1

In our product documentation it is written that

If your local security measures require, you can change the user account and password under which the main Server services run.

You must have Administrator privileges to change the service account.

Note that the main Server services cannot run using the local system account.

Here then what is the problems with that account, when i did a search i came to know that LocalSystem service can do things that would bring down the entire system or damage the entire system.

Does that the real problem?

Where do we can see that account.

I think the actual name of the account is NT AUTHORITY\System.

Improve this question
8
  • 5
    the system account is the utter core of Windows. it exists at a level above "administrator" and should never be used by anything/anyone other than actual system services. If 'administrator' is the equivalent of 'root', then 'system' is the HR officer who hired 'administrator'.
    – Marc B
    Jun 28, 2011 at 17:53
  • what you mean by actual system services?
    – shanethomson11
    Jun 28, 2011 at 17:57
  • 3
    pop up task manager, "display processes from all users". You'll see what's running under system. Things like 'lsass', 'wininit', 'winlogon', etc.. All processes that, if killed, will immediately crash your system.
    – Marc B
    Jun 28, 2011 at 18:00
  • 2
    If you're running your own code under the 'system' account, you'd better be VERY sure it's bulletproof code. System has COMPLETELY access to EVERYTHING in windows, and you can trivially kill the box with a simple bad memory address. There are no safeguards when running under SYSTEM.
    – Marc B
    Jun 28, 2011 at 18:13
  • 1
    @Marc B - no more so than other applications (AFAIK) ... it is more about default permissions than anything else.
    – William Hilsum
    Jun 28, 2011 at 18:52

1 Answer 1

Reset to default
4

Local system is one of the few built in groups.

Anything that runs as system has full local control over your computer and can do anything/everything they want to.

So as for your questions (I think).

Q: When i did a search i came to know that LocalSystem service can do things that would bring down the entire system or damage the entire system.Does that the real problem?

A: As I said, Processes under system can do pretty much anything they want. The usual processes that run under this account include AV, Firewall and other similar programs. It has a lot of power and should only be used when required.

Q:Where do we can see that account .I think the actual name of the account is NT AUTHORITY\System.

A: It is a system managed account, you cannot see it as such and it would be a bad idea if you could.... If you really want to do it, take a copy of c:\windows\system32\osk.exe and then copy c:\windows\explorer.exe to c:\windows\system32\osk.exe.

Go to the login screen (which runs as system, so you should understand the power of this account!), then click on accessibilities control (the circle-ish icon in the bottom left hand corner) and launch the on screen keyboard.

You will now have an instance of explorer running as system that has full control over everything!

Improve this answer
6
  • 1
    Interesting trick with osk.exe.
    – Daniel Beck ♦
    Jun 28, 2011 at 19:05
  • psexec -desi cmd is easier
    – u1686_grawity
    Jun 28, 2011 at 20:48
  • It's simple to say, but it's not actually true. Local System does not have "full control over everything". It has no network credentials (beyond the machine account), for example. And ACLs that deny it access will work just as they do for other accounts. Windows NT is not Unix. It doesn't have special accounts that it stops making all security checks for, and that can "do everything" therefore. The dangers of Local System are that it has access to system processes that run under that account, access to the SAM, and the TCB privilege. Let's not confuse people with hyperbole.
    – JdeBP
    Jun 28, 2011 at 20:50
  • @jdeBP Well, full control over everything "local by default"... 3 additional words, but, in the context of the question, I was trying to keep it simple!
    – William Hilsum
    Jun 28, 2011 at 21:23
  • Simplifying to the point of incorrectness will only cause confusion. Your saying "full control" is a case in point. That has a specific meaning on Windows NT, and it is not the case that Local System has full control even if one is only considering local resources. Since Windows NT 6.0, Local System has not had full control access to operating system executable files, for example. There is no account in Windows NT that bypasses security controls and has full access to everything. It's not Unix.
    – JdeBP
    Jun 29, 2011 at 9:46