Given that accounts with login access to a server OS would usually be a systems administrator (or in general, has elevated privileges), is there a good reason to have User Access Control turned on? If not, why?
Asked
Active
Viewed 473 times
4
-
1Why are you logging-on to the server OS's interactively anyway? Beyond the bare-metal configuration, you should be able to do most of your admin work from a client computer, logged-on with a limited user account and using "Run As" to start management console snap-ins targeted at remote machines with privileged credentials. – Evan Anderson Feb 01 '10 at 16:46
6 Answers
5
Leave UAC on. UAC is not simply to prevent stupid clicks but to make you aware when an application is performing actions that will require more than user access. While it may be presumed that if you log on with administrative access you are granting any applications the ability to perform those actions it's very helpful to be aware of the fact that an application or script is performing actions that could impact the stability of the system. UAC should have very little impact from an admin point of view since you should not be logging on to the server interactively very often.
Jim B
- 23,938
- 4
- 35
- 58
0
Leave it on.
Here is a good discussion on serverfault. I think all of the same reasons apply for sysadmins:
How important is UAC for developers?
0
Since Windows Vista (so including Windows 7, Windows Server 2008 and 2008 R2) with UAC enabled, all users run with standard permissions. Even when logged in as an administrator, you still run with standard permissions. This is the big innovation of UAC. Malware cannot hijack a highly-priviledged account, because even administrator accounts run with standard permissions most of the time.
Only after the UAC prompt does your account receive its full privileges.
If you turn off UAC, you lose that protection and malware would be able to more easily hijack your highly-priviledged account. Once malware gets control of a highly-privileged account, it's Game Over.
So, UAC is even more desirable on servers, precisely because the users tend to log in with highly priviledged accounts. That is the exact situation that UAC is designed to protect.
Tim Long
- 1,728
- 1
- 20
- 41
0
Leave it on.
Some wisdom from the Unix world: good sysadmins use SUDO, bad ones log in as root.
SUDO and UAC perform a similar function, after all.
Dan Andreatta
- 5,384
- 2
- 23
- 14
0
The exception here would be Windows 2008 Servers that users use for terminal services. Having UAC on is more annyoing than needed for them (Applications don't know that the users don't have admin privileges, so UAC pops up every time Java or similar wants to update itself).
Other than that: Leave it on :)
pauska
- 19,532
- 4
- 55
- 75