According to Microsoft, it's the most secure operating system the company has ever produced. Five years in the making, Windows Vista promises to lock down the desktop and usher in the era of "trustworthy computing," in which PCs are more reliable, user experience is improved, and rampant malware is a thing of the past.

Just three months into the official commercial release of the OS, however, questions are flying. Anti-malware vendors, hackers, and security experts have raised doubts as to the efficacy of Microsoft's new security measures, with one -- blogger Joanna Rutkowska -- going so far as to suggest that Vista's security model might be merely "a big joke."

Microsoft is always an easy target, especially when it makes extravagant claims. The truth is that early testing suggests Vista is significantly more secure than previous versions of Windows.

That doesn't mean that the new OS signals an end to Windows security headaches. Some of the pain for IT administrators will subside, but weak spots and their work-arounds should be top of mind as always.

Administrator no more

One of Windows Vista's most lauded security enhancements is also one of the most criticized. UAC (User Account Control) aims to address a long-standing flaw in how Windows handles user permissions, but its detractors say it doesn't offer enough protection and that inadequate design undermines its effectiveness.

At issue is the role of the administrator account. Best practices dictate that a user should be assigned administrator privilege only when performing tasks that require it, such as installing device drivers or changing the registry. But part of the legacy of DOS is that older versions of Windows were essentially single-user systems. Even on Windows XP, which was Microsoft's first multiuser client OS, users would routinely log in as administrator by default, even for mundane tasks.

This practice made workstations easy to manage but was a security disaster. When a user is logged in as administrator, worms and Trojan horses have free rein to run amok. Worse, Microsoft's inattention to user permissions encouraged ISVs to use sloppy, insecure programming practices that compounded the problem. Many Windows applications simply would not work unless they were allowed to run with full administrator privilege -- that is, to run in the least secure way possible.

UAC attempts to correct these bad habits. Under UAC most software runs at reduced privilege by default. When an application attempts to do something that requires administrator privilege, UAC prompts the user with a dialog box asking for permission to "elevate" the application to the increased privilege level.

Unfortunately, UAC is not perfect. On her blog, Joanna Rutkowska details several flaws in Vista's UAC implementation that are potentially exploitable. For example, software installers are always allowed to run with full administrative privilege, just like in old-fashioned Windows. In addition, Symantec security analyst Ollie Whitehouse points out that Vista ships with executables that can be used to compromise UAC.

"I still think that Microsoft did a good job with Vista," Rutkowska says, yet the significance of these discoveries is clear: Don't expect UAC to eliminate problems associated with the administrator account overnight.

Programmatic exploits aren't the only way around UAC's protections, either. User behavior is equally critical. UAC confirmation dialogs can be intrusive and somewhat cryptic. Users might be tempted to simply disable UAC out of frustration, or they might become so numb to the UAC warning messages that they click "OK" without thinking. What's more, they can easily be tricked into doing the wrong thing using social engineering or deception.

"Windows Vista provides many features to protect your system, but they require proper use," reads Microsoft's Windows Vista Security Best Practice Guidance for Consumers on the subject of UAC. "Your system security is only as strong as your actions, so think before you click." In other words, relying on UAC puts the responsibility for system security in the hands of the individual user -- hardly an ideal scenario.

In fact, Microsoft discourages customers from thinking of UAC as an explicit security boundary -- and therefore, as Rutkowska notes, it does not consider flaws in the UAC implementation to be security flaws . Don't ignore this point. It speaks volumes to how IT should view UAC within the enterprise environment.