[sengork]

Cygwin (64bit) didn't work for me in the latest creators update (actually I think it broke even before that). Now I am trying things using WSL itself, so far it has been a productive move.

File permissions and security descriptors proved to be quite a hassle when removing Cygwin requiring multiple takeown and cacls hacks to remove some of the files.

On the flip side I saved some disk space too.

[barrkel]

OTOH when I wanted to have pretty pictures on my lock screen but without the Microsoft ads, I needed to rely on Cygwin to blow away the folder that caches the pictures deep in ProgramData/.../SystemData/*/ReadOnly - the lock screen image setting API has a lot of bugs. Without Cygwin, I was fiddling with cacls and takeown in an elevated prompt trying to blow away the folder. An elevated Cygwin prompt and it was just rm -rf.

(Bugs: https://www.google.co.uk/search?q=lock+screen+windows+10+ima...)

[mkup]

Sometimes elevated command prompt is not powerful enough and you need command prompt running from "SYSTEM" user account (Windows NT equivalent of Unix "root"). You can get that one with psexec tool from Microsoft SysInternals: psexec.exe -i -s -d %WINDIR%\System32\cmd.exe

[barrkel]

There's no real equivalent of root on Windows. Accounts can have capabilities (pronounced 'privilege' [1]), and securable objects have ACLs and ownerships. Owners can replace ACLs, and a capability can give the ability to unilaterally change ownership[2]. And some of the more recent changes (to increase security for naive users) have been to disempower users and relinquish capabilities.

Accounts like SYSTEM may be functionally similar to root in so far as they may have the grant option on capabilities and thus have the keys to unlock powers, but good privilege separation design suggests that capabilities shouldn't be idly taken up.

Functionally, an elevated prompt had enough power to blow away the directory I wanted to delete - that is, the account had the capability to take ownership, replace ACLs, and then delete the objects - but following all the steps is fiddly. Cygwin abstracts all that away to the simplified POSIX system.

Something like SYSTEM may have been enough for different reasons; the existing ACLs may have permitted deletion to SYSTEM. But that doesn't mean SYSTEM had more intrinsic abilities (though I believe it does have more capabilities [2]).

[1] https://msdn.microsoft.com/en-us/library/windows/desktop/bb5...

[2] SE_TAKE_OWNERSHIP_NAME in [1]

[3] Things like SE_TCB_NAME in [1], I think.

[kevin_thibedeau]

"WSL isn't done until Cygwin doesn't run"