3

I've heard the equivalent of root is the "SYSTEM" account. But I used a tool called "RunAsSystem" to open a shell as SYSTEM, and I'm still getting "access denied" errors even though I know the files in question aren't in use. How can I get a shell from which I can perform any action on any file regardless of whatever permissions are set?

EDIT: This is not a duplicate of this question. That one is asking why a standard administrator account doesn't have certain permissions; I'm asking if there's an account that has full permissions for everything.

EDIT2: It's not a duplicate of this one either. That question is asking how to get a command prompt as the SYSTEM user. In my question I've clearly stated that I was able to do so, so I'm certainly not asking how to do that.

Also, I haven't chosen an accepted answer yet because I haven't decided yet--I didn't forget, if you were wondering.

4

What do you need is to enable Backup and Restore privileges, granted by default to the Administrators group. One way to do that is to use this PowerShell script:

Set-ExecutionPolicy Unrestricted Process
Import-Module .\Set-LHSTokenPrivilege.ps1
Set-LHSTokenPrivilege SeBackupPrivilege
Set-LHSTokenPrivilege SeRestorePrivilege

With Backup and Restore privileges you will have full access to any file or folder regardless of their own access control list.

  • Nice, never thought of using SeBackupPrivilege\SeRestorePrivilege from this angle. Thanks! – beatcracker Mar 14 '15 at 22:04
  • Good idea, and that looks like a useful script. But I'm still getting some "access denied" errors. I'm testing it by trying to create a file in C:\program files\windowsapps\Microsoft.WindowsCalculator_6.3.9600.20278_x64__8wekyb3d8bbwe, as well as trying to append (using >>) to app.xaml within that folder. Both have failed using this method. – flarn2006 Mar 15 '15 at 22:03
  • 1
    Looks like Windows protect files inside WindowsApps somehow besides normal access control lists. Even if I explicitly grant full access to everyone, files still unavailable to edit. icacls shows extra entity in ACL for S-1-19-512-4096 SID, that is not shown in GUI, maybe it related somehow. – user364455 Mar 16 '15 at 0:50
  • @PetSerAl I have a similar problem here superuser.com/questions/1039116/… – Aristos Feb 12 '16 at 21:03
1

You can't. Even being SYSTEM you can't access files or other objects if you don't have permissions to do so. But being root you can change permissions and only then access files\objects.

The typical case for this is the Windows system files on modern Windows versions (Vista and higher): most of them belong to the TrustedInstaller user, and no one other can't delete\modify them. You need first to become owner and then change permissions to allow you to access them.

Not the answer you're looking for? Browse other questions tagged or ask your own question.