Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I read from here that:

On a local computer, an administrator can configure the application to run as Local Service, Network Service, or Local System. These service accounts are simple to configure and use but are typically shared among multiple applications and services and cannot be managed on a domain level.

I just don't understand why these accounts cannot be managed on a domain level, since they all have well-known SIDs?

Thanks for your time.

share|improve this question
add comment

1 Answer

These are "universal well-known SIDs"; they are the same for every machine and do not have the "domain identifier" component, therefore they cannot be associated with any particular domain. (If they did, joining a machine to a domain would break a lot of stuff, particularly ACLs.)

For example, a normal user SID looks like S-1-5-21-2814603912-1974576649-1524133500-1001.

Here, 21 is SECURITY_NT_NON_UNIQUE, 2814603912-1974576649-1524133500 is the domain identifier and 1013 is the relative ID.

In comparison, LOCAL SYSTEM has the SID S-1-5-18.


FWIW, these three accounts are not even real accounts in the SAM. They are predefined in Windows itself.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.