0

I was thinking about SYSTEM account on windows 7 and while researching about it, i came to know that it is predefined account used by service control manager (SCM),The account is not recognised by security subsystem what does it mean? I want to Know if this account has a profile name on windows 7,8,8.1 etc why can't we login into that account,why is the account not associated with any logged in user account? if we do anything under SYSTEM account like rename a file is it logged in event manager,Does this account has a password? or username? Almost Everyone knows that we can run windows explorer under SYSTEM account and explore the SYSTEM profile but when i did it i often have difficulty like deleting ,renaming etc why? Please delete this question if i asked it wrongly

  • SYSTEM has a Windows SID, but it's a lot like restricting root login on Unix. It's used as a level of permissions. I think this really should be as in SuperUser rather than InfoSec. – RoraΖ Sep 4 '14 at 12:31
3

The SYSTEM account is a pseudo-account similar, but not identical, to root on Linux. The two primary differences are that (a) the SYSTEM account is a service account, and therefore does not have a user profile, and (b) the Windows permissions model still enforces ACLs such that objects can exist which SYSTEM cannot directly access (though it can still grant a privilege to a token and gain access that way).

The SYSTEM account is the highest privilege level in the Windows user model. It exists to provide ownership to objects that are created before a normal user logs on, such as the Local Security Authority Subsystem (LSASS) and the Session Management Subsystem (SMSS).

To answer your questions directly:

The account is not recognised by security subsystem what does it mean?

It is recognised by the security subsystem, but it doesn't strictly exist as a user. It's a principle rather than a user. This concept is a little confusing, but think of it this way: the computer itself isn't a user, so if you were to give the computer itself a user account, is it still really a user?

I want to Know if this account has a profile name on windows 7,8,8.1 etc

No, it doesn't have a profile. This goes for other service accounts too, such as LOCAL SERVICE and NETWORK SERVICE. The special case for local service accounts (including SYSTEM) is that they don't exist outside the machine they are attached to, so they are not part of the domain. You can have domain service accounts, but these exist as part of AD rather than accounts on a machine.

why can't we login into that account,why is the account not associated with any logged in user account?

The SYSTEM account is a service account, not a user account. It has no user profile associated with it, so you can't log in with it. It's simply there to facilitate the operation of the system above the user level. For example, services associated with drivers need to run at boot time, before the user logs in, so they run as SYSTEM in order to get the process to execute on boot and have the necessary privileges to communicate with drivers (usually via IRPs).

if we do anything under SYSTEM account like rename a file is it logged in event manager

Not any more so than any other account. You can indeed enable auditing and other logging as part of your filesystem auditing features or as part of the local (or group) security policy, but this goes for any other account too.

Does this account has a password? or username?

The username is just SYSTEM. The question as to whether it has a password or not is complicated. The simple answer is no, but that doesn't tell the full story. It has something called evidence, which is a term used in the Windows security model to mean any form of identifying data that proves you are who you say you are. This isn't as clear-cut as just passwords or certificates, but extends to things like security tokens attached to threads or processes. As such, it doesn't have a password in the sense that you could type something in and log into it, but it does have evidence that proves it is the SYSTEM account in order to prevent a local process from impersonating it.

Almost Everyone knows that we can run windows explorer under SYSTEM account and explore the SYSTEM profile but when i did it i often have difficulty like deleting ,renaming etc why?

The important thing to remember here is that a process can run as SYSTEM but still have handles to objects that exist under a different session. Keep in mind that sessions aren't the same as users - they're container objects that are instantiated for users when they log on. By default, services run under the null session, which you can't see. When you run Explorer as SYSTEM under your own session, its window handles exist in the current session that you're logged into, but are owned by SYSTEM. The important distinction is that you don't own that process or its handles, but you own the session under which the window exists.

As for why you had trouble with deleting and renaming, I'm not sure. I've not tried running explorer as SYSTEM in 8.1, but back in XP and Win7 it worked just fine. I'd suggest trying cmd or something similar rather than Explorer.

My advice would be to read the security model sections of the Windows Internals book by Mark Russinovich, which has really in-depth explanations about how all this works.

  • No doubt your answer has given enlightment but i want to clear some doubt,there is systemprofile folder in this path in windows 7 C:\Windows\System32\config\systemprofile, where we havee Desktop,My Documents,Downloads,Favourities folder just like any normal user in windows,so please clear this, also there is serviceprofile folder under this path in windows 7 C:\Windows\ServiceProfiles which has both networkservice and local service profiles please enlighten me a little,Can we login into this account then why it has desktop and my documents folder like any other user,thanks for the advise – raven Sep 4 '14 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.