I discovered today that Vista's irritating User Account Protection completely locks you out from doing certain things on your PC. It's like that annoying message in XP warning you not to modify system folders, except there's no 'I know what I'm doing' option to skip past it.
I say, I say, I say…when is an administrator not an administrator? When they’re a Vista administrator!
ROLFMAO.
It’s true, but were you laughing? Neither was I. It’s not funny.
David Flynn talked in a recent article about how after we upgraded on APC machine to Vista RC1, we noticed we couldn’t open Outlook PST files stored on an external drive. It turned out to be a problem with permissions - despite being an administrator, the user didn’t have Modify and Write access to the PST file, so Outlook couldn’t expand the file using the rights inherent in his credentials.
Once the user account was explicitly added to the folder’s security permissions, things went back to normal.
Step back a bit from this particular incident and look at the larger picture - in Windows Vista, system administrators are genuinely NOT administrators, and things break when that happens. When something as basic as opening a PST on an external drive breaks, that's a real worry.
This is all due to UAC - User Account Control [such an important new feature of Vista's security system that Microsoft even has a blog about it.]
Anyone who has tested a Vista pre-release build has seen it jump into that protected desktop mode, prompting for confirmation when you want to access some particular system feature or install an application. If you haven't seen it, Microsoft has a 12 minute demonstration video of it. You may want to switch it off after about 20 seconds.
UAC alerts are irritating, but fortunately they can be completely disabled (more on that later). However, they’re symptomatic of events happening at a lower level.
Why administrators ain't administrators
By default in Vista, the first account you create is a member of the Administrators group. You can check that by go into Computer Management (right-click My Computer, Manage) and navigate to Local Users and Groups.
Take a look at the properties of your own user account under "Member Of", or look at the members of the Administrators group, and there you are.
The local Administrator account is also listed there, which should be reassurance enough that you have full local admin access.
However, let’s suppose you want to do something like change all the security permissions on the C:\Program Files folder. As an administrator you should be able to, right? Wrong.
Right-click on Program Files and select Properties. Go to the Security tab and there’s a list of currently-assigned access rights.
Click Edit, go through the standard confirmation, and then try to change something. You can’t - everything is greyed out.
However, turn UAC off and suddenly all is revealed - you now have full access to the underlying filesystem returned to you.
There are a number of ways to disable UAC, and I’ll go into them in greater detail once I get some info back from Microsoft, but a straightforward way to do it is to go into the Control Panel, switch to Classic View, double-click User Accounts, and select “Turn User Account Control on or off”. This takes you to another window, where you simply untick the checkbox to disable UAC, hit OK and then reboot.
UAC is one of those aspect of Vista which offers both great and highly annoying features. The concept behind it is sound - distance users from the OS, thereby protecting both the OS and the users themselves. It also gives great flexibility to users with standard user rights - these users on Vista can do much more to personalise the experience than Windows XP’s all-or-nothing approach. UAC can also be used to run applications intelligently with elevated privileges, which is great news for desktop admins trying to strike a balance between functionality and security.
However, power users don’t want to be protected, don’t want to babysat, don’t want to be cut off from anything. They want full access, all the time, and if something breaks they won’t come crying to your door. They’ll take responsibility for the stuff-up and sort it out themselves. And for these people, UAC is the software equivalent of hearing a mozzie buzzing around in your bedroom when you’re trying to sleep.
Personally, when I do a Vista install from now on for my own use, UAC is the first thing to go.