Search Results
6/19/2025, 11:16:16 AM
>>105638304
You're under a few misapprehensions here. The built-in Administrator account has never been the most powerful account on an NT machine. To demonstrate, if you fire up the Security Policy Editor, you'll find a lot of Se* rights that Administrators don't get by default. As >>105638335 points out, the real power is (and always has been) LocalSystem.
Until relatively recently, LocalSystem owned all the OS files, by virtue of being the highest authority. That changed in Windows 8, with the arrival of TrustedInstaller. It's not actually an account (it has no password, no entry in the SAM database, no user profile, etc.): it's what's called a "service credential", and it's for LocalSystem's exclusive use (that's why if you read through any "Run As TrustedInstaller" utility's source code, you'll see it "switches accounts" to LocalSystem, then does some process token forgery to access TrustedInstaller), to which it delegates OS file manipulation, such as ownership, installing updates and suchlike.
As it's not really an account, TrustedInstaller has no special rights - it just owns all the files. It's primary function is to stop any program that gets into the LocalSystem account (rogue system services etc.) from trashing the OS files - a job it does admirably.
You're under a few misapprehensions here. The built-in Administrator account has never been the most powerful account on an NT machine. To demonstrate, if you fire up the Security Policy Editor, you'll find a lot of Se* rights that Administrators don't get by default. As >>105638335 points out, the real power is (and always has been) LocalSystem.
Until relatively recently, LocalSystem owned all the OS files, by virtue of being the highest authority. That changed in Windows 8, with the arrival of TrustedInstaller. It's not actually an account (it has no password, no entry in the SAM database, no user profile, etc.): it's what's called a "service credential", and it's for LocalSystem's exclusive use (that's why if you read through any "Run As TrustedInstaller" utility's source code, you'll see it "switches accounts" to LocalSystem, then does some process token forgery to access TrustedInstaller), to which it delegates OS file manipulation, such as ownership, installing updates and suchlike.
As it's not really an account, TrustedInstaller has no special rights - it just owns all the files. It's primary function is to stop any program that gets into the LocalSystem account (rogue system services etc.) from trashing the OS files - a job it does admirably.
Page 1