Windows 7, First Impressions

It's been a little less than 12 hours since I installed and started using Windows 7. I must say I'm not entirely pleased, neither I am particularly displeased. Only frustrated.

1. Interface
Despite a certain charm to the OS interface, which is hard to deny, I personally prefer more minimalist interfaces. The one thing that annoyed me was that Classic mode keeps the same general design of Windows Vista/7 (down to widget sizes), and dresses everything in Windows 2000 colors. The result is one ugly interface that is not even optimized in terms of screen real-estate conservation. Contrary to Windows XP, classic mode is really no longer advisable unless you are doing it because of lack of system resources. But be prepared for one terrible, saddening, experience.

2. UAC
Ok, this is what really is driving me nuts. You see... I WANT TO USE UAC! I really do. But I can't. Not for now at least.

If I'm upgrading my operating system, I want to use those technical features that have been improved. And UAC offers an important layer of security that was always missing from windows operating systems. I feel this is an important tool and should be used by everyone. Pardon the french, but screw Aero! I'm in it for the real technical features.

But the problem is that UAC interferes with your normal computer usage in ways that aren't intuitive or, I dare say, meaningful.

Lets get something straight here, I don't loath UAC because of the dialog boxes. Microsoft has come a long way since the diag fest of Vista prior to SP1. During the first hours that I used UAC, the boxes were always presented to me in the right moments and their presence made sense. My biggest beef with UAC is that it affects your daily file operations in the most annoying and strange ways. And I couldn't find any information on what the workflow for normal file operations is when yo have UAC turned on. Let me explain...

- I install a program and it goes into C:\Program Files.
- Now, I have on another drive a huge folder with backups and I want to replace many of the files on that program's Data folder (C:\Program Files\Program\Data) by those on the backups folder.
- When I try to copy over I get an Access Denied. This has something to do with that Program Files folder new protection mechanism. Very well. But I feel this is a safe folder to write to. So,
- I take ownership of C:\Program Files\Program\Data. I do notice that the folder ownership was already set to the Administrators group. That already spelled this wouldn't work. But I did it anyways. Then I give myself Full Rights.
- I try to copy the files now. Still Access Denied.
- So, Me, on a Administrator account, after having gained ownership of the folder and given myself full rights to it, am still denied a simple Copy and Replace operation?

... UAC was turned off. And with it one of the reasons I wanted to upgrade to Windows 7.

3. DirectX 11
I have only played a little. But with an ATI Radeon HD4770 with latest drivers, on 1440x900 I was able to play DX9 games like Fallout 3 or Bioshock on maximum settings and even gained 3-7 FPS over Windows XP and 10-15 (I believe... because I don't remember the actual vista numbers anymore) over Vista.

DirectX11 and Windows 7 DX9 mode has matured. I haven't tried any DX10 game yet. The only one I had was a pirated copy of FarCry 2 that I used to evaluate the game before buying. I didn't like it.

Of course, for folks like Bubba there there's more to it than just playing games. But can't help you there. I really have no clue, not I think I will ever want to have, about programming with DX. I can however vouch that, at least with these ATI drivers, there's even a gain for DX9 games under Windows 7 over XP.

4. Start Menu
I'm trying to get used to it. I seem to understand the logic behind the changes. I seem to think it makes sense. I seem to agree I may eventually get used to it. But so far I'm still trying.

Changing your All Programs folder is something that apparently you are encouraged into not doing. The way is to right-click All programs on the start menu and select Open (to open your user All Programs) or Open All Users (to open the "All Users" All Programs folder). However, the way the All Programs Folder is organized in the Start Menu makes it look like you aren't supposed to go there much. You can't, for instance, sort All Programs folders to your preferences anymore. I get a feeling Microsoft wants you to use the search box exclusively and to use other features like Pin to Start Menu.

This is one of the type of things that drew me away from Vista. When Microsoft one day does an Operating System that actually tries to adapt to the user, instead of forcing the user to adapt to it, I'll stop complaining.

We see the search box Microsoft! It's there. It's pretty and it's cool. Yeah, your improved search technology is awesome. Get it? Really. It is nice. Good. Now, don't flash it like some horny middle-age lunatic and let me use All Programs if I want to, how I want to.

I've only used Vista, not Win7, but here's my 2 cents...

