Windows 11

[Smolley]

....it's all kidology:

[Adrian Caspersz]

Disagree.

[Joe]

Be fair, MS has only recently got rid of the wonderful Edlin. Yes, I have used it, though not for decades and never in Windows.

[Joe]

Even now, the first user out of the box is by default an administrator.

[Rob Morley]

How would you configure the machine and add regular users, if not as admin?

[GB]

Sure. Install a different OS, but installing Windows, and then disabling the security...

I assume it's just a wind-up, because nobody could actually be that stupid.

[Joe]

You would run the OOBE as admin but would be required to create a normal user.

You're still free to logon as admin and install viruses if you want to. At the moment, the first user isn't even told that it's a bad idea to run as admin, something that most domestic users wouldn't guess.

[Mark]

Funny enough there is an apt called Sledgehammer that lets you turn on/off windows updates

[Vir Campestris]

says it's a quote from a Caledonian chieftain. Just for once I wish I'd paid attention in those Latin classes so I could read the original! I think I get it...

"atque ubi solitudinem faciunt, pacem appellant." it says at

"they make a solitude and call it peace."

I'm surprised it's that old. Plus ça change.

Andy

[The Natural Philosopher]

If you really understood security, you would realize that huge parts of what is sold to you as secure it to protect incompetent programming and incompetent users from getting f***ed. By not being an incompetent user, and taking precautions, you simply dont need additional security

I havent bothered with any since I moved to Linux, 20 years ago. Ni virus, No malware. Nada.

[Tim Streater]

Same applies on macOS, where I do precisely nothing at all about viruses, because there are none. And see my sig.

[Paul]

The first user during OOBE, belongs to the Administrator group. Elevation involves a UAC prompt.

The "real administrator" account is disabled. If you did want to run in a "permanently elevated" state, then you would do this, but this is NOT how windows ships. And this model is really not much different than the "sudo" model used by some Linux distros (where the root account is not running and there is just sudo).

net user administrator /active:yes

(do not forget to set a password for the account, and record it somewhere)

If you did want to run permanently elevated by logging in as the (freshly-enabled) real administrator, you can get a copy of DropMyRights.

DropMyRights notepad.exe

and then that is the inverse of UAC. It would allow you to run notepad.exe without elevation. But having to type this for everything, this would get on your nerves.

DropMyRights firefox

So really, Windows has a means of emulating what model Linux is using at the moment. You can selectively elevate. Or, selectively de-elevate. The shipping Windows model, is similar to how sudo works in Linux (selective elevation).

For example, I regularly "deny" UAC prompts, as a means of preventing certain aggressive browsers from updating :-) You don't always click "OK" on the stupid UAC prompt :-) There are occasions when there is an activity you want blocked.

The purpose of elevation during software install, is for the "impersonation privilege" and being able to add software to Program Files as the TrustedInstaller account. Not as the Administrator account.

When administering a Windows PC, just be careful to not remove the last account with elevation privileges. As they've made it harder to hack your way back in. The OSK.exe hack has been removed (or, bypassed in a sense). There is one person who keeps a webpage, with the hacks that still work for adding back a user who belongs to the Administrator group.

Paul

[Joe]

You know all this, and I used to for NT4 and the few following it, but I'm no longer in that line of business.

But what about your aunty Mary, bought a new computer by one of her other nephews? Does she know all this or is she happy to just use the first account, that the nephew 'set up' for her, and permanently run with admin privileges?

[John Rumm]

The "first account" does not "permanently run with admin privileges". For GUI operations it can use the *nix style elevation in the form of UAC to allow elevation.

Try:

notepad %windir%\system32\drivers\etc\hosts

Now save save the file...

Did it let you?

That would be because you don't have privilege.

(you can use the "runas" command from the cli to allow elevation there)

[Adrian Caspersz]

In Linux getting past Sudo is by default a request for a password, and for that a trip to command line if not prompted in the GUI. And ...

We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.

#2) Think before you type.

#3) With great power comes great responsibility.

Password:

Because of the overload of nuisance things to deal with in a typical Windows installation with pop-ups, spam warnings, anti virus software, windows notifications, software updates, windows updates, advertising, browser windows etc... some Windows users will blindly click anything, including UAC prompts and unsigned software warnings.

If Microsoft enforced re-authentication for UAC out of the box, then those users would probably take note.

[Andy Burns]

but it's the same password that user has already logged on with, using "su -" at least it's a different password for the privileged account.

[The Natural Philosopher]

Well that depends on what you have your passwords set *for*. In terms of whether that is better or not.

Having to re-enter my password to do 'cool shit'; at least reminds me that I am tampering with how the thing works, rather than just mindlessly creating and destroying data. And it stops any random malware including kiddies sticky fingers from using my identity to f*ck with the system as well. I have never given my password to anyone, except in an emergency to a friend. I changed it then after 10 years. But then he died, so I could change it back. And I have never on Linux been hacked or suffered any malware at all

So I reckon its 'good enough'

[Paul]

If you use sudo to elevate the package manager

sudo synaptic

then that first occurrence will cause a password prompt.

If you immediately enter a second command

sudo copy empty /etc/fstab

then no password prompt results. The initial authentication is good for some number of minutes.

if you want some sort of "absolute-ism", you can "su" your afternoon away if you want.

Some distros even have a "root terminal window", for the <cough> "power hungry" user.

Security is a state of mind -- never assume anything when you sit down at a computer. You never know what silly habit a distro might have.

*******

I've only ever had one computer tipped over, and I'm not particularly careful. The exploit came in through a browser, and I doubt the browser was elevated at the time either. Apparently a commercial site was hacked and the top level domain was replaced with a "redirect attack".

Paul

[The Natural Philosopher]

No, you will get an error because copy and empty are not Linux commands

And? If I do su - and enter the root password, the root session is there forever.

The distros aren't the silly part. The users are.