User Account Control enabled, but not completely

[Jeronimo]

I found a nice guide here explaining how you can keep UAC active, but disable certain aspects of it. However I do not seem to have secpol.msc under Home Basic.

Is this because I used vLite on my installation or is it not present in Home Basic? Is there another way to apply such settings?

[cluberti]

Run gpedit.msc.

[Jeronimo]

Thanks for pointing me towards the obvious I will check tonight, if UAC options are accessible from there.

Edited January 25, 2007 by Jeronimo

[Jeronimo]

Also gpedit.msc is not available :-S

[cluberti]

That may not be possible in home basic - I'll check.

Edit: yup, what I suspected - you need at least Home Premium to modify group policy settings.

[md1813]

Any way to disable WRP in the policyeditor?

There was a guide some time ago on the net...

[Jeronimo]

Any way to disable WRP in the policyeditor?

There was a guide some time ago on the net...

What do you mean by WRP?

[md1813]

Windows Resource Protection

or let me say it another way...

Is there a guide or something to gain ABSOLUTE administrativ power over vista.

You know... delete any files I want, and not getting various warnings and messeges about not having any administrativ rights.

The way I se it an administrator in vista is in more like a extended user...

Edited January 27, 2007 by md1813

[cluberti]

Technically, it is - every user other than the built-in Administrator account gets a split token when UAC is enabled. The only account with complete control is the built-in Administrator user, but as you've already noted, things in Home Basic (and Starter) are different. Note that you may be able to disable UAC via the registry:

Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System

Value: EnableLUA

Type: REG_DWORD

Data: 0

Reboot and UAC should be completely off.

[Jeronimo]

UAC can be disabled from user accounts or from msconfig, but this is not what I started the topic for. There are some possibilities to loosen up UAC, as to make it less anoying more userfriendly and therefore more secure: if you get messages all the time, that you click away without reading, then it's purpose has been lost and security is still at risk. However I have not found an alternative way to edit Local Policies within HomeBasic (also in HomePremium) because secpol.msc or gpedit.msc is not available.

[Jeronimo]

Finally took the time to investigate. Maybe these settings can be added to vLite when UAC is kept enabled?

The following is an extract from TweakVista (link in my first post) with added the settings in registry. All settings can be found under the link stated bycluberti (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System):

* User Account Control: Admin Approval Mode for the Built-in Administrator account
		  o Enabled
		  o Disabled
	ValidateAdminCodeSignatures

	* User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
		  o Elevate without prompting
		  o Prompt for credentials
		  o Prompt for consent
	ConsentPromptBehaviorAdmin

	* User Account Control: Behavior of the elevation prompt for standard users
		  o Automatically deny elevation requests
		  o Prompt for credentials
	ConsentPromptBehaviorUser

	* User Account Control: Detect application installations and prompt for elevation
		  o Enabled
		  o Disabled
	EnableInstallerDetection

	* User Account Control: Only elevate executables that are signed and validated
		  o Enabled
		  o Disabled
	ValidateAdminCodeSignatures

	* User Account Control: Only elevate UIAccess applications that are installed in secure locations
		  o Enabled
		  o Disabled
	EnableSecureUIAPaths

	* User Account Control: Run all administrators in Admin Approval Mode
		  o Enabled
		  o Disabled

	* User Account Control: Switch to the secure desktop when prompting for elevation
		  o Enabled
		  o Disabled
	PromptOnSecureDesktop

	* User Account Control: Virtualize file and registry write failures to per-user locations
		  o Enabled
		  o Disabled
	EnableVirtualization

Additional information on all settings can be found here:

Understanding and Configuring User Account Control in Windows Vista

[prathapml]

I would suggest applying the changes you want on a Vista Business/Ultimate, & monitoring it with regshot - to get a listing of which keys & values get modified.

And then apply the *.REG file to home basic.