Snapster: Your argument doesn't match your conclusion. If questionably coded programs require elevated rights when they “really don't need to” than I have two choices. I can use the program or I can not use the program. If I chose to use the program, than I have no choice but to allow it elevation. If I decide to allow the program to run, how does providing credentials each and every time, protect my system more than giving it permission to always run elevated? The fact is that there is no benefit, and instead, the policy actually creates a larger security risk, because all limited users must be given an administrative password to run programs that I have decided are safe. Simply typing in a password each time does not make the program any more or less safe. An administrator should have a tool to allow specific programs to run elevated, without prompt, for all or specific users. Using Task Scheduler, as you suggested does not work in a limited account. It will only prevent the inconvenience of having to click “OK” in an Admin account to run a program. It does nothing to prevent the security risk of needing to supply Admin credentials to limited users.
I'm sure you know the decision behind UAC is to protect the system from harm from
malicious programs. You have to keep in mind the Windows ecosystem where the typical users are simple minded and like to click on and run everything they touch. Having Windows prompt you to confirm any modifications to the registry / protected file system location when a program requests it far better by design than not having it at all. Whilst it's not always suitable for power users out of the box, collectively it's helping idiots protect themselves and help reduce (not eliminate) the spread of suchmalicious programs.
As Microsoft did not enforce such restrictions in the past, an unfortunate side effect is that legacy and poorly coded programs, have always assumed administrator rights to the whole system. Run on Vista/Windows 7 as an administrator will trigger the elevated permissions prompt, run as a standard user will either trigger the prompt or not run at all (depending on the policy of the machine).
The ideal scenario as already pointed out is to have updated programs that can run under any user account once installed by an administrator, like Photoshop can for example. Whilst obviously favourable, this is not always achievable as companies have little in it for them to update old programs and would rather you purchased the newer versions which should be compatible, or perhaps they no longer support the program.
I do think you missed what I was originally getting at. I was suggesting that having the prompt is better than not having it at all, rather than saying always providing credentials is better than providing it once.
In your point that providing credentials each and every time is no more secure than giving it permission to always run elevated, I would say this is not always true. Say for example you allowed the program C:\Users\BigDaddy\SuperCool.exe to run on startup with full permission. If I was to somehow replace that program with my own hand crafted program that deletes files from your pc and it then runs next time any user logs in, would that be more or less secure than you thought it was? Of course most good operating systems won't allow a modified version of program to run without re-providing credentials in such cases due to crc checks.
Back to the scheduled tasks, with a little bit of work you can run scheduled tasks with admin privileges when logging in as a standard user. The adminstrator has to create the task, set it to run when any user logs on, and run with highest credentials. The only difficultly doing it this way is that the application is run under the admin user's session and not the limited user, so this is fine for services or unattended applications but if you need the gui then your SOL. UAC Trust does exactly the same thing, but provides a GUI to do all the hard work for you.
You can also wrap the applications you want to start up in a windows service, but that is allot of work, and perhaps would not be the road for you to go down.