Elaborate on Windows super Account SYSTEM

Bkjia.com Windows Host documentProfessor Wang baohui of Tsinghua University asked everyone, "Do you know the highest administrator privilege of Windows XP ?", The dishes shouted, "Administrator", "Admin", and "root" (Khan! I think it's just like calling a Guset account.) Professor said, you are all wrong. In fact, the highest Administrator Account of the SYSTEM is SYSTEM.

Is that true? We usually think that the Administrator account is the highest-permission account, and we can do whatever we want, but it is not. There are also things we can't do with this so-called Top-right account, such as deleting the Windows System backup and recovery file System Volume Information, accessing the Registry's SAM file, and killing some key processes in the System. So why have we never heard of this account? It is because when we log on to the Administrator account, the SYSTEM user is already in the SYSTEM and manages the core of the entire SYSTEM, that is, it is in the operating system and mentality; and ordinary users, regardless of the Administrator account or other permission accounts, log on to the system in user-level user mode. "Normal user" runs in the logon session of the system account. Therefore, we naturally think that the user with the highest permission is Administrator.

Since this trump card account is in the "seclusion" system, can we call it out? The answer is yes!

S1: Use the at command to schedule command tasks Run cmd and enter the following windows command: # At 10: 32/interactive cmd.exe A new job is added. Its job ID is 1. If the current time is a time before, then when is reached, the system will pop up. exe will talk, and then the owner of this article will talk about system, of course, it will be verified by typing a command under "cmd.exe. # Whoami Nt authority \ SYSTEM The SYSTEM prompts that the account currently running is SYSTEM S2: Kill the Administrator's explorer Assume that we start the system with the account name "administrator". In the new session, we will kill the assumer.exe process! Type the following command: # Taskkill/f/im assumer.exe Successful: the process "assumer.exe" has been terminated, and its PID is 964. S3: recreate assumer.exe At this time, we use the system account ID to run the operating system. We only need to create a new cmd.exe instead of having a table. Type the following command: # Explorer We found that the Windows xp system with a new SYSTEM account is displayed in front of us ......

So what can we do with this user?

Open

At first, I mentioned that this account can "Do whatever you want" and has the highest permissions in the real sense. If you try to delete the Windows System backup and recovery file System Volume Information, access the Registry's SAM file, and kill some key processes in the System, you can see if it can be implemented. Besides, when a virus exists, the first thing we should think of is to manually end the virus process, but the virus may reside in system-level key processes, deleting a virus process as a partition Administrator cannot end the virus process, so you need to use the SYSTEM account. There are still many examples that require SYSTEM account applications. I will not give them one by one. I hope you will be able to seriously understand the mysteries of the application.