Microsoft caves in, will change Windows 7 UAC
Microsoft will deliver two changes to the UAC security feature in Windows 7's release candidate in response to intense user criticism
Follow @infoworldReacting to intense criticism of an important security feature in Windows 7, Microsoft Thursday said it will change the behavior of User Account Control (UAC) in Windows 7's release candidate.
"We are going to deliver two changes to the Release Candidate that well all see," said John DeVaan and Steven Sinofsky, two Microsoft executives responsible for Windows' development, in the second of two posts to the Engineering Windows 7 blog today.
[ Read what InfoWorld's Randall C. Kennedy has to say about the dumbing down of UAC in Windows 7 as well as his other analyses and insights on PC tech in the Enterprise Desktop blog. And download our free Windows performance-monitoring tool. ]
"First, the UAC control panel will run in a high integrity process, which requires elevation," said DeVaan and Sinofsky. "Second, changing the level of the UAC will also prompt for confirmation."
The changes, they said, were prompted by feedback from users, including comments appended to an earlier post Thursday by DeVaan in which he defended the modifications Microsoft made to UAC in Windows 7.
"Our dialog is at that point where many do not feel listened to and also many feel various viewpoints are not well-informed," DeVaan and Sinofsky said in the later blog post. "That's not the dialog we set out to have and we're going to do our best to improve."
The UAC feature, which debuted in 2007 as part of Windows Vista, but was altered to reduce the number of prompts in Windows 7, has been under fire since last week, when two Windows bloggers, Rafael Rivera and Long Zheng, first reported that it could easily be disabled by attackers.
Wednesday, they followed up with more information about how hackers could piggyback on UAC-approved applications to fool Windows 7 into giving a malicious payload full administrative rights.
"This is definitely the result we've been looking for," Long said in a e-mail late Thursday. "[But] I'm a little bit shocked at just how quickly Microsoft has turned around, considering they made a post not 12 hours earlier stating that they would not change their position."
Rivera, Long, and others urged Microsoft to reconsider the default setting of UAC in Windows 7. That default, which DeVaan said Microsoft had selected because people running Windows balked at dealing with more than two security prompts per day, was "Notify me only when programs try to make changes to my computer."
