Most newer programs work with UAC’s privilege escalation on-the-fly. But there will be times when that won’t work, especially with older programs. You can run any program with administrative privileges by right-clicking its startup icon and choosing Run as administrator. The same method works for programs that you can’t launch from the Start menu. Use Windows Explorer to get to the folder that contains the executable file for the program.

Then right-click the filename and choose Run as administrator. You can make older programs that aren’t part of Windows Vista run with elevated privileges automatically by changing program compatibility settings. Right-click the startup icon for the program, or the executable file’s icon, and choose Properties. In the Properties dialog box, click the Compatibility tab. Then under Privilege Level, select Run this program as an administrator and click OK. If the option to run the program as an administrator is disabled, then either the program doesn’t require administrative privileges to run, you are not logged in to an administrative account, or the program is blocked from always running elevated.

Add the Built-in Administrator Account to the Login Screen

The built-in Administrator account is intentionally hidden to keep out users who don’t have sufficient knowledge to understand the risks involved in using such an account. Typically the only way to get to it is by starting the computer in Safe Mode. If you’re an advanced user, and want to be able to get to that account from the login page, you just have to enable the account. Here’s how:

1. Log in to an account that has administrative privileges.

2. Click the Start button, right-click Computer, and choose Manage.

3. In the left column of the Computer Management tool that opens, click Local Users and Groups.

4. In the center column, double-click the Users folder.

5. Right-click the Administrator account and choose Properties.

6. Clear the checkmark next to Account is disabled and click OK.

7. Close the Computer Management window. When you log out of your current account, you’ll see the Administrator account on the login page. It will also appear there each time you start the computer.

Stop Entering Password on Lockout

In Windows Vista If you leave the computer for a few minutes without logging out, you’re taken to a lockout screen that shows your user account information. If your user account is password-protected, you need to enter your password to get back to the desktop. This is to prevent other people from using your computer while you’re away. But it only makes sense in a work environment. In a home environment, it may be overkill. You can reconfigure Vista so that you don’t have to re-enter your password to get back to your desktop. Here are the steps:

1. Click the Start button, type pow, and click Power Options.

2. In the left column, click Require a password on wakeup.

3. If the options under Password protection on wakeup are disabled, click Change settings that are currently unavailable. Then elevate your privileges by clicking Continue or by entering the password for an administrative account.

4. Choose Don’t require a password.

5. Click Save Changes.

Advanced Security Tools

IT professionals and highly experienced users can continue to use Local Users and Groups and Local Security Policy consoles for more advanced security configuration. Options in those tools are beyond the scope of this book, and not the kinds of things the average home user wants to mess with. To get to Local Users and Groups, click the Start button, right-click Computer, and choose Manage.

About Windows CardSpace Windows CardSpace lets you store user account information for online services that support the CardSpace feature. It’s a means of creating a digital identity that can be used instead of a username and password to log in to online accounts that support the CardSpace feature.

Some of you might be more familiar with the term InfoCard. CardSpace is basically a new name for InfoCard. CardSpace adds security to Web relationships by encrypting data in your card before sending the information to a Web site. You can also review cards from Web sites that use them to get more information about a site before signing up for an account. As I write this section, CardSpace is entirely new and not many Web sites support it. Whether or not it catches on as a technology remains to be seen. But the idea is fairly simple. You can create one or more digital cards, each with whatever information you want to provide to Web sites with whom you do business. For example, you might want cards that include only your name and no further identifying information. Other cards might include your street address and phone number. When you set up an account with an online site that supports CardSpace, you can send your card rather than filling in blanks on their user form. Once you’ve established an account, you can submit your card whenever you need to log in to the site.

There are two kinds of cards you can use:

- Personal cards: These you create yourself, and provide to online Web services as you see fit.

- Managed cards: These are like membership cards provided to you by organizations and businesses that support the CardSpace identity system.

Because there are currently no Web sites that support the CardSpace feature, there’s nothing I can demonstrate here. About the only thing I can do is tell you how to get to the program for managing your cards. Use whichever method is easiest for you: - Click the Start button and choose Control Panel  ->  User Accounts and Family Safety  ->  Windows CardSpace. - Tap the Windows key, type card, and click Windows CardSpace. If you’re taken to a welcome page, click OK to proceed. To create a personal card, click Add a card in the right column. Click Personal Card and fill in whatever blanks you’re comfortable with. You might want to start by creating a basic card that contains your name, e-mail address, and perhaps a picture or logo. You can create other cards with more information, if necessary, for sites that you trust with that information. You don’t create managed cards yourself. Instead, you set up an account with a service that uses managed cards. When you receive such a card, you’ll likely get instructions on its use. But the basic procedure is to go into CardSpace, click Add a Card, click Install a Managed Card, and then import the card that the online service has sent you.

If the CardSpace technology catches on, you’ll be able to access your cards right from your Web browser. When you go to log in to a site, you’ll see an option to log in the traditional way through a user account and password, or by using CardSpace (or an InfoCard). Click the option to use CardSpace, click the card you want to use, and you’re logged in. When two or more people share a computer, user accounts let each person treat the computer as if it was their own. Each user can personalize settings to their liking, and keep their files separate from other users. User accounts also work in conjunction with parental controls. A parent can set up a password-protected administrative account, and then use that account to set up parental controls. Create standard accounts for children, and allow them to log in to their own accounts only.

User accounts also add security to your system by making all users run with limited privileges. The general term for security through user accounts is User Account Control (UAC). Some key points to keep in mind: - At least one person should play the role of administrator for the computer. That person should create a password-protected user account with administrative privileges. - The administrator should also create a standard account for himself, and one for each person who shares the computer. - All users (including the administrator) should use their standard accounts for day-to-day computing. - All the tools for creating and managing user accounts are accessible from User Accounts and Family Safety in the Control Panel.