Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When comparing the various linux distributions with Windows' software, what is the fundamental difference in terms of levels of access with the administrative accounts?

I always thought that the Windows' Administrator account was the equivalent to the Unix root account. But what about SYSTEM? It's not a regular user account, but by doing various tricks you can get a shell as it, but does it really have any greater permissions than the Administrator account?

share|improve this question
up vote 4 down vote accepted

The main difference between the Administrator and SYSTEM is that Administrator is an actual account (for example, it has a password) whereas SYSTEM is not. (Properly speaking, SYSTEM is a "security principal".)

One practical difference is that, if the computer is joined to a domain, processes running as SYSTEM can access domain servers in the context of the computer's domain account. Processes running as Administrator have no access to domain computers unless the password happens to match or alternative credentials are explicitly provided.

It is possible for a file, directory, registry key, or other securable object to only grant access to SYSTEM and not to Administrator. However, I'm not aware of any examples on a default installation of Windows. Edit: I forgot about the SAM key, containing the local account information. This has full control granted only to SYSTEM, with the Administrators group having neither read nor write access. Kreemoweet has also pointed out that Vista has a number of other examples.

Of course, the administrator can override any permissions anyway.

There are one or two oddball special cases. For example, the WTSQueryUserToken function allows a program to get an access token that can be used to launch a new process in the context of a specified logged-on user. This function can only be used by processes that are running as SYSTEM, not by processes running as Administrator.

share|improve this answer
On Vista, the default ACL's on innumerable registry keys and files reserve full control to System or TrustedInstaller. The \winsxs\ and system32\drivers\ folders are two such. The security properties of many registry keys can not even be viewed by Administrators. – kreemoweet Nov 12 '12 at 5:23
@kreemoweet: Interesting. I haven't had much to do with Vista. In Windows 7 the permissions on both the winsxs and the drivers folders are the same for Administrators as for SYSTEM. (The really strange thing, of course, is that permissions are explicitly granted for SYSTEM at all; that's redundant, since the SYSTEM token always includes the Administrators group.) – Harry Johnston Nov 12 '12 at 19:46

Root in Linux is equivalent to Windows' Administrator and System.

You see, you can legitimately log into Linux as root on many distributions. You cannot truly do this with Windows using the System account. Root also runs all of the services on the computer be default like system does for Windows. You log into Windows as administrator but services do not run under it unless specifically told to.

share|improve this answer
+1. The two accounts in windows are like two sides of the same coin. – Xyon Nov 11 '12 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .