Leave UAC enabled on 2008?
i looking more reasons for keeping uac enabled windows 2008. how effective has uac been securing systems? what argument "if run administrator bypassing uac so why need enabled?" uac more effective desktops servers? specific examples of worms or virus that have been stopped uac? thanks
this not going answer. not everyone's needs features , security same, hence ability exists turn off. personaly recommend make use of it.
whenever need configure windows server 2008 setting, if logged on administrator - need elevated privileges. design, , part of fierce security initiative in windows server 2008.
when administrator logs on computer running windows 2008, vista, user assigned 2 separate access tokens. access tokens, contain user's group membership , authorization , access control data, used windows® control resources , tasks user can access. before windows vista, administrator account received 1 access token, included data grant user access windows resources. access control model did not include failsafe checks ensure users wanted perform task required administrative access token. result, malicious software install on users' computers without notifying users. (this referred "silent" installation.)
even more damaging, because user administrator, malicious software use administrator's access control data infect core operating system files and, in instances, become impossible remove.
the primary difference between standard user , administrator in windows vista level of access user has on core, protected areas of computer. administrators can change system state, turn off firewall, configure security policy, install service or driver affects every user on computer, , install software entire computer. standard users cannot perform these tasks , can install per-user software.
to prevent malicious software silently installing , causing computer-wide infection, microsoft developed uac feature. unlike previous versions of windows, when administrator logs on computer running windows vista, user’s full administrator access token split 2 access tokens: full administrator access token , standard user access token. during logon process, authorization , access control components identify administrator removed, resulting in standard user access token. standard user access token used start desktop, explorer.exe process. because applications inherit access control data initial launch of desktop, run standard user well.
after administrator logs on, full administrator access token not invoked until user attempts perform administrative task.
contrasting process, when standard user logs on, standard user access token created. standard user access token used start desktop.
source http://technet.microsoft.com/en-us/library/cc709691%28ws.10%29.aspx
similar thread may help
windows 2008 - must disable uac
uac - what. how. why." (video).
"security features vs. convenience". windows vista team blog
Windows Server > Windows Server General Forum
Comments
Post a Comment