What's New in Beta 2? - User Experience

  • Article

Hi, I am Jennifer Allen, a technical writer in the Windows Security Core team. I write technical documentation for UAC, including information for IT pros, developers, and end users. Why am I posting about UAC Beta 2 updates? Well, Windows Vista Beta 2 is hot of the press and ready for you to install, test, and enjoy. You can get the latest Windows Vista beta by registering in the Windows Vista Customer Preview Program. Please note that this is beta code and should not be used in a production environment or on a main machine in the home.

Okay, onto UAC and the Beta 2 “goodness,” as Darren Canavor says. This first post will focus on the user experience (UX) updates that have taken place in Windows Vista Beta 2 versus Beta 1 and the last CTP. I'll follow up this post shortly with a discussion of Group Policy updates in Windows Vista Beta 2.

Several elements of the UAC UX have changed since Windows Vista Beta 1. The first thing that you will notice about the variance in the Beta 2 UX to the Beta 1 UX is the fact that UAC is enabled by default.

This blog post is intended to summarize the main UX updates that occurred in Beta 2. If you would like to read more about the UX changes, you can check out the following two documents:

Getting Started with User Account Control on Windows Vista Beta 2 – Details the Beta 2 UX and basic configuration options. This document also provides information for deploying Windows Vista with UAC enabled in enterprise (managed) and home (unmanaged) environments.

Understanding and Configuring User Account Control in Windows Vista Beta 2 – Detailed information for IT Professionals, including conceptual information, configuration options, configuring and “fixing” legacy applications for Windows Vista and UAC compatibility, and deploying applications for standard users (enterprise).

Elevation Prompt Updates

New Elevation Prompt UI

Figure 1 is an example of a Beta 2 UAC consent prompt.

Figure 1 – Beta 2 UAC Consent Prompt

Figure 2 is an example of the Beta 2 UAC credential prompt.

Figure 2 – Beta 2 UAC Credential Prompt

Contextual UAC Elevation Prompts

The UAC elevation prompts now include contextual information about the programming requesting elevation, including the name of the program requesting elevation and the application’s publisher.

Application Aware Elevation Prompts

The UAC elevation prompts are also customized based on the type of executable that is requesting elevation. The following diagram (Figure 3) illustrates the different UAC prompts that are displayed based on the type and state of the requesting executable. This behavior is the default for Windows Vista and is not configurable, with one exception-- the ability to configure blocked applications with Group Policy and to block applications that are not signed and validated.

Figure 3 – Application Aware Elevation Prompts

The following details the elevation prompt color-coding:

  • Red background and red shield icon: The application is from a blocked publisher or is blocked by Group Policy.
  • Blue/green background: The application is a Windows Vista administrative application, such as a control panel.
  • Gray background and gold shield icon: The application is Authenticode signed and trusted by the local computer.
  • Yellow background and red shield icon: The application is unsigned or signed but not yet trusted by the local computer.

The color-coded elevation prompts align with the color-coded dialog boxes in Microsoft Internet Explorer.

UAC elevation prompts on the secure desktop

Windows Vista displays UAC elevation prompts on the secure desktop by default in Beta 2. Jim Hong’s Secure Desktop blog posting details this Beta 2 feature.

Hello Shield Icon, Goodbye Lock

Because the shield icon has historically been used to represent security entry points in Windows, it is also now used in place of the Beta 1 “lock” icon to mark elevation entry points. Elevation entry points are places within the user interface (a button or link control) that require a user to access a full administrator access token to proceed.

Some control panels, such as the Date and Time Properties control panel, contain a mix of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. Figure 4 is a screenshot of that control panel.

Figure 4 – Date and Time Properties control panel

The shield icon is also used in Beta 2 to mark elevation entry points on an executable’s icon. Figure 5 is an example of a shield icon overlay.

Figure 5 – Shield Icon Executable Overlay

This icon overlay marking is performed by Windows Vista by default. To see for yourself, drag an executable that requires an administrator access token onto your Beta 2 desktop. A shield icon will be placed over part of the executable’s icon.

That's all for now; I'll post about the updated Group Policy settings tomorrow.

JA Allen