Re: UAC
I know copying things into protected folders like "Program Files" is a huge pain in the butt. I managed to get it to work somehow, although I don't remember exactly how. But other than copying files, UAC isn't the the slightest bit annoying.

Re: Start Menu
Just right-click the Taskbar, click Properties. Click the Start Menu tab, and choose "Classic Start menu". It's the very first thing I do on any system higher than Windows 2000.

Just a note about UAC - you can run your apps with admin privileges. Especially older applications work better with this. When doing this, it can copy files anywhere. It's under the Compatibility tab in File Properties. Or you can just right-click and select Run as admin.
But UAC is screwed anyway, so I would suggest it stayed off.

I'll look into that. Didn't occur to me compatibility mode would also have an effect on UAC. But it does make sense, now that you mention it.

Quote:

---

Re: Start Menu
Just right-click the Taskbar, click Properties. Click the Start Menu tab, and choose "Classic Start menu". It's the very first thing I do on any system higher than Windows 2000.

---

Not anymore, I'm afraid. Windows 7 doesn't seem to have an option anywhere to display the Start Menu in Classic mode. Only option would be to go full Classic mode.

EDIT: However, newsflash! I didn't notice it before, but under Right-Click Start Menu->Properties, there's an option down the list that reads Sort All Programs Menu by Name. It's checked by default and unchecking it gives me the ability to sort the folders manually. Hurray, and I take back my critic.

What if you go into the System Properties (Right click the Computer icon & click Properties on Vista & below), click Settings in the Performance section of the Advanced tab, then start unchecking some boxes or just choose "Adjust for best performance"...? Would that switch to the good (i.e. classic) Start menu?

Quote:

---

Originally Posted by Mario F.

3. DirectX 11
I have only played a little. But with an ATI Radeon HD4770 with latest drivers, on 1440x900 I was able to play DX9 games like Fallout 3 or Bioshock on maximum settings and even gained 3-7 FPS over Windows XP and 10-15 (I believe... because I don't remember the actual vista numbers anymore) over Vista.

---

This horse is a winner!

Quote:

---

Originally Posted by cpjust

What if you go into the System Properties (Right click the Computer icon & click Properties on Vista & below), click Settings in the Performance section of the Advanced tab, then start unchecking some boxes or just choose "Adjust for best performance"...? Would that switch to the good (i.e. classic) Start menu?

---

You'll get full classic mode.

Which, by the way, I had found out meanwhile does look good if you alter the icon sizes default settings from big to small on both the desktop and taskbar, something that didn't occur to me at the time. So you may be pleased to know. And you even get to keep Aero Snap.

I'll be getting W7 the day it releases here. My friend at MS said they just had a huge release party and they are expecting a much better reception to W7 than Vista. Initially it sounds like your having mixed feelings about W7 Mario which to me is a good sign. When XP came out it wasn't all that great but then grew on you, got patched, and became a very good OS. The fact that W7 could probably be patched up to fix some of the minor annoyances is very good news.

Mixed reactions are good and expected. It's not like we are going to let some new OS beat out XP overnight - after all we have been using XP for a very long time. So if W7 did not instantly make you want to run back to XP or cause you to puke in your throat then I would say it just might be good enough to be the next good MS OS.

And let's be fair to XP here on the DX11 numbers. DX is just an interface - it really comes down to the drivers behind the interfaces. It appears that the driver status for W7 is in a much better condition than Vista was at release. This is clearly evidenced by your numbers. Any gain in the DX/D3D department is good news indeed. Mark my words if W7 does become the next XP, DX11 will rule the roost. If not then we have many more years of DX9. Oh and DX10 barely registers on the radar. I expect W7 will pan out and DX9 will get dropped overnight.

The Vista dev team did do one good thing for the W7 dev team. People were so horrified by Vista that the W7 dev team really didn't have to worry about competing with it b/c any change would have been a good one. If the product before yours sucked really bad it's a good bet that any improvement offered by yours will be accepted with open arms.

XP is clearly the measuring stick for W7.

Quote:

---

Originally Posted by Bubba

So if W7 did not instantly make you want to run back to XP or cause you to puke in your throat then I would say it just might be good enough to be the next good MS OS.

---

Yup. It's been over 48 hours now and I'm not regretting having done the upgrade.

I'm still struggling to get used to it (the Windows Explorer being one case, and getting to know all these new windows services, another) but I feel this is mostly to do with being a new windows experience as you mention, and necessarily also lack of knowledge that can only be gained from experimenting with it.

