Need help to understand how best configure Windows7

[stuckless]

On Vista, I had an admin account (which was my account), and then I created separate limited accounts for the kids. This approach proved to be pretty frustrating, especially with UAC enabled. UAC, to me, doesn't seem to add any real benefits other than providing a layer of file obfuscation, but I am probably misunderstanding the purpose of it.

So, my question is really, do I disable UAC, or should i install the kids applications somewhere outside of the program files areas, etc.

I also want to run the kids as limited accounts, but on Vista, this also proved problematic, since most game updates happened when you are in the game, and then there were permissions issues, installing updates, etc... I think in the end, I ended up having to promote them to admin users... but then with UAC enabled, if would appear that if one kid took the game update, then the other kid didn't actually get the update, etc... (very messy).

So, I'm looking for some guidance from the pros, on how to better configure Windows7 for multiple users, games, uac, etc.

Thanks

[JerryB]

I can't answer your question since that's an individual decision regarding the trade-off between addition protection vs the hassles of UAC. However, I can state that UAC has been improved and is less intrusive in Windows 7.

For example, in Vista, if one of my children was running a program/game and was prompted to install an update for that program/game, the only way to get the update installed, given the UAC restrictions on their accounts, was for them exit the program, log out of windows, have me log into windows under my administrator account and install the program, have me log out of windows, and, finally, have them log back into windows and reload the program/game. This was a real hassle.

In contrast, if they receive a similar prompt to install an update in Windows 7, a dialog box automatically opens on the screen, they call me and I enter the user name and password for my administrator account (actually since I have a fingerprint reader attached to the computer, I just scan my thumb). This provides Windows with the necessary administrator credentials and the program is temporarily given the access it needs to install the update. This way, my children still can't install things by themselves but now it is much easier for me to temporarily supply administrator credentials when necessary from within their accounts.

[stuckless]

Originally Posted by JerryB

For example, in Vista, if one of my children was running a program/game and was prompted to install an update for that program/game, the only way to get the update installed, given the UAC restrictions on their accounts, was for them exit the program, log out of windows, have me log into windows under my administrator account and install the program, have me log out of windows, and, finally, have them log back into windows and reload the program/game. This was a real hassle.

Yep... that sounds exactly like my life... except in the cases where they just installed it anyways as their account... and then still really got wierd.

In contrast, if they receive a similar prompt to install an update in Windows 7, a dialog box automatically opens on the screen, they call me and I enter the user name and password for my administrator account (actually since I have a fingerprint reader attached to the computer, I just scan my thumb). This provides Windows with the necessary administrator credentials and the program is temporarily given the access it needs to install the update. This way, my children still can't install things by themselves but now it is much easier for me to temporarily supply administrator credentials when necessary from within their accounts.

Sounds like MS is finally getting it sorted out... Maybe i'll start off with it installed and see how it goes... I don't like running any account as admin but even Vista, it was next to impossible to not run as admin. I'll try it this way in Win7 and see what happens.

[JerryB]

Originally Posted by stuckless

Sounds like MS is finally getting it sorted out... Maybe i'll start off with it installed and see how it goes... I don't like running any account as admin but even Vista, it was next to impossible to not run as admin. I'll try it this way in Win7 and see what happens.

I agree. Ideally an administrator account should not be used for routine computing. The ability to temporily elevate access in any account to the administrator level in Win 7 finally makes it feasible for all users to routinely run under limited access accounts. You just need to create two accounts (one administrator/one limited access) for the person responsible for maintaining the computer and then log in using the administrator account only when you know you're going to need administrator access for a prolonged period, eg initial computer setup, etc. Otherwise, you log into and use your limited access account for routine computing and supply the credentials from your administrator account only when specifically prompted to install/update softeware, etc.

[Taddeusz]

Yea, games are a tough one. Especially with integrated updates. The issue is that with UAC turned on, unless the application asks to be elevated, any writes to a folder within "Program Files" will instead be routed to the individual user's virtual store located in their AppData. The only way around this is to modify the file/folder permissions for those particular games to allow full write permissions to limited users. That's actually what I was doing with my SageTV Client program folder so that the properties files and such would go where they were supposed to.

