GI Rights Network

Transcription

Welcome back to your free training course for Windows 7. In this video I will look at user account control. At feature that first appear in Windows Vista and has improved in Windows 7. If you go back to the old days of computing there was not much need for security. Back in the dos days computers were not even networked. Now days the majority of computers are networked and most of these are connected to the internet. As new operating systems came out like Windows XP, they allowed you to create users administrator rights or user rights. The idea being that you would log in as a user when you wanted to do your day to day activities and log in as an administrator when you wanted to perform a task that required more access. The problem with this approach was that the user often just logged in as an administrator and stayed logged in as an administrator for their day to day activities. The reason they did this is that it saved them having to log off and log back on when they needed to perform an administrator task. Being logged in as an administrator now gave malware access to your system so spyware, adware and viruses could easily infect your system without the users knowledge. Now this may seem to you just laziness and not wanting to switch users to perform administrator tasks, but the problem also occurs with poorly written software. This software would often require the user to have administrator access. Often a help desktop support person would change the users access level to administrator to allow the software to run. This is not the best security. Also when you look at how often actual an administrator function is required even when the user is an enterprise admin it is often very rare. What I am getting at is that when you are logged in as administrator, the software you are using may perform an administrator function and then not require any additional administrator functions for a long time. For example, just say the files associated with a log are protected. When software to read these logs is first run the software needs additional access to read these log files. As soon as the log files are read into memory it no longer requires that access. All in all, the time required to access the files may be a split second, but the user could be looking at the logs for minutes if not hours, all this time logged in as the administrator. Also since the user is logged is an administrator, any software currently running can access the system using administrator rights. Even though the user may have only logged in with the intent of only using one piece of software with administrator rights. User account control attempts to fix these problems. First it solves the issue of having users logged in as administrators by having two security identifiers. A security identifier or SID for short, is basically a unique identifier. Here are some examples of SID’s. It is beyond the scope of this course to go too much detail into SID’s, but understanding the layout of the tokens does help you understand them better. You can see from the sid’s listed that they come in different lengths but they always start with a S. The next value is the revision number. The value after that is the authority that issued the SID. The last number or sets of numbers are the identifiers. These identifies are the unique part of the SID. Each user has one of these and although the start of the SID may be the same, the last part of SID will always be different. When an administrator account is created in Windows 7 it is given two SIDS, a general user SID and a administrator SID. To demonstrate how this work, I switch to my Windows 7 computer. First to show you how user account control works I will show you how to configure it. First open the control panel and then select system and security. From system and security select the option change user account control settings from under the action center. This setting determines how many UAC prompts you will receive. By default Windows will only notify you when programs try to make changes to the computer. When Windows Vista came out a UAC prompt would be displayed for any changes made on the computer. This annoyed a lot of people as it seemed anything you did would trigger a UAC prompt. Even with the reduced amount of prompts that you get on Windows 7, you can disable them completely by sliding the bar down to the bottom. This of course is not recommended as it completely disables UAC. If I put the slider to the top, this will enable UAC for any time a change is made to the computer no matter how small. This is the same behavior as Windows vista. If you look at the o k button, you will notice that there is a small shield next to the button. This means that when you select this button a change will be made to your computer. Since I have changed the UAC to always prompt, when I press the O.K. button I will put into secure desktop. While is secure desktop, input can only be done through the keyboard and the mouse. Program such as malware cannot accept the prompts for you. This gives you more security, but also means that you will get a prompt every time you try and change sometimes which can become annoying. You will notice you can see the background is greyed out. Windows takes a snap shot of the back ground and puts a secure dialog box on top of it. This is more noticeable when you have a video running in the background and the video will appear to stop. When I press o.k. the actual change will be made using the administrator SID and not the user SID. The effect of this is not that noticeable in this case. If I accept the prompt and open Windows Explorer I have a share mapped to anther server. If I now run some software from the network this will illustrate the two sids better. When I attempt to install the software from the network, I will once again get a UAC prompt asking me if I want to proceed. Notice that when I press yes I now get a prompt asking me for a username and password. What has happened is that UAC has changed to the administrator SID to perform the action. Think of it as two users. The standard SID has the drive mapped to the network