Am 01.07.2017 um 20:14 schrieb Mike Horvath:
> On 6/29/2017 8:19 AM, clipka wrote:
>> As I said: I think it is reasonable to expect you to already /know/ such
>> stuff, given that you've deliberately chosen to set up a separate admin
>> account. If you've been unaware of the associated pitfalls until now,
>> blame it on the person who recommended to you that you should go that
>> route - /they/ should have informed you about the side effects of that
>> procedure.
>>
> 
> Having separate admin and limited user accounts is probably one of the
> most important best practices on Windows, and is one of the cornerstones
> of the concept of "least privilege". The fact that you don't know this
> as a professional after 20+ years amazes me.
> 
>
https://social.technet.microsoft.com/wiki/contents/articles/1510.best-practices-using-a-separate-account-for-admin-tasks.aspx
> 
>
http://www.lbmcinformationsecurity.com/blog/are-your-administrators-using-admin-accounts-for-everything

(1) What does this (the question whether it's best practice or nor) have
to do with whether, if you follow it, you should be aware of its drawbacks?

(2) Your "fact" is an alternative one, i.e. a falsehood: I /am/ well
aware of the practice, and that it is an important best practices on
Windows.

(3) What amazes /me/ is the fact that /you/ don't really understand the
background of that best practice.

The articles cited are /not/ making a case for regular end users having
an extra dedicated admin account -- they both are making a case for
professional admins having an extra dedicated non-admin account.

As the latter, the practice is still valid. As the former, it is pretty
much obsoleted by the UAC introduced with Windows Vista.


> There is no Access Control popup during installation. All you get is a
> generic error regarding "agpl-3.0.txt". There is also no Access Control
> popup when trying to access the include files. You are simply denied
> access to that folder.

There /would/ be a UAC popup if your regular user account was equipped
with the privilege of obtaining admin privileges via UAC. But since
you're trying to run the installer with a locked-down user account,
you're denying yourself that route.

(Note that as of Vista, as a regular user you do not /have/ admin
privileges anymore during regular operation. Only when you confirm a UAC
dialog do you /temporarily gain/ those privileges, and only for the
program in question, such as an installer.)

Post a reply to this message