Really, not being able to write directly to the Program Files folder is a good thing. The fact that so many programmers have been getting away with it for years rather than following best practices is kind of sad. Even SageTV is guilty of it. If it's configuration data that needs to be read by all users it should go in the "All Users" AppData otherwise it should go in the user's AppData. You wouldn't believe how many times I had to explain this to one of the programmers at my old company and as far as I know to this day the program in question will still not work right without full administrator rights.

[Mark SS]

Go with a different programs folder for games/apps that might require updates. On the HTPC server/client at home, SageTV, DVBE4Sage, XMLTV tool etc are all installed to C:\ProgramOther, which bypasses the virtual store and UAC issues.

[stuckless]

Originally Posted by Taddeusz

Really, not being able to write directly to the Program Files folder is a good thing. The fact that so many programmers have been getting away with it for years rather than following best practices is kind of sad. Even SageTV is guilty of it. If it's configuration data that needs to be read by all users it should go in the "All Users" AppData otherwise it should go in the user's AppData. You wouldn't believe how many times I had to explain this to one of the programmers at my old company and as far as I know to this day the program in question will still not work right without full administrator rights.

I agree that not allowing write access to program files folder is the right thing... which is why i just shake my head at MS deciding that obfuscating the writes by putting them somewhere else is somehow a good thing. Why not just deny access, like any other OS would do... then, there's no confusion about to where your data is getting written.

Sounds like installing games outside the program files area is probably the easiest solution.

[babgvant]

Originally Posted by stuckless

I agree that not allowing write access to program files folder is the right thing... which is why i just shake my head at MS deciding that obfuscating the writes by putting them somewhere else is somehow a good thing. Why not just deny access, like any other OS would do... then, there's no confusion about to where your data is getting written.

Application compatibility.

Originally Posted by stuckless

Sounds like installing games outside the program files area is probably the easiest solution.

For applications that don't follow the rules I find the relaxing the permissions on the install folder in Program Files is the best approach. Many applications are poorly tested so a non-standard install location could easily cause issues.

[stuckless]

Originally Posted by babgvant

Application compatibility.

I understand why MS does this... but it's not like they haven't said to the driver manufacturers... "Build new drivers for each OS release"... so why the special treatment for app developers. We don't expect the sound driver for written for Windows 3.1 to work in Windows Vista... and I wouldn't expect all my apps written for Windows95 to just work in Windows 7, etc. Seems to me that "Application compability" comes with a lot of negative issues for MS, and they'd probably be better off to set simply create a better, more secure OS, even if that meant that my windows 3.1 apps would no longer run.

[babgvant]

Originally Posted by stuckless

I understand why MS does this... but it's not like they haven't said to the driver manufacturers... "Build new drivers for each OS release"... so why the special treatment for app developers. We don't expect the sound driver for written for Windows 3.1 to work in Windows Vista... and I wouldn't expect all my apps written for Windows95 to just work in Windows 7, etc. Seems to me that "Application compability" comes with a lot of negative issues for MS, and they'd probably be better off to set simply create a better, more secure OS, even if that meant that my windows 3.1 apps would no longer run.

But you're a rational guy who understands how computers work.

There are many users who complain about exactly the hardware scenario you raise, and it's even worse for applications. In the majority of the cases I've seen both on the interwebs and listening to real people (like my dad) MS takes the blame for "breaking" compatibility; add to that that MS has to sell people something where if it doesn't work with their existing applications is much hard to market. While it might not be the right technical decision, there are solid business drivers behind it.

[stuckless]

Originally Posted by babgvant

But you're a rational guy who understands how computers work.

I don't know about rational ... but certainly logical... ie, I can the logic in keeping crud around for a certain length of time, but over time, the crud needs to go... and Windows does that with drivers at least... and it would be nice to see them do that with applications as well.

There are many users who complain about exactly the hardware scenario you raise, and it's even worse for applications. In the majority of the cases I've seen both on the interwebs and listening to real people (like my dad) MS takes the blame for "breaking" compatibility; add to that that MS has to sell people something where if it doesn't work with their existing applications is much hard to market. While it might not be the right technical decision, there are solid business drivers behind it.

Each new version of windows totally changes the user experience... I knew where to find things in Windows XP, but in Vista I was totally lost. I don't see the logic in changing the UI just for the sake of change, but I do see the logic in breaking backward compatibility if it means a better user experience moving forward. But I agree with you in that it's more of a technical benefit than a business benefit.

