Monday, June 23, 2008

Disable UAC in Vista - Properly

One of the security measures MS added to Vista is the User Access Control (read Microsoft's take on UAC here). Essentially, every little change in your OS has to be approved by a user with an appropriate permission . This includes changes to files, registry keys, installations/uninstallations of software, but also resolution changes, background changes and various innocuous everyday changes.

To make a long story short, you get so many notifications from UAC, that 10% of your work in Vista consists of approving actions you yourself initiated. This thing has pissed off so many people, that the 'net is full of "how to turn off UAC" guides. Many people think, and rightfully so, that getting confirmation for every action is a very lazy and inefficient way to implement a "security measure". You can see a funny representation of this in this funny Apple commercial.

The main problem with outright disabling UAC is that you get a menacing Security Center alert in the form of a red icon in your taskbar, claiming that "your machine is not protected".

To get rid of UAC and this annoyance all together, follow these steps:
  1. Go to Start->Control Panels->Security Center and locate the User Access Control section in the bottom.

    Turn UAC off - this calls for a restart.
  2. Before restarting look at the left side of the control panel and click "Change the way Security Center alerts me".
  3. In the next screen, you can click option 3 ("Don't notify me and don't display the icon"), so you'll never get that red icon again.

Microsoft recommends not using Vista with an administrator-level account - that should prevent unwanted apps from having their vile way with your OS. Make sure you follow this rule, if you disable UAC.

While researching this post, I came across this recommendation: don't turn off UAC, just tell Vista to automatically accept each action. While this sounds essentially the same - it still keeps UAC on and logs every action. Here are the steps from that article:

Click Start and Control Panel. Switch to Classic View (if you haven't already) and click on the Administration Tools icon. In the list that opens click on Local Security Policy, and in the next window, Local Policies (a tiny bit redundant, but all UIs can't be perfect -- If UAC is running you'll get a UAC pop-up somewhere in here). In the Local Policies list click Security Options, and scroll down to "User Account Control: Behavior" (the full title of the policy is "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" but the window barely opens that far). Double-click the title and in the dialog box change its setting from "Prompt for Consent" to "Elevate without prompting." Click OK and the urge to tear your hair and scream at your PC will be greatly diminished in the future.

(One note of caution: This works for Vista Ultimate. I don't guarantee it will work in all versions, or in all time zones. Please add a comment below if you've got a version of Vista it doesn't work with.)

Notice that this tip works in Vista Ultimate only. To read more about this option and the story behind it, here's the link.

No comments: