31

Today I installed Windows 7. After installing everything, I looked in the task manager and I saw that some processes have NT AUTHORITY\SYSTEM as the username. I searched to see what it is.

I found on some sites that a virus causes this (msblaster), on others I found that it is some sort of user, and I didn't know what to believe.

1

1 Answer 1

29

LocalSystem account is a built-in Windows Account. It is the most powerful account on a Windows local instance (More powerful than any admin account). It is part of NT Authority\SYSTEM. See comment from Heinzi below.

Most of the System level (Windows Services) services and some other 3rd party services run in the account. You do not have to worry anything about it.

In addition to LocalSystem, there are two more widely used system accounts: LocalService and NetworkService. These are built-in accounts with lesser privileges.

5
  • Thank you ! Now I understand what it is . But ,I wonder, why is it necessary ? Why 3rd party services can't run on the current account ?
    – Sumi
    Sep 8, 2012 at 19:32
  • 1
    @user1568511: Which current account? Windows NT has been designed from start to be a multi-user operating system. You can have two, three, twenty users logged into the same WinNT system.
    – user1686
    Sep 8, 2012 at 21:58
  • 2
    @user1568511: Also, your account does not have enough access rights to do things services need to do.
    – user1686
    Sep 8, 2012 at 21:58
  • 2
    @user1568511 Here is a link to a MSDN page about setting up the service accounts for SQL Server. That link has a really good description of what rights each account has and what it is used for. Sep 8, 2012 at 23:37
  • 4
    "NT Authority\SYSTEM a.k.a LocalSystem" is technically not correct: .\LocalSystem is a built-in user, and NT AUTHORITY\SYSTEM is a group this user belongs to. See this question for details: superuser.com/q/1067246/14517
    – Heinzi
    Jun 2, 2017 at 13:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.