BTW... I don't expect that MS will break backward compatibility, but I really do wish that they would. They can probably still retain backward compatibility by using a VM, which they seem to be doing in some cases anyways. Apple had a similar problem when they moved from PPC to Intel, but they seemed to have handled it fairly well. Maybe in Windows 10, we'll see a statement that they no longer provide backward compability, or that they will provide it in a virtualized manner (you'll pay extra for that option )

[babgvant]

Originally Posted by stuckless

I don't know about rational ... but certainly logical... ie, I can the logic in keeping crud around for a certain length of time, but over time, the crud needs to go... and Windows does that with drivers at least... and it would be nice to see them do that with applications as well.

They do it for drivers because there's a strong business case behind the change.

As a developer I agree that from a technical perspective the current model is unnecessarily complex, but I also understand the motivation and think that for most users, it's a decent balance b/w the two sides.

Originally Posted by stuckless

BTW... I don't expect that MS will break backward compatibility, but I really do wish that they would. They can probably still retain backward compatibility by using a VM, which they seem to be doing in some cases anyways. Apple had a similar problem when they moved from PPC to Intel, but they seemed to have handled it fairly well. Maybe in Windows 10, we'll see a statement that they no longer provide backward compability, or that they will provide it in a virtualized manner (you'll pay extra for that option )

Many ISVs would be effected (including Sage) by that kind of change, and it would drive up development costs to maintain two applications (one that works in XP and another in Vista/7).

Apple's ecosystem is so different I'm not sure it's reasonable to make the "if Apple did it..." argument. Ignoring that Apple is a very different kind of company (which doesn't seem to have any issues taking a public dump on it's ISV community); MS has to deal with a much more diverse and exponentially bigger set of applications, vendors, and user base.

[PLUCKYHD]

Originally Posted by babgvant

Apple's ecosystem is so different I'm not sure it's reasonable to make the "if Apple did it..." argument. Ignoring that Apple is a very different kind of company (which doesn't seem to have any issues taking a public dump on it's ISV community); MS has to deal with a much more diverse and exponentially bigger set of applications, vendors, and user base.

Agree there look at the backlash when Vista came out although it had it's issues most people were made at all the backward compatibility that was broken. Most articles where about how this or that doesn't work on the new version.

I too wish Microsoft didn't have to do this but unfortunately it comes with the tag of being used by majority of business and consumers that unrealistically expect their version of office 2000 to run smoothly on windows 7 (which it does just saying why should it)

[OneOfMany]

I have to agree. Forcing people to purchase updated applications just because a new OS is released is not sensible. In the Apple world, the majority of users are only using basic, supplied apps, and with the exception of designers are not running them in business applications. We deal with many companies that are running proprietary, and sometimes ancient (even DOS-based) legacy business apps, and backwards compatibility is paramount to successful network upgrading and deployment. We are using a Paradox 7 application that I wrote for our business, with years of coding, tweaking and upgraded feature development. I would hate to have to re-code in another database application just because a new version has popped out. It has successfully migrated from Win95, Win98SE, Win2000, XP Pro and now Win7 clients, and Win3.5NT, Win2000, Win2003, and now Win2008 servers. Thank you Microsoft!!

Grant

[PLUCKYHD]

Originally Posted by OneOfMany

I have to agree. Forcing people to purchase updated applications just because a new OS is released is not sensible. In the Apple world, the majority of users are only using basic, supplied apps, and with the exception of designers are not running them in business applications. We deal with many companies that are running proprietary, and sometimes ancient (even DOS-based) legacy business apps, and backwards compatibility is paramount to successful network upgrading and deployment. We are using a Paradox 7 application that I wrote for our business, with years of coding, tweaking and upgraded feature development. I would hate to have to re-code in another database application just because a new version has popped out. It has successfully migrated from Win95, Win98SE, Win2000, XP Pro and now Win7 clients, and Win3.5NT, Win2000, Win2003, and now Win2008 servers. Thank you Microsoft!!

Grant

Yeah but by the same token Microsoft doesn't force you to upgrade o/s. Although your statement is exactly why they do keep backwards compatibility. Although I do get tired of microsoft getting blamed for breaking software and drivers that are not theirs on new o/s.

[Taddeusz]

And there are good reasons to break backwards compatibility because many of those legacy apps, particularly DOS based, aren't up to current security standards and may have even been under par at the time of development. Keeping backward compatibility is a hindrance on microsoft's ability to properly secure their os.