But I'm starting to have that comfortable feeling that everything is alright. No need to panic. Windows 7 is not going to let me down in any significant way and is indeed an improvement over XP. Thank goodness. About time.

Knowing you Bubba, I think you'll be happily impressed too.

...

I do want however to gain a lot more in-depth knowledge of the UAC. I feel this is an interesting and important feature of the OS that we shouldn't neglect. I want to believe the problems I'm having with it are just because I don't know it that well yet and because it means I'll have to adapt to news ways of doing things (which on this particular case I personally feel justifiable since I was never an admirer of user level security, or the lack thereof, on previous versions of windows).

A nice find:

If you right click a process in your task manager and select Go To Services, it will show you the full services list with all the services attached to that process highlighted.

Speaking of UAC...

(I aware I'm triple-posting. My apologies if this bothers you. But I feel the wake-up call justifies this)

The best source of Information I could find to truly understand its mechanisms, its related technologies and how to properly use them, can be found by reading Mark Russinovich's extensive article on the subject: Inside Windows 7 User Account Control.

I really suggest you take his proposed side-step before taking on the article text and watch the conference presentation and read the article text linked to on the second paragraph (in this order). These pertain to Windows Vista, but the model is pretty much the same on Windows 7 and you'll gain a lot of important knowledge.

With that baggage, you then should proceed to the third link in the third paragraph that will further your understanding.

Only then I suggest you get to the article proper. Be ready for a lengthy process. It took me around 4 hours to sort of skim through the whole thing and I'm now readying myself to go through it all over again, this time a lot more slowly and testing things as I read them.

...

Full understanding of the UAC family of technologies will give us all the tools we need to effectively run our systems under non-privileged user accounts without that meaning loosing any of the power-user abilities that are so dear to us. We will also be able to better understand why certain seemingly "odd" things happen that aren't odd after all. Just mean we have to do things in a different way.

...

My initial perception is a bit of a contained praise.

A praise because I do think they pulled it off. We have a highly secure operating system with access to administrator privileges under an unprivileged account, in a way mimicking Linux functionality.

It's all the more surprising to me because I honestly never thought they could pull it off in this way. Linux users (and windows users alike, truth be told) tend to mock windows security features (UAC included) as ineffective. But it becomes very clear right from the onset of this article that the reason for this was a consequence of Windows success coupled with a very bad decision made a long, long, time ago. As software developers (that's us too -- the ones who also criticize windows security. There's a irony here) kept developing software assuming full user privileges, the noose around Microsoft hands got tighter and tighter. Up to a point where only such a complex solution as UAC could provide an answer, while other systems took the right decision earlier and now have a much simpler approach because they never had to deal with legacy code that tried to make a mess of an hypothetical UNIX system that didn't implement user account security features.

However its a contained praise because there are a few things I feel aren't just quite right yet.

For one, It's really strikes me as odd that, with UAC since Vista, windows keeps not offering the choice to create a unprivileged user account during setup. This would be of utmost importance, because after that stage most users will not know, or care to learn, how to setup new user accounts. So, they'll keep running their systems under Admin rights, which despite being better protected by UAC, is still no match to the nearly full proof security offered by a standard user account.

But also the fact UAC dialog boxes (Orange, Grey and Blue) are not properly documented. Most importantly, they are not properly documented for unknowledgeable users. This is a very important piece of information that could help reduce the click-through effect UAC suffers. If users cannot understand the purpose of these boxes, they'll quickly start clicking through them whether it is a good thing or not. Under a Admin account that will still be the primary account because of the problem on the previous point, this is essentially the same as turning UAC off. Better text describing the dialog box color and more information describing the dialog box contents should be inserted in each prompt.

In what way is UAC more flexible than good ol' Run As?

Not sure I understand the question SMurf.

UAC offers elevated privileges through a Run As Administrator prompt if you so wish. On Vista this didn't work well because what it essentially did was calling on the Administrator profile (same as Windows XP and below). But on 7 you get a straight user rights elevation. Meanwhile for certain Microsoft Published digitally signed file extensions and if they are located in the right folders, you'll get silently elevated (after accepting the UAC prompt) too.

