Windows Vista is expected at the end of the year and security enhancements are one of the biggest talking points about Vista at the moment. One enhancement receiving a lot of attention in particular is the idea of running the system under a Limited User Account (LUA) by default.
I've always like the idea of limited permissions for improved security but it has always seemed too hard to achieve when I have tried in the past. Since then, the information, tools, and push to develop LUA-safe software have become much more popular and it is definitely where most systems are heading. Considering this, I have decided to jump onboard and attempt to use my primary Windows XP machine for all my daily tasks with a non-Administrator, non-Power User, Limited User Account.
I have read several forums and blogs discussing many different aspects of using LUAs but ultimately the replies and comments turn into a list of reasons why people don't like running without their beloved admin rights. I would like to try to use this blog to present a consistently optimistic view toward running with a LUA and look at the problems encountered and how to work around them. Maybe this will be useful to others who are interested in putting their Administrator hat aside for a while or maybe for good.
Writing this article I have been running my notebook as a limited user for one week now. I use my notebook from 9 to 5, Monday to Friday at the office and I take my notebook home at night and on weekends and use it almost every waking hour. It is the only computer I use. At the office I am .NET developer, using Visual Studio 2005 and SQL Server 2005 to write enterprise Windows Forms applications. At home I like to play with the latest software and mess around with new hardware. I definitely consider myself a power user and I didn't begin this expecting it to be an easy endeavour.
However, I may have an unfair advantage. I have had my notebook running with an account with admin rights since I bought it six months ago and in that time I have installed and configured all my regular programs the way I like them. I have now simply removed my account from the Administrators group and continued with my existing profile.
Logging in for the first time as a limited user, my first experiences were very good. All my documents and dev projects were still fully accessible and my regular applications (MSN Messenger, Outlook, and Firefox) worked perfectly. To my surprise Visual Studio 2005 and the SQL Server Management Studio worked fine too.
I am very satisfied with the LUA support in most Microsoft programs so far and I expect most problems will usually be due to bad third-party software. However, Microsoft Backup is an interesting one, as a limited user I don't have access to all my system files so I cannot perform a complete backup. Windows defines a security group called Backup Operators to solve this problem but I am not sure whether adding my normal account to this group would be a good idea. I guess it depends on whether this group only grants access to special file backup APIs or if it grants all access to any file operation. I think I will just login as a special backup user for performing my backups and avoid any potential problems.
Using a notebook PC means that I have a plethora of OEM applications running to "support" all the non-standard features. The power management software is the first of the bad third-party software to fail under an LUA. It simply doesn't run and as a result when my I unplug my notebook and it switches to battery power, the software isn't there to auto-adjust the LCD brightness and other power-saving options. I don't use battery power often so for now I run the power management software as Administrator whenever I need it but I will have to look into this further and maybe start hassling Acer to fix it.
My RSS aggregator, Omea Reader, refused to start, citing an error about class registration or some such thing. A quick search on the newsgroups suggested clicking the Omea "Clip and Edit" toolbar button in Internet Explorer and sure enough the software has worked fine ever since. Also, Nero Burning Rom denied access to my DVD writer, but having encountered this before I logged in as Administrator, ran the NeroBurnRights.exe tool (hiding in the Nero folder), added my account to the Nero group, and that problem was solved too.
Another minor annoyance was the inability to use one of my favourite shortcuts - double-clicking the clock in the system tray to see a quick calendar. As a limited user I cannot change the system time so that dialog is unavailable and I now resort to using my Outlook calendar (which is normally running anyway).
A very handy tool that I must recommend for LUAs is
MakeMeAdmin from Aaron Margosis. This tool uses some neat batch file tricks to temporarily promote your current account to an Administrator for certain programs. The benefit of this over RunAs is that with MakeMeAdmin you still maintain your profile, user folders, and environment. I use this tool for installing new programs and for occasionally starting or stopping a service.
So far I am very happy working as a limited user (Luser) and I expect I won't be changing back to Administrator again. I am even becoming more organised with new files that I create or download because I don't have permission to dump them all in the root of my second partition anymore. I will try to keep you up to date with my progress as my LUA experience continues.