Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read from here that:

On a local computer, an administrator can configure the application to run as Local Service, Network Service, or Local System. These service accounts are simple to configure and use but are typically shared among multiple applications and services and cannot be managed on a domain level.

I just don't understand why these accounts cannot be managed on a domain level, since they all have well-known SIDs?

Thanks for your time.

share|improve this question

These are "universal well-known SIDs"; they are the same for every machine and do not have the "domain identifier" component, therefore they cannot be associated with any particular domain. (If they did, joining a machine to a domain would break a lot of stuff, particularly ACLs.)

For example, a normal user SID looks like S-1-5-21-2814603912-1974576649-1524133500-1001.

Here, 21 is SECURITY_NT_NON_UNIQUE, 2814603912-1974576649-1524133500 is the domain identifier and 1013 is the relative ID.

In comparison, LOCAL SYSTEM has the SID S-1-5-18.

FWIW, these three accounts are not even real accounts in the SAM. They are predefined in Windows itself.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.