User Account Control (UAC)

User Account Control (UAC) is the feature that enables Vista to be able to run more reliably without giving the user local admin rights to the system. This does result in some additional dialog boxes and warnings that pop up for users but in the end can reduce the damage that malware can do to a computer.

Credit: Diana Huggins

UAC on by default

User Account Control is enabled by default in Windows Vista. Microsoft recommends leaving it enabled to protect against the installation of malicious software. The Security Center will indicate whether UAC is turned on.

Credit: Diana Huggins

Customizing UAC through local computer policy

Further to enabling/disabling this feature, you can control the behavior of UAC through the local computer policy.

Open the Local Computer Policy and navigate to the following locations: Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.

Credit: Diana Huggins

UAC Admin Approval Mode

User Account Control: Admin Approval Mode for the Built-in Administrator Account

The default value for the UAC policy setting is Disabled for new installations and upgrades when the built-in Administrator is not the only active local administrator account on the computer.

Credit: Diana Huggins

UAC Elevation prompt for admins

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode.

This security setting determines the type of prompt an admin-level user will receive when they attempt to perform an admin-level task. The default value is Prompt for Consent. You can increase security by setting the value to Prompt for Credentials. Doing so means the admin-level user will need to enter their admin-level username and password.

Credit: Diana Huggins

UAC Elevation prompt for standard users

User Account Control: Behavior of the elevation prompt for standard users

This security setting determines the type of prompt a standard user will receive when they attempt to perform an admin-level task. The default value is Prompt for Credentials.

You can increase security by setting the value to Automatically deny elevation requests. Standard users will then have to perform admin-level tasks using the Run command or by logging in with an admin-level account.

Credit: Diana Huggins

Windows Defender scan scheduling

Windows Defender is configured to scan your computer every day at 2:00 AM. This schedule should be changed if the scan can not be performed at this time.

You should enable the Check for updated definitions before scanning option. This is your best bet for ensuring the software is up-to-date with the latest definitions. Otherwise you must be diligent enough to manually check for updates on a regular basis.

Note: Windows Defender should be used in conjunction with third party anti-virus software.

Credit: Diana Huggins

Configuring Windows Defender with Local Computer Policy

There are several settings within the Local Computer Policy for controlling how Windows Defender behaves. The settings you configure will be specific to your requirements of your computing environment.

For example, if WSUS is used to deploy updates to Windows Defender, you should consider enabling the Turn on definition updates through both WSUS and Windows Update. In the event that the WSUS server in your environment is unavailable, Vista will use Windows Update to check for new definitions.

Credit: Diana Huggins

Malicious Software Removal Tool

Even with the appropriate security measures in plan, there is still the risk that an instance of malware can go undetected by your anti-virus software or even disable it. The Malicious Software Removal Tool is designed for such situations. When the tool is run, it detects and removes any malicious software it finds on your computer.

Although the tool is not necessary if you are running up-to-date anti-virus software, it does provide another layer of protection.

Credit: Diana Huggins

Malicious Software Removal Tool scan options

The tool is installed with Windows Vista and is available as a free download for Windows XP. You can locate the tool by typing mrt.exe in the Search field on the Start menu.

When the tool is run, you can choose the type of scan to perform. As you can see from the exhibit, you can perform a Quick, Full or Custom scan.

Credit: Diana Huggins

Malicious Software Removal Tool - Quick Scan

If you choose a Quick scan, the Malicious Software Removal Tool will scan the areas of a computer that are likely to contain malicious software.

With a Full scan, the entire system is checked for malware. You should perform a Full scan every once in a while but be advised that it can take up to a few hours depending on your system.

Finally, you can opt to perform a Custom scan and choose the folders or areas of your computer that you want the Malicious Software Removal Tool to scan.

Credit: Diana Huggins

Malicious Software Removal Tool scan results

The results of the scan will indicate whether any malicious software was found on your computer.

Credit: Diana Huggins

Software Restriction Policies

Software Restriction Policies are yet another way that you can protect your computer from malware. You can use them to control what software users can run on a computer and prevent certain executables from running.

Credit: Diana Huggins

Internet Explorer 7 Security Tab

Internet Explorer has its own set of security options that can be used in conjunction with the other technologies discussed to protect your computer. IE7 in Vista now operates in a quarantined corner of the OS, where it can no longer allow spyware, adware, and various malware threats to have an open door into the throne room.

From the Security tab, you can enable Protected Mode. This feature prevents malicious users from changing any files or settings without your explicit permission. It is enabled by default for all security zones, except the Trusted Site zone.

Credit: Diana Huggins

Internet Explorer 7 Phishing Filter

IE 7 protects against phishing scams through the Phishing Filter. It is designed to protect against phony Web sites that attempt to gather personal information about you when you are online.

The tool requires little to no configuration. Once it is enabled through the Internet Properties window, it will run in the background without your intervention.

Credit: Diana Huggins

Windows Firewall profiles

In Windows Vista, the firewall is now more advanced because it lets you create and apply specialized rules depending on the type of network you are connected to.

Windows Firewall with Advanced Security supports three different profiles that are based on three common environments: Domain, Public and Private.

The profile that you apply will be based on the network you are connected to. If you connect your computer directly to a Public network such as the Internet, the Public profile should be applied.

Credit: Diana Huggins