5

Our small team of developers primarily uses Windows Vista. There has been some debate about the importance of Vista UAC (User Account Control).

How important is UAC for experienced users, particularly developers, who are not likely to do not-so-smart things like open executables in email attachments?

And second: if UAC is disabled after a considerable amount of time, will the change adversely impact any programs (e.g., settings in Eclipse, etc)?

Improve this question

5 Answers 5

Reset to default
9

As a developer, if you code for UAC to be in place then your code will work on everything. I'm in an environment where security is of great concern and we can't buy a product that doesn't play nice with UAC.

Improve this answer
1
  • 4
    +1; very very good point. Whether we like it or not, UAC is here to stay, and if developers have UAC enabled on their machines then they are more likely to write code that can work properly with UAC enabled on a user's machine.
    – Maximus Minimus
    Jun 10, 2009 at 14:27
7

I look at it this way... I'm a former security architect and incident response team lead. I've been a developer and a directory services administrator and infrastructure architect. Maybe I'm paranoid, but I run with UAC. There are too many zero days, too many legitimate sites getting hit, and too many new vectors out there for me to feel that I'm safe. It's also why I run with AdBlock Plus and NoScript on Firefox. Yes, it's an extra pain, but not as much as getting a system compromised and having to spend the time rebuilding it and reloading the apps.

I don't know that UAC changes any programs, per se, but it will impact how someone uses it and remembers what they have to do. A better solution is to go ahead and toggle those apps which need the rights (such as Visual Studio 2005) to run as Administrator from the start. Yes, you'll get the prompt, but then you have UAC on and still have the rights you need.

Improve this answer
2
  • A corollary question is: is it bad to disable the UAC prompting as by changing the settings in the local security policy? is this effectively disabling it, or just eliminating the popups. I've generally run with it, too, just to be on the safe side. Generally, the popups are not terribly annoying.
    – Jon St. John
    Jun 10, 2009 at 13:39
  • I leave the pop-ups on. If I know a certain operation shouldn't require a confirmation and I get one, of I get one when I'm not doing anything that would require it normally, I know something is up.
    – K. Brian Kelley
    Jun 10, 2009 at 13:42
5

How important is UAC for experienced users, particularly developers, who are not likely to do not-so-smart things like open executables in email attachments?

I have to take issue with the idea that experienced users won't do / are less likely to do dumb things. Plenty of admins and developers got tricked by the weekly outlook worm du jour a few years ago.

Remember, you can only be "betrayed" by someone you trust. I trust myself and I don't run with rights I don't need.

I'm not sure if disabling UAC after a while will impact programs compared to turning it off straight away, but there are issues with programs behaving in unpredictable ways with UAC turned off.

Improve this answer
1
  • 4
    I have to second this, I although in a lot of ways basically knowing what I am doing, end up being lax about things. I have gone from not have much security or even anti virus, to runing all the basic protection programs and more (anti vir, adaware, spybot etc...) I recently got infected with something, quite possibly through a website that was flagged to me by good and firefox as being dodgy. I know I'm an idiot for ignoring it, but there are some crazy exploits out there these days. Checkout the "security now" podcast, espectially the confiker episode 193.
    – optician
    Jun 10, 2009 at 14:33
3

Run as a normal user, as always - and use parts of UAC to easily change to a higher-privileged user when needed.

This shouldn't be any different than in NT4-XP running as a normal user and using runas to change to an admin when needed - only that UAC makes this a lot easier and trouble-free...

I don't see why you'd run any corporate desktop as an admin by default and using UAC to try and push down the privileges, prompting for elevation - this part of UAC seems like a consumer flirt trying to do something about those consumers always running as an admin without a clue.

But sure, if your corporate policy demands that they run as administrators for some reason - having UAC on won't hurt, in fact it will help in the same way as with consumers... so it would be best left on in any case.

Testing applications as normal users is something I just figured is always done regardless since NT4...

Improve this answer
1
  • 3
    "Testing applications as normal users is something I just figured is always done regardless since NT4" Unfortunately, many developers still assume all users are Administrators.
    – u1686_grawity
    Jun 10, 2009 at 15:49
2

  1. Running as admin is dangerous when you don't need the privs, even for experienced users.

  2. Too my knowledge keeping UAC disabled will not have a negative impact on applications.

I think that your use of the word developers struck a chord. UAC was designed as much for developers as it was for normal users.

Mark Russinovich wrote a pretty good article about this very subject stating that by implementing UAC, Microsoft was hoping that developers would stop writing lazy code that required or assumed elevated privileges unless the application had a specific need.

Windows 7 will bring some enhancements to UAC, which is good.

Improve this answer
1
  • Is there anything Russinovich has written that shouldn't be compiled into a "Windows Bible" for reference by programmers, advanced users and sysadmins?
    – Bart Silverstrim
    Mar 9, 2010 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .