Least Privilege – Still Unusable

Quite some time ago, I argued that unprivileged users were too annoying to be usable in Windows. Today I took shipment of a shiny new computer and figured that for once I might actually try applying all these ideas that are meant to make Windows secure. Previously I’ve just kept Windows safely behind a firewall and done my web browsing and email on my Mac – essentially eliminating any way for unvetted code to get to my PC.

So I set off and created a limited user account, logged in as admin to do the initial setup of installing programs and what-not, then switched to the limited user. Some of the programs I’d installed had annoyingly placed shortcuts on the desktop so I tried to delete them. Turns out they’re in the Shared user directory and my limited user doesn’t have permission to delete them. Yep, that’s right, by default most installers will add icons to my desktop that I have to switch users to delete. Great….

Then I opened the start menu. This time it was Microsoft adding useless crap to the start menu and again, it belongs to the shared user so I couldn’t delete it. Sigh. This is getting annoying very quickly.

So I thought I’d just play a game and forget about it all. Call of Duty 2 came with my graphics card so I tried it out. “Please log in as an administrator and try again.” Wonderful! Aha! I think, I can just use this little run as trick and get around that. “Please log in as an administrator and try again.” So much for that.

So that’s a total of three things I wanted to do, three things I couldn’t and the prospect of having to change users just to play a game. Forget this – I’m running as an administrator user again.

So if someone on the windows “make limited user accounts usable” team happens to find this (prodding Scoble), might I suggest eliminating that damn shared users folder – I want to control wants on my desktop and start menu, get out of my way – and coming up with a better system for running an app as another user. The current attempt is crap.  In the mean time, I’ll browsing and emailing from my Mac.