Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My last computer ran XP; administrators had unrestricted access (no UAC) and my normal day to day account was a standard user. I simply did a 'run as' then entered the admin credentials when I needed to do something such as install software. It made sense to have the day to day account a limited one (like with linux)

I've recently purchased a new Windows 8 computer. With User Account Control, when I am logged in as an administrator, UAC will pop up an allow/deny prompt if an application tries to make changes to the computer.

If I instead make my day to day account a standard account, when I do something that requires admin privileges, it will prompt me as well (but with a password and username). As both user accounts will prompt me anyway, is there any point to making my day to day account a standard one? What is 'best' practice and do you all personally follow it?

share|improve this question
    
+1You raise a good point... –  Canadian Luke Mar 14 '13 at 5:36
1  
Starting with Windows Vista certain actions like removing a file from a protected folder requires a UAC prompt. As you found this happens with an administrator or a user account. Unless you have your own reasons for running a restricted account the UAC will protect your computer from yourself provided you always read the prompt. –  Ramhound Mar 14 '13 at 11:20

2 Answers 2

up vote 3 down vote accepted

UAC is not considered a security boundary. What this means is that there is only (relatively) weak protection preventing malicious software from "escaping" UAC and gaining administrator access. (In particular, Microsoft do not promise to fix issues that allow this to happen.)

Personally, I always use a standard user account on my home machine, except when I'm actually administering the computer.

share|improve this answer
    
Do you have any evidence of malware "escaping" UAC and Microsoft not doing anything about it? From all I know of windows getting around UAC is a pretty nasty privilege escalation and would most definitely be fixed. –  Scott Chamberlain Mar 19 '13 at 3:14
    
    
@ScottChamberlain: consider the case where malware injects itself into an unprivileged but well-known executable, such as Firefox or Adobe Flash, and causes that program to generate a false update notification. It is likely that a user would be tricked into granting elevation. This sort of approach allows malware to elevate while doing nothing that the Windows security model doesn't explicitly allow (although AV might catch it). –  Harry Johnston Mar 19 '13 at 3:44
    
I don't see how those two articles prove your point. Also your example is just as valid for a standard user account, however you would just need to type in the password instead of clicking the OK button. –  Scott Chamberlain Mar 19 '13 at 14:02
    
@ScottChamberlain: well, the first one contains the phrase "UAC is not a security boundary" which I thought proved my first sentence. The rest is mostly just a description of what "not a security boundary" means. Note also phrases like "Microsoft’s position that the reports about UAC do not constitute a vulnerability" and "Because elevations aren’t security boundaries, there’s no guarantee that malware running on a system with standard user rights can’t compromise an elevated process to gain administrative rights." –  Harry Johnston Mar 20 '13 at 0:18

When it comes to your personal computer(s), "best" practices tend to vary widely and are often ignored. Everyone uses their computer(s) differently at home and security is different as well. You should do what you feel is the best mix of security and convenience for you. What works for others, may be wrong for your situation.

Personally, all my users are administrator accounts on Windows, its just more convenient. If I were to have someone living with me and they had to use my computers, I would give them a standard account. I would also be more conscious to lock or log out of my computers.

And remember UAC prompts on a standard account, might be due to an application having admin privs, not the user.

share|improve this answer
    
It's always a good idea to make all your users "standard", and not "administrator". If there's any security vulnerability, the app will not have "god" access to your computer if it's a "standard" user. –  Lizz Mar 16 '13 at 6:55
    
sure you can follow security best practices at home. But for me, and probably most people, its not worth it. –  Keltari Mar 16 '13 at 19:44
    
@Keltari: do you use internet banking? If so, what measures do you take to prevent malware from interfering with it? –  Harry Johnston Mar 21 '13 at 5:01
    
@HarryJohnston - Yes I use internet banking. As for malware, I dont have any on my PC, so its a non-issue. –  Keltari Mar 21 '13 at 12:24
    
@Keltari: Hmmm. In a world where zero-day attacks are commonplace, and rootkits are very good at hiding themselves, how can you be so sure you don't have any malware on your PC? Or, if there isn't any there now, that there won't be any there tomorrow? –  Harry Johnston Mar 21 '13 at 18:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.