Microsoft Windows Vista Manual page 46

138
Part III: Securing Windows Vista
Disabling Credential Prompting for Application Installation
By default, Windows Vista prompts users for consent or credentials prior to installing appli-
cations using elevated permissions. If you don't want users to have access to this prompt, you
can disable User Account Control: Detect Application Installations And Prompt For Elevation
under Security Options, and in this way block users from using this feature to install appli-
cations as administrators. This doesn't, however, block users from using other techniques to
install applications as administrators.
You can use the following procedure to disable the User Account Control: Detect Application
Installations And Prompt For Elevation feature:
1. Log on to the computer as a member of the local Administrators group.
2. Click Start, point to All Programs, Accessories, and then click Run.
3. Type secpol.msc in the Open text box, and then click OK.
4. In the console tree, under Security Settings, expand Local Policies, and then select Secu-
rity Options.
5. Double-click User Account Control: Detect Application Installations And Prompt For
Elevation.
6. Click Disabled, and then click OK.
Changing the Elevation Prompt Behavior
By default, Windows Vista handles security prompts for standard users and administrator
users in different ways. Standard users are prompted for credentials. Administrators are
prompted for consent. Using Group Policy, you can change this behavior in several ways:
If you don't want standard users to have access to this prompt, you can specify that
users shouldn't see the elevation prompt, and in this way block users from using this
feature to run applications with elevated privileges. However, this doesn't block users
from using other techniques to run applications as administrators.
If you want to require administrators to enter credentials, you can specify that adminis-
trators should be prompted for credentials rather than consent.
If you don't want administrators to have access to this prompt, you can specify that
administrators shouldn't see the elevation prompt, and in this way block administrators
from using this feature to run applications with elevated privileges. This doesn't,
however, block administrators from using other techniques to run applications with
elevated permissions.
You can use the following procedure to configure the elevation prompt for standard users:
1. Log on to the computer as a member of the local Administrators group.
2. Click Start, point to All Programs, Accessories, and then click Run.