and programs cannot make potentially disastrous changes to their systems.

"When logging into Vista as a standard user, a logon session is created and a token containing only the most basic privileges is assigned. In this way, the new logon session is incapable of making changes that would affect the entire system. When logging in as a user in the Administrators group, two separate tokens are assigned. The first token contains all privileges typically awarded to an administrator, and the second is a restricted token similar to what a standard user would receive. User applications, including the Windows Shell, are then started with the restricted token, resulting in a reduced privilege environment even under an Administrator account. When an application requests higher privileges or "Run as administrator" is clicked, UAC will prompt for confirmation and, if consent is given, start the process using the unrestricted token.[5]"

/>http://en.wikipedia.org/wiki/User_Account_Control

"Runas" is the closest equivalent for Windows, though how explaining this to the average computer user would avoid them becoming confused is questionable.

How do Mac users handle this? I worked with a Mac once, and when I needed to perform a task that required admin rights, I was simply prompted for the admin password. I wonder if Mac users find this confusing or not.

the "confused" the easiest way around the problem is to install something like, Returnil, Time Freeze, or Shadow Defender on their computer and then password lock it so that they cannot turn it off. Any write action on their part then becomes "Virtual."

I didn't know about those utilies. I'll check them out.

Thanks.

[MANEMAN]

Thanks for coming back with a reply. Many dont even bother.

Much appreciated.

Here are the links.

http://www.returnilvirtualsystem.com/

http://www.wondersha...ime-freeze.html

http://www.toolwiz.c...iz-time-freeze/

http://www.shadowdefender.com/

"I wonder if Mac users find this confusing or not."

Probably not. The Mac user purchases because he/she usually has a purpose in mind when buying their machine.

The Windows PC user most times purchases, and then tries to find a purpose for using it to justify the cost.

Lower percentage of confused amongst the Mac users because they didn't start out as being confused at the time of purchase in the first place.

It's fine quoting from Wikipedia but you should remember that some of the people who put that stuff together are confused. Whereas if you use just quotes from Microsoft articles..................... ?.......... Yeah ! ................... OK I get the point. :)

Hey ! Why are you quoting to me Wikipedia on UAC anyway, when you were the one who asked the question about it in the first place ? :lol:

All the best my friend. Keep sharp, and keep smiling amongst the crazies.

John.

[MANEMAN]

I have actually found a script which offers to implement a similar workability in Windows that "sudo" does in the Mac environment.

Start notepad.exe and copy the following text into a new text file and save it as sudo.cmd:

@echo Set objShell = CreateObject("Shell.Application") > %temp%\sudo.tmp.vbs
@echo args = Right("%*", (Len("%*") - Len("%1"))) >> %temp%\sudo.tmp.vbs
@echo objShell.ShellExecute "%1", args, "", "runas" >> %temp%\sudo.tmp.vbs
@cscript %temp%\sudo.tmp.vbs

Copy now to your Windows folder.

Now you can to easily start a command prompt with admin rights. (edited after original posting)

sudo cmd.exe

The only caveat to all or some of this it seems is:

Runas, su, and sudo.

Windows has a command runas which has similar functionality, but neither runas nor UAC are sudo, they impersonate another user rather than privilege escalation.

Runas and su:

* do not allow authorized users to launch processes with elevated privileges using their own passphrase.

* do not preserve the user's profile and ownership of created objects.

The runas command is (more or less) equivalent to Unix su, not sudo. The reason sudo is superior to su is that it allows privilege escalation based on the user’s own identity, and most importantly does not require use of a shared password. Using runas or su to access a privileged account requires distribution of a password to an admin-capable account, a security weakness that sudo does not have.

Dont ask me about it. Or shoot me, for I am only the messenger.

I shall never use it, I prefer to virtualize. If anyone wishes to experiment with it and report back though I would be interested.

Perhaps "littlebigman" would do the honours ?

John.

[littlebigman]

Thanks for the infos. I'm confused about user accounts, privilege escalation, UAC, etc. Looks like I'll have to do more reading to find out if it's possible to only keep one user account, and escalate as admin when necessary.