Hello everybody, Here is a couple of my observations on Windows 2000/XP LocalSystem account. Originally (NT4) the paradigm of this account was declared by MS as the following: 1. This account doesn't require athentication on the local computer. 2. It has unlimited rights on the local computer. 3. No network resources can be accessed using this account. Now, that's what we see in Windows 2000: 1. LocalSystem is still the main account under which the most of system services run. 2. LocalSystem has unlimited privileges on Active Directory objects. It is true for all of the partitions located in the AD database. So, any process running under LocalSystem on any of domain controllers can easily crash the whole forest just by erasing Schema or Configuration objects. And that becomes not funny, you need to control every single backup operator as well as patch thoroughly every single buffer overflow vulnerabilities in system services and apps. 3. Here is another surprise coming. Now the LocalSystem account is able to access other computer's shared resources. Basically, its rights are equal to ones of "Users" or "Domain Users". So you don`t need to be authenticated by domain at all to access domain resources shared for "Users" only. Has anything changed in Microsoft's vision of the System account? What are documented security features of this account? Thanks
