26

Today I installed Windows 7. After installing everything, I looked in the task manager and I saw that some processes have NT AUTHORITY\SYSTEM as the username. I searched to see what it is.

I found on some sites that a virus causes this (msblaster), on others I found that it is some sort of user, and I didn't know what to believe.

24

LocalSystem account is a built-in Windows Account. It is the most powerful account on a Windows local instance (More powerful than any admin account). It is part of NT Authority\SYSTEM. See comment from Heinzi below.

Most of the System level (Windows Services) services and some other 3rd party services run in the account. You do not have to worry anything about it.

In addition to LocalSystem, there are two more widely used system accounts: LocalService and NetworkService. These are built-in accounts with lesser privileges.

| improve this answer | |
  • Thank you ! Now I understand what it is . But ,I wonder, why is it necessary ? Why 3rd party services can't run on the current account ? – Sumi Sep 8 '12 at 19:32
  • 1
    @user1568511: Which current account? Windows NT has been designed from start to be a multi-user operating system. You can have two, three, twenty users logged into the same WinNT system. – user1686 Sep 8 '12 at 21:58
  • 2
    @user1568511: Also, your account does not have enough access rights to do things services need to do. – user1686 Sep 8 '12 at 21:58
  • 2
    @user1568511 Here is a link to a MSDN page about setting up the service accounts for SQL Server. That link has a really good description of what rights each account has and what it is used for. – Scott Chamberlain Sep 8 '12 at 23:37
  • 4
    "NT Authority\SYSTEM a.k.a LocalSystem" is technically not correct: .\LocalSystem is a built-in user, and NT AUTHORITY\SYSTEM is a group this user belongs to. See this question for details: superuser.com/q/1067246/14517 – Heinzi Jun 2 '17 at 13:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.