Hacker News new | ask | show | jobs
by barrkel 3353 days ago
OTOH when I wanted to have pretty pictures on my lock screen but without the Microsoft ads, I needed to rely on Cygwin to blow away the folder that caches the pictures deep in ProgramData/.../SystemData/*/ReadOnly - the lock screen image setting API has a lot of bugs. Without Cygwin, I was fiddling with cacls and takeown in an elevated prompt trying to blow away the folder. An elevated Cygwin prompt and it was just rm -rf.

(Bugs: https://www.google.co.uk/search?q=lock+screen+windows+10+ima...)
1 comments
mkup 3352 days ago
Sometimes elevated command prompt is not powerful enough and you need command prompt running from "SYSTEM" user account (Windows NT equivalent of Unix "root"). You can get that one with psexec tool from Microsoft SysInternals: psexec.exe -i -s -d %WINDIR%\System32\cmd.exe
link
barrkel 3352 days ago
There's no real equivalent of root on Windows. Accounts can have capabilities (pronounced 'privilege' [1]), and securable objects have ACLs and ownerships. Owners can replace ACLs, and a capability can give the ability to unilaterally change ownership[2]. And some of the more recent changes (to increase security for naive users) have been to disempower users and relinquish capabilities.

Accounts like SYSTEM may be functionally similar to root in so far as they may have the grant option on capabilities and thus have the keys to unlock powers, but good privilege separation design suggests that capabilities shouldn't be idly taken up.

Functionally, an elevated prompt had enough power to blow away the directory I wanted to delete - that is, the account had the capability to take ownership, replace ACLs, and then delete the objects - but following all the steps is fiddly. Cygwin abstracts all that away to the simplified POSIX system.

Something like SYSTEM may have been enough for different reasons; the existing ACLs may have permitted deletion to SYSTEM. But that doesn't mean SYSTEM had more intrinsic abilities (though I believe it does have more capabilities [2]).

[1] https://msdn.microsoft.com/en-us/library/windows/desktop/bb5...

[2] SE_TAKE_OWNERSHIP_NAME in [1]

[3] Things like SE_TCB_NAME in [1], I think.

link