Enabling Non-Administrators to Make Configuration Changes

Standard user accounts in Windows Vista can make configuration changes that don’t compromisevthe computer’s security. For example, standard user accounts in Windows Vista have thevright to change the time zone on their computers, an important setting for users who travel.vIn Windows XP, ordinary user accounts do not have this right by default, an inconveniencevthat causes many IT professionals to deploy accounts for mobile users as administrators and sacrifice the security benefits of using ordinary user accounts. Additionally, standard users can now connect to encrypted wireless networks and add VPN connections—two tasks commonly required by enterprises.

However, standard user accounts in Windows Vista do not have the right to change the system time because many applications and services rely on an accurate system clock. A user who attempts to change the time is prompted for administrative credentials.

Some applications do not run in Windows XP without administrative privileges because these applications attempt to make changes to file and registry locations that affect the entire computer (for example, C:\Program Files, C:\Windows, HKEY_LOCAL_MACHINE), and standard user accounts lack the necessary privileges. Registry and file virtualization in Windows Vista redirects many of these per-machine file and registry writes to per-user locations. This feature enables applications to be run by a standard user, whereas on previous operating systems, these applications would have failed as standard user. Ultimately, this will enable more organizations to use standard user accounts because applications that would otherwise require administrative privileges can run successfully without any changes to the application.


Source of Information : Windows 7 Resource Kit 2009 Microsoft Press