As Rob mentioned, Protected Mode helps to eliminate the silent install of malicious code through Windows Vista’s User Account Protection (UAP) technology by blocking writes outside of the Temporary Internet Files (TIF) folder. Protected Mode also leverages UAP’s User Interface Privilege Isolation (UIPI) to help prevent Window messages from being sent to higher privilege processes.
For this release, security is our number one priority and preserving compatibility is a close second priority. To maintain compatibility, Protected Mode launches broker processes at the user and admin privilege levels to accomplish elevated operations like saving web pages and installing ActiveX controls through UAP’s Application Info Service (AIS).
User Account Protection is enabled in the Windows Vista CTP build, but Protected Mode work is not done yet and hence users are unable to install ActiveX controls in the default configuration. To solve this problem, the following procedure can be used to temporarily elevate IE’s permissions:
- Start IE with elevated permissions: click Start, point to All Programs, right-click IE, and then select Run Elevated.
- Perform the ActiveX installation.
- Exit the current instance of IE.
- Start a new instance of IE normally (without Administrator permissions).
Read the rest here
IE Security in Brief