share while the administrator SID does not. When the administrator SID attempted to take over it could not access the mapped drive and this is why Windows has asked you for a username and password to connect to the network drive. Once the username and password has been entered, the administrator SID will now be able to access the mapped drive and install the software. Sometimes you may find that software on a network drive does not install correctly with UAC. A work around for this problem is to copy the software from the network drive to the local computer and install it from there. I have already shown you how to change the amount of prompts that you will get in UAC. If you want more control over UAC you can do this with group policy. The settings for UAC are found in computer configuration, Windows settings, security settings, local policies and then security options. You can also access the options through the local security settings for the computer through the control panel. Regardless of where you change the settings they are essential the same because they are the same settings. Local security settings are the local group policy filtered down to the settings that only apply to security. If I change back to my Windows 7 computer I can configure the UAC group policy settings. To change the settings, I will open control panel and open system and security. From system and security select administrative tools at the bottom. From administrative tools select the option local security policy. This will show a filtered down view of the local group policy. The UAC settings are found under local polices and then security options. At the bottom of the list is the UAC Settings. The first setting controls admin approval mode for the built in administrator account. When you install Windows 7, a built in administrator account is created and then disabled. If you enable this account and start using it, by default you will not get any UAC prompts before performing a function that requires additional rights. If you ever need more information about what a setting does, you can select the explain tab. This will tell you what the setting does. The next UAC setting you can set for user interface accessibility or UIA. When this setting is enabled and UIA software is used, a standard prompt will be displayed rather than the secure desktop prompt. UIA is often used by remote control software. Since secure desktop can only be accept or declined using the local keyboard and mouse, without this setting on means a remote user using remote assistance could not accept a secure desktop prompt. However enabling this option does weaken security. The next option determines what will happen when admin approval mode is used. Admin approval mode is when you are asked to confirm a request or asked for a username and password. It is possible to disable the secure desktop and use the regular desktop allowing it to work better with remote control software. If you do this, you may want to consider setting this setting to always ask for a username and password. Even if you are the administrator logged in, doing this will force the person to enter in a username and password and thus get back some of the security lost by disabling the secure desktop. If you wanted to, you could change the setting to bypass admin approval mode all together. Doing this means you will not be prompted when the computer needs to elevator rights. The next option determines if user account control will prompt for elevation when it detects an application is being installed. On a home pc, this is set to enable as this will either be done by a user or malware. If you add your computer to a domain, this option will be disabled. In an enterprise environment software is often managed from remote. Having this setting enabled in an enterprise environment will stop remote software management systems from working. The next setting will make it so only executable that are signed and validated will be able to elevate. If you need very strict control over software used in the environment you may want to enable this setting. If you do enable this setting, then any software you download from the internet will need to be signed and trusted by your certificate authority. This is a lot more work, but does give you better security. The next option determines if the user interface accessibility elevation will occur only when the executable is in a secure area. This basically means if it is in the Windows system 32 directory or the program files directory. This prevents malware from installing itself in other locations bypassing security. This setting determines if any user with administrator rights can bypass admin approval mode. By default only the built in administrator account will bypass admin approval mode, however if you enable this setting, any person with administrator rights will not be given any admin approval prompts. This does weaken security. The next setting determines is user account control will switch to secure desktop when prompting for elevation. By disabling this you will still get the prompts however it will use the standard Windows interface. Doing this does mean that malware could accept the prompts for you and by pass the security. It is recommend you leave this setting to enabled, however if you have software like remote control software that does not work with secure desktop you may need to configure this setting. The last setting determines if user account control will use the virtual file and registry service. When a program attempts to write to a secure area of the hard disk or registry, it is silently redirected to a virtual area of the user profile. This fools the program into thinking that it is writing to the protected area when it does not have access. If you disable this setting some legacy software may stop working. This concludes user account control. In the next video I will look at Authentication and authorization the 40th free video in this free series for Windows 7. We hope you have enjoyed this free training video on Windows 7 so far. For the completed course have a look at our web site or you tube channel. Thanks for watching.