Windows 7's UAC Slammed by Sophos

Microsoft and software security firm Sophos are at it again, this time arguing about the effectiveness of Windows 7's user account control (UAC) feature.

UAC is an administrative access control that provides security warnings to end users each time a system change is about to be made. It first showed up in Vista and Windows Server 2008, enabling better administrative control of user network privileges. Microsoft refined the UAC in Windows 7 after users complained about seeing annoying pop-ups.

However, the issue for Chester Wisniewski, a Sophos security staffer, was purely about the security protection afforded by UAC in Windows 7.

"UAC's default configuration is not effective at protecting a PC from modern malware," Wisniewski wrote in a Sophos blog post last week.

Sophos came to that conclusion based its testing of UAC. Those tests involved a clean install of Windows 7, running it without antivirus protection. Next, the Sophos team added "10 unique samples" of malware to the PC. The UAC failed to block eight of the ten viruses from running, according to the blog.

Paul Cooke, Microsoft's director of Windows enterprise client security, responded to Sophos' claims in a blog post this week.

Cooke pointed out that malware usually gets onto a workstation via Web browsers. Had the malware been encountered via Internet Explorer 7 or IE 8, those browsers would have notified the users of the threat via Microsoft's SmartScreen filter prior to download. Cooke claimed that Sophos' test results are skewed because the samples were apparently just added to the computer and run.

However, Cooke did suggest a common ground for agreement, saying that Windows 7 shouldn't be run without antivirus software. He accused Sophos of grandstanding to sell its software, and inserted a plug for Microsoft Security Essentials, a free consumer antimalware solution that was rolled out in late September.

"While, I'm not a fan of companies sensationalizing findings about Windows 7 in order to sell more of their own software, I nevertheless agree with them that you still need to run anti-virus software on Windows 7," Cooke wrote. "This is why we've made our Security offering available for free to customers."

Sophos makes security solutions for small businesses and the enterprise, so the consumer-oriented Microsoft Security Essentials isn't supposed to be a direct competitor to Sophos' products.

The UAC spat is just the latest disagreement between Sophos and Microsoft. In September, a Sophos official complained about the security of XP Mode, a virtualized Windows XP desktop that runs on Windows 7. In that discussion, the Sophos official called XP Mode "a potential security disaster."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Silver Pins

    Microsoft Teams Sprawl: What It Is and How Partners Can Fix It

    Microsoft Teams is having its boom period and the remote-work revolution is driving it. But for many organizations, that hasn't been without its downsides.

  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • Privacy Management for Microsoft 365 Hits 'General Availability'

    Microsoft's Privacy Management for Microsoft 365 hit the "general availability" milestone on Tuesday, according to the company.

  • Notebook

    Sikich Acquires Gold Microsoft Dynamics Partner PA Group USA

    There's some consolidation happening in the Microsoft Dynamics space this week, with Sikich LLP announcing its plan to acquire Dynamics specialist PA Group USA.