However, without UAC and relying only on the previous "Run As..." approach, you cannot for instance implement separation between user accounts. If you install a program under "Run As..." it's your administrator account HKEY_CURRENT_USER that will be updated. Meanwhile, if the program doesn't write correctly to the registry, it will be HKLM the one being written. With UAC, HKLM is protected and any legacy application writing to HKCU will do so on the elevated user account. Not on the administrator account, giving it full admin rights.

I'm sure there are more, and more important, differences I could present later. But as I said I'm still studying the subject.

UAC is basically the same as sudo on UNIX.

Yup. It essentially implements proper user access privileges. Something that was missing from previous windows versions. UAC prompts are just the visible part and one portion of the technologies involved.

Running under a standard windows account will give a better feel for UAC features and advantages. Something that Linux users are accustomed to since birth. Under an Admin account, while still offering some forms of protection, UAC really has a lot less appeal and cannot provide other forms of protection (also something that any Linux user running as root understand for years).

Russinovich is tireless in repeating that UAC is essentially a set of technologies meant to allow users to effectively use their computer as standard unprivileged users. This is in my opinion one of the sources of confusion of this technology. Under a standard account UAC acts as a security boundary, while under an Admin account, it does not.

When sometime recently a UAC whitelist attack was exposed, Microsoft reaction to it was controversial. They basically replied with "This is not a security problem and we aren't going to fix it. This is by design". They did end up removing run32dll.exe auto-elevation. Which is just fine. But I cannot stop feeling they are right indeed.

Under admin rights, UAC is not a security boundary. This is an important thing to take into consideration. In plain English it means that if you want to run your computer as root, you do it at your own risk. Something that any Linux user knows. In more technical terms it means UAC doesn't implement enforced privilege separation under Admin rights. Which any Linux user also knows when they run as root.

Note: I suggest reading that Russinovich's article and experimenting through it while under a standard windows account. Very enlightening.

O_o

I only skimmed the various articles you've linked so you must forgive me, or not I don't really care, for asking for some direction/clarification.

Am I right in my thinking that this "UAC" "exploit" only works for a user logged in to an account with administrator privileges?

Quote:

---

UAC is basically the same as sudo on UNIX.

---

Well, with `sudo' the administrators have finer control over who can do what. (Or can you really use "UAC" to give specific non-privileged users "Program Files" installation rights but not other users?)

Soma

Quote:

---

Originally Posted by phantomotap

Am I right in my thinking that this "UAC" "exploit" only works for a user logged in to an account with administrator privileges?

---

Yes. Because Run32DLL.exe is part of the trusted group of applications (several file extensions that ship with windows, are digitally signed Microsoft Publisher, and belong to an internal list of Ok applications) it is silently elevated. However under a standard account, there's no silent elevation of anything and run32dll.exe fires a UAC prompt along with an admin password request, ala sudo.

Some detractors complain, but we need admin rights because certain applications don't run without admin rights. They tend to not understand that is exactly what UAC is for. To allow them to use a standard account and still use these applications, ala sudo. UAC is an effort to have us switch our minds into starting to use windows from a standard unprivileged account. Forever putting admin accounts to rest for daily normal usage.

In any case run32dll is indeed a special case. And later Microsoft did remove it's auto-elevated privilege. So now, the exploit does't work anymore under an admin account. Well, it works, if you say yes to the UAC prompt you are seeing in front of you asking if you really want for Run32DLL.exe to execute that strange looking DLL from a temporary folder named rtxyhhxsrdt.

Quote:

---

Well, with `sudo' the administrators have finer control over who can do what. (Or can you really use "UAC" to give specific non-privileged users "Program Files" installation rights but not other users?)

---

Good point. Admin in windows is indeed more restrictive than root under Linux. The only account that really has full control is SYSTEM. As my UAC misinformed complain on the very first post of this thread clearly demonstrated, a full admin still doesn't have full control over the system.

So there's quite a bit of adapting to the new rules and new ways of doing things. From my first experiments during the past hours, this is a lot more transparent for standard unknowledgeable users running off a standard account. They will be doing things as they usually did with just the "annoying popups" showing up once and awhile. For power users running under a standard account or under an Admin account there's more adapting and some frustrating moments until the concept is fully realized. Definitely, if like me, they come from Windows XP.

However to answer your question directly, yes. An administrator can change user account rights through the Local Security Policies administrative tool. And because of UAC you don't need to login as an administrator. You just insert an administrator password when you fire it from a standard account. Familiar?