I think the concept can be applied to desktop programs too, where each application's directory under Program Files would be marked as its own application scope, and all executables contained within can run under its own security principal which gives users more control, remedies problems associated with UAC, and more stuff besides. For instance users might prohibt all programs from editing their files, in case of things like ransomware, or reading files in certain directories (like banking details).

The idea being than an application is freely able to alter the filesystem in its own directory, which means an end to the misuse of the ProgramData directory on Vista/Win7 as a "UAC-free" version of Program Files (which defeats the point of UAC to avoid program file modification in the first place).

This idea could be combined with an overhauled package management system which makes things easier for program installation, management, security, and uninstallation. Kind of like Apple's .app system, but on steroids.

Discuss.

Perhaps old applications could keep the "Program Files" directory and a new directory called "Applications" could be created in the root folder.

Or you could even have an "Applications" directory in both the root folder and the users folder. Then if an application like Google Chrome wants to only install for the user, it could do so without stuffing its self under AppData.

AndyC said:

I'm not sure why you think using ProgramData to store system-wide shared state for an app is abusing it, that's what it is there for. And since it's not flagged as a "trusted location" you aren't circumventing UAC either.

AndyC: I read documents from Microsoft that suggested for MMOs and other games that require constant patching that they just put all their files in ProgramData so they don't require UAC elevation to self-patch. This includes the executable program code, not just game assets.

Except if that's the case, why not just install all programs to ProgramData to avoid all UAC prompts?

But if you do that, you lose the benefit of protection from malware-modified program files.

littleguru said:

My problem is that if you make something like this opt in nobody will actually opt in. Or a small minority. If you enforce it tons of apps break and that version of Windows is going to be even less well received than Vista... 

You could use heuristics to enforce this right now: assume that each directory under %programfiles% containing an executable is an application scope, and monitor filesystem changes made by installers. The monitoring that Application Mode Terminal Services already does is considerably more complicated.