On the protection mechanism of Windows Vista system account

Vista has had a lot of news recently, as well as a new member of Vista, WMP11. Today, let's take a look at how Vista protects the security of your account.

Often when it comes to Microsoft's operating system, we are always concerned with security. Because of the high penetration rate, coupled with the myriad levels of users around the world using it, and running a large number of mixed-quality applications on Microsoft's operating system, this combination makes Microsoft's product security issues very prominent.

For example, the previous two years have been a raging network of shock waves, oscillating wave, Sven and other viruses, are exploited by Microsoft's product vulnerabilities and users of the careless spread open.

Microsoft is naturally not going to let this problem go on. For a long time last year, all of Microsoft's developers stopped working on their own development and began to conduct security checks on existing products. This check directly affects the rollout time of Windows XP SP2 and Vista, but from the Windows XP SP2 and Windows Server 2003 SP1 released after the check, security has really improved and long waits are worth it.

Although the security has been improved after the patch, but this is still in the existing loopholes on the patch, always let people feel not enough to rest assured. So what is the security improvement of the new next-generation operating system? We can experience it through Vista Beta. As an example of Vista 5219, in this release, one of the most important security improvements is the addition of a feature called User Account Protection, PROTECTION,UAP.

Vista Development News

Vista New member WMP11 unveiled

As a Windows bundled player, WMP has a huge user base, and every new release is a concern for many Windows fans. Recently, the release of WMP11 finally in Vista Beta1 launched 4 months after the prospect. From the screenshot, WMP11 added a preview feature to display a thumbnail of the video file. Its user interface is generally the same as before, but in detail, the more prominent the texture of the panel, and crystal clear vista and complement each other.

Beautiful Vista WMP11.

You might think that this is a fairly safe and convenient mechanism, because as long as you enter a user name and password at the time of logging on to the system, you can perform any permission actions directly throughout the logon process. At the same time, as long as the SAM database is protected, there is no need to worry about the security of the system. Yet this is far from being the case, but it is quite unsafe, though convenient.

We can consider the situation: After using the Administrator account to log on to the system, any programs we run will naturally have administrator privileges. What if we accidentally run a file that contains malicious programs downloaded from the Internet? A malicious program uses the access credentials of the current user at run time, which means that the process of the program also has administrator privileges, and that the process can take any action on the system. Be aware of the risks involved.

So a lot of articles that introduce system security will suggest, usually use the computer when it is best not to use the Administrator account log in, but with the permissions of small accounts, only the occasional need for maintenance or other necessary operations to use the Administrator account, or directly using the runas command. This will ensure system security.

Little knowledge: The runas command that has to be mentioned

Here's a little more about the runas command. With this command, we can run the program with the other user's identity while keeping the current user logged in. For example, for a shortcut to a program in the Start menu, we just click the right mouse button on the shortcut, click on the "Run as" command, and then in the pop-up dialog box, select the "following user" option, specify a username and enter the password. This allows the program to run with the specified user identity.

Of course, if you prefer to use the command-line approach, you can also run cmd to open a command prompt and use a command such as "RunAs User: The path and name of the program to run with the username you want to use", press ENTER, and enter the user's password. For example, a command such as "RunAs user:administrator regedit" allows you to run Registry Editor using the administrator's identity.

Although we can log in with a user with low privileges, we use the runas command when we need to perform a specific operation, but this is still a bit of a hassle, and there are too many additional actions to take. To solve this problem, Vista provides UAP functionality.

Before we introduce this feature, let's take a look at how the various permissions in Windows are controlled. This section mainly takes the example of Windows XP Professional in a stand-alone or workgroup environment and also applies to Windows 2000/2003, not Windows 98.

When the system is installed, all user credential information (that is, user name and password) is saved in the local Sam (Security Accounts Manager, secure account Manager) database. When a user logs on to the system, first enter the username and password, which is obtained by the Winlogon process and is submitted to the SAM database for authentication by the LSA (Local Security Authority) subsystem.

If there is a qualifying record in the SAM database, the LSA subsystem generates an access token (access Token) and passes it to the user. When the user needs to run programs or access resources, the system first finds the appropriate permission information in the access token held by the user, and then compares the permissions required for the desired operation, and if the permissions are sufficient, the operation can be performed;

To run a program, for example, when we try to start a program, the system uses our access token to start the program, so that the program that is started has the same permissions as the token owner. To confirm this, we can open the Process tab of Windows Task Manager. This tab lists all the processes in the current system, and each process shows the identity of the process in the User Name column.

As an example of several processes in Figure 1, Csrss.exe is a system process, so the User Name column displays "System" Emeditor.exe is the program initiated by the current logged-on user, so the User Name column displays the user name of the current user; Emule.exe, although it was started by the current user, used the runas command when it was started, so it appears that the program is starting with another user. Of course, because these three processes use different access tokens (that is, user identities), the permissions of these three programs will vary.