Aaron Parker passes along this odd tale of an OEM that apparently needs to be whacked with a cluestick. His MSI Wind (a nice little netbook) needed a BIOS update, so he decided to try out the MSI Live Update application, which is supposed to provide users with the latest BIOS and refresh any device drivers
For some reason that I can’t quite fathom, it appears that MSI has decided that User Account Control needs to be disabled for their application to run.
The program tries to run an executable called DUAC.exe, which apparently stands for Disable UAC. Aaron’s conclusion is on the money:
Not only is this a sad indictment of MSI’s support tool, but this could potentially put many of their users at risk. It’s a real shame to see developers taking the easy way out instead of doing a little research and doing things the right way.
If you own an MSI Wind (or are thinking of buying one), be sure to read this.
Ed Bott (@ wordpress.com) 
What I don’t understand is how come there is even a “disable UAC” feature possible… It’s incredible that MS did this in a half-assed way. By simply putting up a dialog where the user has to endlessly “allow” all kinds of trivial changes, as well as installs. The right way to do this is to ask for the admin password every time an admin task needs to be performed (which shouldn’t be all that often). Period. There’s no way to “disable” this, since without the admin credentials the operation is not possible – end of story.
But no, MS had to find a half-assed way to do this. They figured out how to drive users crazy with it, without actually providing any security… That whole UAC thing amazed me, and drove me crazy. I managed to stand it for about 2 weeks, after that I kept disabling UAC on any freshly installed machine right off the bat.
Yeah, looks like MSI made the wrong choice, but I’d say MS is faulty for even making that choice possible. What they should have done is implement the thing right: ask for an admin password every time it’s really needed (and not as often as Vista does).
I don’t have a problem with a BIOS update requiring that UAC be disabled to something as heavy as a BIOS upgrade. However, the MSI people forgot two steps: 1st, record the condition of UAC before disabling it, and 2nd, restore UAC to its pre-existing condition.
I’ve updated the BIOS on Dell and HP machines recently. Neither one required disabling UAC.
I do have an MSI Wind, but don’t most those come with XP? Mine did, and I haven’t seen any with Vista and obviously there is no “7” yet (except RC), so it’s weird that they would even do that or anyone would find it…
OEMs are the ruin of Vista and Win7
I had a more colorful experience regarding OEM support (HP in this case). I purchased a Compaq C733TU notebook in January 2008. The notebook had been out in the market for about 2 months already. The machine came with no OS pre-installed and the only full set of drivers available was for Vista. The wireless driver available on HP website for Atheros 5007 card was pathetic to say the least. It didn’t let you create an ad-hoc network – to create an ad-hoc wireless network in Vista you have to make sure your wireless is turned on, and pressing the switch had no effect whatsoever. It could connect to a wireless network if it was available in the vicinity but that is it. Resume from sleep/hibernate never worked either. Later in June 2008, an update to the driver was released that did something incredible. Features worked on their whim. Sometimes internet connection sharing would work, sometimes not. Sometimes restart would result in a BSOD, and investigation revealing the driver in question to be the culprit. In fact another driver version, suggested by Vista`s Problem Reports and Solutions section did not work either. But it all changed when Windows 7 RC was released. Mind you I am talking about RC and not Beta, as these issues were present in Beta as well, i.e. it installed a driver that didn’t work and no help from Windows update either. So the RC installs a driver that works OOTB and then an update for the driver arrives form Windows update that further enhances the reliability of the device. Every single thing that I could imagine doing with my wireless device works awesome without fail. Now if I would not have been intelligent enough to figure out that a bad driver is the root of the problem then like an avg Joe I could laid the blame on Vista, and MS would have another dissatisfied customer for no fault of theirs.
@Joe, the MSI Live Update application requires elevation to run, which means as soon as I allow the elevation the application can do whatever it wants – including disabling UAC and rebooting.
I’m always deeply suspicious when I see a warning window — or any window — whose message contains gramatical errors. In casual posts, email or casual convesation, it’s acceptable; in a professional capacity, it smells of faulty development (or a script-kiddie).
No, the weakest link in the Windows Ecosystem turns out to be Microsoft itself. Allowing an unverified third-party executable to simply disable UAC is a HUGE security risk.
Although I hate UAC, I still leave it on, just in case. MS could have certainly designed the system to be less annoying…but few people can argue against the security coverage provided by UAC. Need to see how the changes in UAC to 7 feel.
I think you miss the point. Windows does NOT “allow an unverified third-party executable to simply disable UAC.” As always, the code requires administrator consent (standard user can’t do this). The code is simply allowing the administrator to CHOOSE to do what he or she could do manually. It’s no different from a vendor providing a script that changes registry settings. It sounds like your point is that it should be impossible to disable UAC. Unfortunately, that would destroy compatibility with some applications, which is why UAC is not mandatory.
I don’t remember specifically what model it was but about six months back we did have some issues with HP bios updates that would refuse to do anything on Vista with UAC running unless you right clicked – Run as Administrator even though the account was an admin account (though not super admin or whatever is disabled now by default)
So, maybe its possible MSI had the same problem and instead of updating the bios updater program, or posting a work around just decided to throw something together?
Still plain stupid though
This is absolutely correct. I own an MSI motherboard (that is the base of my DIY PC) and the utility for BIOS update is the same. What I normally do is to run the tool once a month or so (it DOES disable the UAC!) and then uninstall it and re-enable the UAC again. Surreal…
@Chris: Just to clarify: the tool does this just to check (!) to see if a BIOS upgrade is needed, not to actually upgrade it… Anyway, Intel proves this can be done right with their BIOS upgrade tools – they have different versions and the “Intel Express BIOS” is actually a Windows tool that runs directly on the desktop without any need to disable anything…
My experience with Dell lately tells me that when it comes to drivers and bios upgrades, they get it. I haven’t bought an HP for years but my experience with Gateway and Lenovo wasn’t horrible but compared to Dell it was in general harder to find what I needed and the install process was a little bit more cumbersome.
I’ve owned MSI motherboards for years and I’ve noted them to be increasingly sloppy with their updates over the years. Little things like the UAC, but also and even worse, not being able to find updates without using their app.
Somewhere at any moment there always seems to be a “bad” motherboard vendor; Asus has been that vendor and now MSI has had the dubious honors for a while now. I’ve wanted to pick another vendor but for the fact that my Vista installation has been too stable, and with Win7 having similar requirements I may not change motherboards anytime soon.
I also have used MSI boards in my systems. The MSI auto update has tended to be questionable and I have had problems with it in the past.
I still believe that a bootable, self contained installer is the best method of BIOS updates.