I just checked, and on my system without having changed anything, administrators (i.e. users in the Administrators group, including Administrator) are granted S

I just checked, and on my system without having changed anything, administrators (i.e. users in the Administrators group, including Administrator) are granted SeBackupPrivilege and SeRestorePrivilege, which are the "ignore access control" privileges. Anyways, even then administrators have by default SERVICE_ALL_ACCESS grant to the Service Control Manager, which allow you to create and start a service running as SYSTEM. Also administrators have SeDebugPrivilege, so they can ignore ACLs on process objects. This means you can just execute arbitrary code in one of the system processes - or you can duplicate the token of one of those and impersonate it.