8

My last computer ran XP; administrators had unrestricted access (no UAC) and my normal day-to-day account was a standard user. I simply did a 'run as' then entered the admin credentials when I needed to do something such as install software. It made sense to have the day-to-day account be a limited one (like with Linux).

I've recently purchased a new Windows 8 computer. With User Account Control, when I am logged in as an administrator, UAC will pop up an allow/deny prompt if an application tries to make changes to the computer.

If I instead make my day-to-day account a standard account, when I do something that requires admin privileges, it will prompt me as well (but for a password and username). As both user accounts will prompt me anyway, is there any point to making my day to day account a standard one? What is the 'best' practice and do you all personally follow it?

1
  • 1
    Starting with Windows Vista certain actions like removing a file from a protected folder requires a UAC prompt. As you found this happens with an administrator or a user account. Unless you have your own reasons for running a restricted account the UAC will protect your computer from yourself provided you always read the prompt.
    – Ramhound
    Mar 14, 2013 at 11:20

3 Answers 3

4

UAC is not considered a security boundary. What this means is that there is only (relatively) weak protection preventing malicious software from "escaping" UAC and gaining administrator access. (In particular, Microsoft do not promise to fix issues that allow this to happen.)

Personally, I always use a standard user account on my home machine, except when I'm actually administering the computer.

7
  • Do you have any evidence of malware "escaping" UAC and Microsoft not doing anything about it? From all I know of windows getting around UAC is a pretty nasty privilege escalation and would most definitely be fixed. Mar 19, 2013 at 3:14
  • @ScottChamberlain: consider the case where malware injects itself into an unprivileged but well-known executable, such as Firefox or Adobe Flash, and causes that program to generate a false update notification. It is likely that a user would be tricked into granting elevation. This sort of approach allows malware to elevate while doing nothing that the Windows security model doesn't explicitly allow (although AV might catch it). Mar 19, 2013 at 3:44
  • I don't see how those two articles prove your point. Also your example is just as valid for a standard user account, however you would just need to type in the password instead of clicking the OK button. Mar 19, 2013 at 14:02
  • @ScottChamberlain: well, the first one contains the phrase "UAC is not a security boundary" which I thought proved my first sentence. The rest is mostly just a description of what "not a security boundary" means. Note also phrases like "Microsoft’s position that the reports about UAC do not constitute a vulnerability" and "Because elevations aren’t security boundaries, there’s no guarantee that malware running on a system with standard user rights can’t compromise an elevated process to gain administrative rights." Mar 20, 2013 at 0:18
4

When it comes to your personal computer(s), "best" practices tend to vary widely and are often ignored. Everyone uses their computer(s) differently at home and security is different as well. You should do what you feel is the best mix of security and convenience for you. What works for others, may be wrong for your situation.

Personally, all my users are administrator accounts on Windows, its just more convenient. If I were to have someone living with me and they had to use my computers, I would give them a standard account. I would also be more conscious to lock or log out of my computers.

And remember UAC prompts on a standard account, might be due to an application having admin privs, not the user.

7
  • It's always a good idea to make all your users "standard", and not "administrator". If there's any security vulnerability, the app will not have "god" access to your computer if it's a "standard" user.
    – Lizz
    Mar 16, 2013 at 6:55
  • sure you can follow security best practices at home. But for me, and probably most people, its not worth it.
    – Keltari
    Mar 16, 2013 at 19:44
  • @Keltari: do you use internet banking? If so, what measures do you take to prevent malware from interfering with it? Mar 21, 2013 at 5:01
  • @HarryJohnston - Yes I use internet banking. As for malware, I dont have any on my PC, so its a non-issue.
    – Keltari
    Mar 21, 2013 at 12:24
  • @Keltari: Hmmm. In a world where zero-day attacks are commonplace, and rootkits are very good at hiding themselves, how can you be so sure you don't have any malware on your PC? Or, if there isn't any there now, that there won't be any there tomorrow? Mar 21, 2013 at 18:38
1

Yes, especially if you're paranoid about physical security. Let me illustrate.

If you're logged in as an administrator with UAC on, you (personally, physically) have the ability to become a full administrator by going through an elevation dialog. Thus, anybody who walks up to your logged-on machine is an administrator.

Imagine you're giving a presentation from PowerPoint running on your laptop. Suddenly, somebody from the audience jumps up and shoves a USB device into your laptop. Weird stuff happens quickly on-screen, and the attacker flees the building. That USB device presented itself to the OS as a keyboard and typed bad things in. (And you can buy one of them for less than $50!) But how much damage did it do?

If you were actually logged in as a standard user, the worst it could have done was grab or modify the documents you have access to. If you were logged in as a UAC-protected admin, it could have created an administrative command prompt - Win+X, A, Alt+Y - and fundamentally altered the OS, maybe to insert a backdoor or spying program that affects everybody who uses the machine.

The only way to guarantee that a bad actor - either electronic or physical - can't become a local admin is to log in as a standard user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .