- Admin Powers = Malware Powers
- The Solution: Run as a Non-Admin
- What Kind of User?
- Switching To Be a Mere User
- What's Next?
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Switching To Be a Mere User
Before you fire up Computer Management (a better tool than the User Accounts Control Panel applet to manage logins on your computer) and remove yourself from the Administrators group, let's talk about some problems that you'll have. You're going to move from an omnipotent account to one that has limited permissions, and some things will go wrong. Well, not exactly wrong, but you won't be able to do a lot of things you used to be able to do. Here's a sample:
- You won't be able to run some applications. These are the "legacy applications" I talked about earlier—the ones that read and write to HKEY_LOCAL_MACHINE or the application directory. If they make intensive use of such protected resources, they're just not going to run. Depending on how well they're written, such applications may crash without giving you a clue what's wrong, or may display a dialog box that indicates the problem. One useful thing you can do is to watch the Windows event logs for a few days; you may need to attend to items logged there, or the logs may give you a clue about the reason for problems.
- Some apps will seem to break randomly. These are the apps that access protected resources only occasionally, such as to write configuration changes you make to some kind of file in the application directory. Because you might only make those kinds of changes occasionally, these apps will break only occasionally.
- You won't be able to read app data (rare) or write it to the usual places (common). For example, if you've been in the habit of saving all your Excel spreadsheets in c:\Windows\MyStuff, you'll probably be able to read them but not save new spreadsheets there or update the existing spreadsheets.
- You can't run Windows Update. This problem is annoying but makes sense. Most of the updates Microsoft distributes through Windows Update affect operating system files, a protected operation.
Other things will go wrong in addition to those I've just mentioned. I'll list a few of the problems that annoyed me the most. I travel a lot, and shortly after I began playing with running as a LUA, I boarded a flight. At 10,000 feet I opened my laptop and found, to my horror, that my wireless card was enabled! Panic ensued because, of course, leaving the wireless running is guaranteed to crash the plane when it screws up the navigation system. I tried to disable the connection, but couldn't as a mere user: I had to log off, log back in with an administrative account, disable the connection, and log back in as a user. Thankfully, I accomplished this in time for the pilot to pull out of the steep dive we had entered, and I saved the lives of 247 unsuspecting passengers and crew.
Other annoyances include not being able to change the system date and time, as I mentioned earlier. I change the time zone when I'm in a different place, even though it completely screws up Outlook appointments. But as a mere user I can't make that change. I can't administer IIS in Windows, a problem because I often develop web sites on my local machine before deploying them to a production server. I can't even create a new virtual directory in IIS. Thankfully, I don't have to use Visual Basic 6 very often anymore, but I can't compile an app in VB 6 because it writes to a protected portion of the system registry every time it compiles. (It's one of those legacy applications I've been talking about that Microsoft apparently never got certified under its own program.)
Fortunately, the Windows XP documentation has some advice for us newbie members of the Users group. Microsoft recommends that if you have problems running legacy applications on newly installed NTFS systems, you do one of the following:
- Install new versions of the applications that are certified for Windows 2000 or Windows XP Professional.
- Move end users from the Users group into the Power Users group.
- Decrease [sic] the default security permissions for the Users group. This can be accomplished by using the Compatible security template.
In other words, 1) give up using the application you're trying to use, since it's very unlikely to have a version certified for Windows; 2) make your system less secure by using the Admin Lite account; or 3) change security permissions—access control lists on system resources like registry keys and file directories—to make it easier for malware to do bad stuff. Gee, thanks, Microsoft!
I'm afraid some pain is involved in moving to running as a mere user. Nevertheless, remember the huge benefits to running without administrative privileges. So go right now and remove your everyday login from the Administrators group and add it to the Users group. You'll have some problems, but it will feel so very good to know that you're making the world a safer place for computing.