32

Today I installed Windows 7. After installing everything, I looked in the task manager and I saw that some processes have NT AUTHORITY\SYSTEM as the username. I searched to see what it is.

I found on some sites that a virus causes this (msblaster), on others I found that it is some sort of user, and I didn't know what to believe.

nhinkle
  • 37,198
  • 36
  • 140
  • 177
Sumi
  • 323
  • 1
  • 3
  • 6
  • See http://superuser.com/questions/220768/how-can-i-access-the-system-account-in-windows-7 and http://superuser.com/questions/276388/what-is-the-system-group-in-windows-7 – bwDraco Sep 24 '12 at 19:52

1 Answers1

32

LocalSystem account is a built-in Windows Account. It is the most powerful account on a Windows local instance (More powerful than any admin account). It is part of NT Authority\SYSTEM. See comment from Heinzi below.

Most of the System level (Windows Services) services and some other 3rd party services run in the account. You do not have to worry anything about it.

In addition to LocalSystem, there are two more widely used system accounts: LocalService and NetworkService. These are built-in accounts with lesser privileges.

Ganesh R.
  • 5,179
  • 1
  • 27
  • 28
  • Thank you ! Now I understand what it is . But ,I wonder, why is it necessary ? Why 3rd party services can't run on the current account ? – Sumi Sep 08 '12 at 19:32
  • 1
    @user1568511: **Which** current account? Windows NT has been designed from start to be a *multi-user* operating system. You can have two, three, twenty users logged into the same WinNT system. – u1686_grawity Sep 08 '12 at 21:58
  • 2
    @user1568511: Also, your account **does not have enough access rights** to do things services need to do. – u1686_grawity Sep 08 '12 at 21:58
  • 2
    @user1568511 Here is a link to a [MSDN page](http://msdn.microsoft.com/en-us/library/ms143504.aspx#Serv_Accts) about setting up the service accounts for SQL Server. That link has a really good description of what rights each account has and what it is used for. – Scott Chamberlain Sep 08 '12 at 23:37
  • 4
    *"NT Authority\SYSTEM a.k.a LocalSystem"* is technically not correct: `.\LocalSystem` is a built-in user, and `NT AUTHORITY\SYSTEM` is a group this user belongs to. See this question for details: https://superuser.com/q/1067246/14517 – Heinzi Jun 02 '17 at 13:01