3 ms·
I took it for granted that all SYSTEM superpowers can be given to Administrator via Computer Configuration/Windows Settings/Security Settings/Local Policies/Use
by red75prime 9y ago
I took it for granted that all SYSTEM superpowers can be given to Administrator via Computer Configuration/Windows Settings/Security Settings/Local Policies/User Rights Assignment in gpedit.msc
Do you have examples for what SYSTEM can do, but Administrator cannot?
- tremon 9y agoSYSTEM ignores access controls on the filesystem, for example. With NTFS, you can disallow Administrator access to certain files and explorer will require the administrator to explicitly take ownership of the files before any other action is allowed. SYSTEM does not need to do that.
- userbinator 9y agoThere's also the HKLM\SAM and HKLM\SECURITY registry keys, which are by default only accessible to SYSTEM.
- poizan42 9y agoDoesn't matter, the administrator can just enable their SeBackupPrivilege and SeRestorePrivilege and ignore those ACLs.
- poizan42 9y agoI just checked, and on my system without having changed anything, administrators (i.e. users in the Administrators group, including Administrator) are granted SeBackupPrivilege and SeRestorePrivilege, which are the "ignore access control" privileges. Anyways, even then administrators have by default SERVICE_ALL_ACCESS grant to the Service Control Manager, which allow you to create and start a service running as SYSTEM. Also administrators have SeDebugPrivilege, so they can ignore ACLs on process objects. This means you can just execute arbitrary code in one of the system processes - or you can duplicate the token of one of those and impersonate it.