Vista's UAC a headache to your IT team? BeyondTrust offers a solution

Computerworld - A small software vendor says it has the solution for IT administrators already beset by complaints from Windows Vista users over one of the new operating system's key security enhancements.

Portsmouth, N.H.-based BeyondTrust Corp. said today that it has ported its Privilege Manager software from Windows 2000 and XP to Vista, including 64-bit versions of the Microsoft Corp. operating system. Privilege Manager relies on the same "principle of least privilege" behind Vista's new User Account Control (UAC) feature.

In earlier versions of Windows, all users by default run as administrators, a move that can create security holes. UAC lets standard users know whenever an administrator-level action is about to take place, and it allows them to choose whether to go ahead. That has led to user complaints about UAC's intrusive repetitiveness, which they argue can be alleviated only with the drastic step of bypassing standard user mode for administrator mode. But making that change reduces their level of security back to XP levels.

Rival security vendor Symantec Corp. claims that UAC can still be tricked, and Apple Inc. parodies UAC in its commercials.

Marco Peretti, chief technology officer of BeyondTrust, sympathizes with Microsoft, which he said does not want consumer users to customize UAC for fear that they could increase their own security risks.

Privilege Manager enables all applications -- whether in XP or Vista -- to run without administrator-level access. It also gets around Vista by letting administrators set user rights and privileges that are transparent to the end user. This way, users can still enjoy UAC-level protection in Windows 2000, XP and Vista, but without the pop-up dialog boxes.

The software is already used by about half a million paid users, according to the company. Gwinnett Medical Center has been using Privilege Manager for three years with more than 7,400 employees and doctors, most running Windows XP or 2000, according to Keith Brown, network administrator. He plans to use the software with Vista once the Lawrenceville, Ga.-based hospital upgrades to the operating system.

Rewriting Privilege Manager to work on Vista involved changing the way the software hooked into the version of Windows, though Peretti declined to elaborate. He said the software, while theoretically vulnerable to tampering by skilled hackers, is at least a less tempting target than Vista. Privilege Manager 3.0 starts at $30 per seat.

Natalie Lambert, an analyst at Forrester Research Inc., said Privilege Manager can "help keep overall management costs down by allowing IT to have more control over systems by keeping them locked down."

However, Lambert also said that "this functionality does not belong as a stand-alone product. Enterprises today are already dealing with a management nightmare of too many products. This functionality should be folded into a larger client management product, such as IBM Tivoli Provisioning Manager or HP Radia, to better address the needs of businesses."

BeyondTrust has at least two close rivals that do just that or offer related complementary products. Altiris Inc. has its Application Control Solution. Attachmate Corp. offers NetIQ IntelliPolicy, which Sacha Dawes, senior product marketing manager at the company, claims is more powerful than Vista's UAC because it offers, for example, control over USB ports.

Neither company has offered a timetable on when it would offer a Vista version of it products.

Read more about security in Computerworld's Security Knowledge Center.