Is there a Linux root equivalent in Windows that can have access to a file without granting full control?
You could make sysadmins use plain User accounts and give them accounts with Administrator access when they need to do administrative tasks like assign permissions . The security dialogs all support UAC now, after all. However, elevation through impersonation is not easy or practical in every environment or situation, and there are still oddball tasks that make administrator-through-elevation-prompt-only difficult at best. Most third party vendors, IMX, still require full Administrator rights to the systems that their software is installed on because developers hate documenting what security they need and vendor technicians hate having to deal with security on a system they won't manage.
To actually answer the question directly, the equivalent on on Windows to Linux root would be impersonating the SYSTEM account (NT AUTHORITY\SYSTEM, aka LocalSystem), which is technically possible but has always been considered extremely poor practice (outside a few narrow scopes like WMI queries) and you should never do it because you never need to (and, indeed, the account isn't allowed interactive logon and you're not allowed to set the account's password, though I think you execute in that context with
AT.EXE tasks). You will, of course, have software vendors who insist their product run services as SYSTEM. Again, they do this because the developers don't want to document or maintain documentation for what permissions their program actually needs, not because they actually need SYSTEM access.
The SYSTEM account, like root, has the real highest permissions and certain things only it can do. Only SYSTEM has access to the files that store the security databases, even though those passwords are stored encrypted. Only services and the kernel run as SYSTEM. This is why it's best practice not to let non-Windows services run as SYSTEM. It's far more permissions than they need.
However, you still can remove SYSTEM access to files and folders. As you discovered, it's possible with NTFS to have folders or files for which no ACE exists, and therefore no account can access the file or folder, including SYSTEM (although the system is always allowed to still enumerate the item, the ACL, and the owner, just not any contents or children of the object). The file or folder owner is the only means to restore access in this state.
If not, is the only option to administrate files in Windows is to give Administrator Full Control to ALL files (I'm excluding the take ownership option as not practical)?
It's not practical not to use Full Control. You need to assign the Administrators group Full Control to what they need to administer because Full Control grants the Change Permissions permission. You could try to figure out what permissions you need to manage an entire folder using just the components, but you'll quickly find you'll have to basically grant Full Control to be able to do any real administration anyways.
Take Ownership is primarily intended to be used when file permissions are accidentally completely removed (like your experience) or when user accounts are delete/disabled. Unlike
chown, you can only assign ownership to yourself or to the Administrators group. Depending on how your backup software works, however, you might need a script to take control of files on your file servers.
Also note that Administrators have Take Ownership on the root folder of every disk in the system. You're not actually preventing a malicious member of the group from doing anything. They already have the keys to the kingdom, as it were. It's not defense in depth because there's no actual additional security mechanism. You just have to ask for ownership and you get it.
Here is an article that has more information than you'd ever want to know about Windows ACLs, including some good documentation on the older SDDL Access Control Entry format. This method has fallen out of favor a bit because
Set-ACL are so much easier to use... not that that is saying a whole lot.