UAC to improve Windows 7 system security

In the Windows 7 operating system, a new computer security management mechanism, UAC (User Account Control), was proposed. What is the use of this feature? Simply put, other users have made changes to the operating system, and these changes require administrator privileges. At this point, the operating system will automatically notify the administrator to let it know whether to allow this. change. Although in previous versions, there were limitations in this regard. But there has been a big improvement in Windows 7. It not only subdivides the level of control, but also automatically notifies the administrator. As in previous versions, just prompted the user to have no permissions in this regard, let them notify the administrator. Therefore, after adopting the latest UAC function, the operating system management is more humanized. So how do you use this feature? Don't worry, the author will introduce this new feature in detail.

First, the administrator can choose different control levels as needed.

As shown in the figure below, in Windows 7, this control level is divided into four levels. The highest level is "Always notify me", that is, the user installs the application software or upgrades the application software, the application software changes the operating system without knowing or knowing the user, and changes the Windows settings, etc., to the system administrator. report.

Safety style="DISPLAY: inline-block; FILTER: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='/tech/UploadPic/2010927/201092794018743.PNG', sizingMethod='scale'); WIDTH: 591px; HEIGHT: 243px">

The second level is "Only when the application tries to change the computer" to notify the system administrator. This level is the default control level for the operating system. The main difference between him and the first level is that the system administrator is not notified when changing the Windows settings. At this level, even if there are malicious programs running on the operating system, it will not cause much negative impact on the operating system. Because its malicious program can not modify the system configuration without the knowledge of the system administrator, such as changing the registry, changing the default page of Internet Explorer, changing the service startup list, and so on. For this reason, for most users, especially for enterprise users, this level of security is sufficient. If the level is too high, it will be too rigid. Maybe the system administrator has to keep on running for it.

The third level and the fourth level are gradually reduced in security, and finally all are not notified. In fact, this control level is similar to the control level of the original IE browser, and is a custom control level of Microsoft. As a system administrator, you need to understand the specific content of each level of control, and then set the security level according to the actual situation of the enterprise. In general, the higher the security level, the more secure the operating system. But system administrators may need to take more time to respond to user complaints. Because the user may have any changes to the operating system, they need to inform the system administrator. Fish and bear's paws can't be combined, and system administrators need to strike a balance between safety and convenience.

In the Windows 7 operating system, a new computer security management mechanism, UAC (User Account Control), is proposed. What is the use of this feature? Simply put, other users have made changes to the operating system, and these changes require administrator privileges. At this point, the operating system will automatically notify the administrator to let it know whether to allow this. change. Although in previous versions, there were limitations in this regard. But there has been a big improvement in Windows 7. It not only subdivides the level of control, but also automatically notifies the administrator. As in previous versions, just prompted the user to have no permissions in this regard, let them notify the administrator. Therefore, after adopting the latest UAC function, the operating system management is more humanized. So how do you use this feature? Don't worry, the author will introduce this new feature in detail.

First, the administrator can choose different control levels as needed.

As shown in the figure below, in Windows 7, this control level is divided into four levels. The highest level is "Always notify me", that is, the user installs the application software or upgrades the application software, the application software changes the operating system without knowing or knowing the user, and changes the Windows settings, etc., to the system administrator. report.

Safety style="DISPLAY: inline-block; FILTER: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='/tech/UploadPic/2010927/201092794018743.PNG', sizingMethod='scale'); WIDTH: 591px; HEIGHT: 243px">

The second level is "Only when the application tries to change the computer" to notify the system administrator. This level is the default control level for the operating system. The main difference between him and the first level is that the system administrator is not notified when changing the Windows settings. At this level, even if there are malicious programs running on the operating system, it will not cause much negative impact on the operating system. Because its malicious program can not modify the system configuration without the knowledge of the system administrator, such as changing the registry, changing the default page of Internet Explorer, changing the service startup list, and so on. For this reason, for most users, especially for enterprise users, this level of security is sufficient. If the level is too high, it will be too rigid. Maybe the system administrator has to keep on running for it.

The third level and the fourth level are gradually reduced in security, and finally all are not notified. In fact, this control level is similar to the control level of the original IE browser, and is a custom control level of Microsoft. As a system administrator, you need to understand the specific content of each level of control, and then set the security level according to the actual situation of the enterprise. In general, the higher the security level, the more secure the operating system. But system administrators may need to take more time to respond to user complaints. Because the user may have any changes to the operating system, they need to inform the system administrator. Fish and bear's paws can't be combined, and system administrators need to strike a balance between safety and convenience.

Fourth, through the domain security policy to unify this management level.

The number of clients in the enterprise is often not small. There are not hundreds of clients managed by a system administrator, and there are dozens of clients. If you adjust the control level of this UAC one by one, it is obviously a repetitive and non-challenging work. According to the author's test, in fact, this UAC control level can be combined with group policy or domain security policy. That is, you can set this level at the domain controller level or at the group level. Then when the client joins this domain or this group, it will inherit this management level. In other words, there is no need to configure one by one on each client. To be honest, Microsoft has been doing a good job in this regard. Although Microsoft's domain environment is complicated to build and manage, its function is still relatively powerful. If you want to make some advanced features of the Windows operating system more convenient, then this domain environment is often indispensable. At least this domain environment provides a platform for unified management of individual clients.

However, for various reasons, I have not tested the compatibility between the new features of the Windows 7 operating system and the Windows 2003 domain controller. Because domain controllers are key devices in an enterprise network, system administrators are often not eager to upgrade for security and stability reasons. When I have the opportunity, I will test how the Windows 7 client is compatible with Windows 2003 domain controllers. If readers are interested in this aspect, they can continue to pay attention to the author's subsequent experience sharing.