Windows Vista security performance comments

Author: Fish compilation Source: enet

Author's point of view: the next version of Windows client provides some good functions, but there is no right to speak without practice. We still have to wait until next year after it is released, and people will run it one after another, to make a more objective and correct evaluation.

For several years, especially after the release of Windows XP Service Pack 2, Microsoft has been vigorously enhancing the security of Windows and Internet browsers. Sometimes Microsoft's efforts are hard to see, but I think they have made some progress. However, in the new Windows version to be launched, Microsoft has the opportunity to do some work to fundamentally increase security.

Like Service Pack 2, these changes will break the existing application system calm and require Independent Software developers (ISV, Independent Software Vendor) and device-driven developers to make corresponding changes. I would like to say that the rule of things is like this. Just as with the advent of SP2, independent software developers spend a lot of time updating their software. If Vista becomes unavailable in the second half of next year, it can be asserted that independent software developers should be blamed.

Other operating systems or third-party products provide many of these "new" features, but it is not easy to make these features standard in Windows. I am willing to do some work on several important features.

For a long time, collaborative IT has been well known for managing Windows users with limited licenses, both on the network and on the local host, indicates that it is not competent for the job ). For ordinary home users, IT is not difficult to create such an account, but usually, collaborative IT is used for applications that require greater privileges, these privileges are only available to a few users in Windows XP.

In Windows Vista, first, the attitude towards this problem has changed. Privileged objects are no longer "very few" users, but currently "very few" accounts. It is not easy to get an account with administrative permissions. However, it is generally not necessary to have such an account. If you want to perform operations that require administrator permissions, such as modifying firewall settings, the system can provide you with an opportunity to obtain an account with sufficient permissions, such as an administrator account. In this way, you can use the operating system of a common account, and you can have administrator permissions when necessary. This is called "User Account Protection". In beta 1, you must manually implement this function.

Of course, this method comes directly from Mac OS X. Mac advocates that this is the best solution to the problem, but there are still some limitations on how this method can protect you. Many spyware or AD software installed on Windows are not caused by users' carelessness. They did so on purpose. If you want the cool tool bar, you also know that you are installing a software, so you will certainly give it the Administrator the permission or meet the other requirements it needs. Install valid software, and you need to do the same. On the other hand, we should provide protection against silent drive-by downloads. Otherwise, silly users will be used again.

Another feature of user account protection is that after you write a program that protects the file system and registry, these written code is actually stored in an independent area maintained by a single user, it is called virtual storage. This is the same as on the Terminal Server. In fact, I really want to know why the Virtual storage is stored in the C: Virtual Store directory of drive C, rather than in the user's own Documents and Settings folder as on the terminal server.