2. Crispin Cowan, PhD Senior PM, WinCore Security Microsoft Corporation PC51

6. Default account type

7. Much more secure, but much less convenient Will get better in future releases, want it to be the default

8. Petit Demo

11. Things an Administrator Can do

12. Things an Administrator Can do Things a standard User can do Things a standard user can do

13. Things an Administrator Can do Things a standard User can do Things a real user Needs to do

14. Things an Administrator Can do Things a standard User can do Things a real user Needs to do These are UAC elevations

15. Things an Administrator Can do Things a standard User can do Things a real user Needs to do These are UAC elevations They allow the user to do privileged operations when needed

16. Things an Administrator Can do Things a standard User can do Things a real user Needs to do These are UAC elevations They allow the user to do privileged operations when needed While highlighting that these are privileged operations that you don’t want to happen without your consent

38. Low Privilege Application Low Privilege Application High Privilege COM Object High Privilege COM Object Malware Malware can press buttons on low application, Causing bad things in high COM object

40. Low Privilege Application Low Privilege Application High Privilege COM Object High Privilege COM Object Malware Malware cannot press buttons on high COM GUI, Protected by UIPI High Privilege COM GUI High Privilege COM GUI

51. XKCD 327

54. Please fill out your evaluation for this session at: This session will be available as a recording at: www.microsoftpdc.com

56. © 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.