Windows Local Service Accounts

Windows services run under built-in virtual accounts that determine what the service can do locally and on the network. The three that matter are LocalSystem, Local Service, and Network Service — understanding the privilege gap between them is what tells you whether a service-hijack or DLL-hijack lands you SYSTEM or a near-nothing account. Microsoft documents them under “Service user accounts” / the LocalSystem account reference.

The three accounts

• LocalSystem (NT AUTHORITY\SYSTEM) — the most privileged account on the machine, more powerful than a normal Administrators member in key respects: it holds nearly every privilege (including SeDebugPrivilege and SeTcbPrivilege) and acts as the computer itself. On the network it authenticates as the machine’s computer account (DOMAIN\MACHINE$). This is the prize for service-based privesc — code running as LocalSystem owns the box.
• Local Service (NT AUTHORITY\LocalService) — a minimal-privilege account intended as the safe default for services that need no broad local rights. It has the same local privileges as an unprivileged user and accesses the network anonymously (null session), so it can’t authenticate to remote resources.
• Network Service (NT AUTHORITY\NetworkService) — identical to Local Service in local privilege, but presents the machine’s computer account credentials when accessing the network, so it can authenticate to remote resources as DOMAIN\MACHINE$. Use it when a service needs network identity but not local admin rights.

The split that matters for security: LocalSystem = full local power + network identity; Network Service = low local power + network identity; Local Service = low local power + no network identity.

Why it matters

• The SERVICE_START_NAME / ObjectName field of a service (see query-windows-service-configuration) tells you which of these you’d inherit by hijacking the service. LocalSystem is the escalation target; Local Service is rarely worth it.
• A service misconfigured to run as LocalSystem when it only needs Local Service is an attack-surface finding — any code-execution bug in it is instantly SYSTEM.
• The computer-account network identity of LocalSystem/Network Service is what lets a compromised service be used for lateral movement with machine credentials (e.g., into AD as MACHINE$).

Related

• windows-services — the service model these accounts run under
• query-windows-service-configuration — reading which account a service uses
• exploit-windows-services — turning a service misconfiguration into the privileges above

Sources

• Using the LocalSystem Account as a Service Logon Account
• Local accounts (Windows Security)