Clearing up confusion: Local System

Today I spent a bit too long explaining the different way that Windows XP displays the security principle identified by SID S-1-5-18.

LocalSystem from caclsThe System account when viewed from CACLS
Local System from ExplorerThe System account according to Explorer
Local System in ServicesThe System account according to Services
All three of these entities are the exact same Security entity in Windows XP. However, they have different names.

  • NT Authority\System
  • System
  • Local System
Same thing.

In a domain context they're still the same thing.The machine account is represented by "Network Service", which is the same as "NT Authority\Network". It can do everything System can, but has visibility in AD. It also requires a login.

Same thing, three different ways of saying it. Classic Microsoft.