Section 6: Special Accounts

The Big Picture: Not Every Name on a Guest List Is a Person

When you read an ACL you meet names like SYSTEM, Users and Everyone. Most of them are not people. Windows creates them itself. Some are accounts that programs and services run as. Others are groups that Windows fills automatically (for example, "everybody who has signed in").

Knowing them helps you read any ACL and understand why a folder is open or closed. Each one has a fixed SID (Chapter 24), so Windows always knows which is which.

  Who runs as what?

  You, typing in Explorer     → your user account
  Windows core services       → SYSTEM
  Light background services   → LOCAL SERVICE / NETWORK SERVICE
  Windows Update installer    → TrustedInstaller (a service identity)

6.1 Administrator Account

What it is: Two related things share this name, so do not mix them up.

1. The built-in "Administrator" account. Windows creates it during setup. On Windows 10 and 11 it is disabled by default. It exists mainly for recovery.
2. The Administrators group. This is a group. A user who is a member of it is called an administrator. The first account you create on a new PC is usually a member of this group.

What members of Administrators can do:

But administrators are not all-powerful.

• By default, even an administrator runs most programs with a standard (filtered) token, and only gets full rights after the UAC prompt (Section 7).
• Some files are owned by TrustedInstaller and cannot be changed without extra steps (Section 8).
• Administrators cannot become the SYSTEM account just by clicking; they need special tools.

Windows tip: To see which groups you are in, open Command Prompt and type whoami /groups. Look for BUILTIN\Administrators. If it says Group used for deny only, you are an administrator, but your current window is not elevated.

Other important groups you will see everywhere:

Use Authenticated Users in preference to Everyone when you can; it is a bit narrower.

6.2 SYSTEM Account (Higher Privilege Than Administrator in Some Respects)

What it is: SYSTEM (also written NT AUTHORITY\SYSTEM or LocalSystem) is the account the operating system itself uses. It is not a person and has no password you can type. The core parts of Windows, and many services, run as SYSTEM.

Why it is so powerful:

• It has Full control over almost every file on the computer. Look at an ACL in C:\Windows: SYSTEM is nearly always there.
• It holds many privileges that even normal administrators do not have enabled by default.
• It can run before any user signs in. Services that start at boot run as SYSTEM.
• On the local PC it reaches the network as the PC's own identity (the computer account).

Is it higher than Administrator? In some ways, yes: SYSTEM is the most trusted local identity. An administrator is a person; SYSTEM is the operating system. You can check this: whoami /priv shows your privileges. A SYSTEM session has more of them.

Why this matters for security: If an attacker gets code running as SYSTEM, they control the whole PC. This is why programs that run as SYSTEM are hardened and why Microsoft prefers lighter accounts where possible.

The lighter service accounts. To follow the principle of least privilege (give only the rights needed), Windows has two weaker accounts for services:

So a service that only needs to read a few files can run as LOCAL SERVICE. If it is hacked, the damage is much smaller than if it ran as SYSTEM.

Compare the three:

   Most power  ──────────────────────────────►  Least power
   ┌──────────┐   ┌─────────────────┐   ┌───────────────┐
   │  SYSTEM  │   │ NETWORK SERVICE │   │ LOCAL SERVICE │
   └──────────┘   └─────────────────┘   └───────────────┘

(Services can also run as normal user accounts, or as virtual service accounts such as NT SERVICE\<name>, one per service.)

Windows tip: In Task Manager → Details tab, add the column User name. You will see many processes running as SYSTEM, LOCAL SERVICE and NETWORK SERVICE, and your own programs under your name.

6.3 TrustedInstaller (Owns Core OS Files)

What it is: TrustedInstaller is a special service identity named NT SERVICE\TrustedInstaller. It belongs to the Windows Modules Installer service, which installs Windows updates and optional features.

What it owns: Most files and folders that Windows itself installed are owned by TrustedInstaller. For example, C:\Windows, C:\Windows\System32, and much of C:\Program Files\WindowsApps and the core Windows folders in Program Files. Open the Properties of C:\Windows\System32\notepad.exe (or cmd.exe), go to Security → Advanced, and you will see Owner: NT SERVICE\TrustedInstaller.

What the ACL usually looks like on a core system file:

The exact rows vary by file and folder, so treat this table as a typical picture. Check a real file with icacls to see your own. The key point is: only TrustedInstaller has Full control, which includes Change permissions and Take ownership. Even administrators cannot rewrite these files without extra steps.

Why it was made (Windows Resource Protection). Since Windows Vista, Microsoft has put a protective layer around core files, called Windows Resource Protection (WRP). The aim: stop users, bad programs and badly written installers from replacing or breaking vital system files. Only the Windows servicing system (TrustedInstaller) is meant to change them. You will see in Section 8 why this blocks even administrators, and how it ties to the System File Checker sfc /scannow (Chapter 21).

Why it matters: Malware that gets administrator rights still cannot freely change files owned by TrustedInstaller. It must do extra work, and security software can notice.

Summary