BetaArchive Logo
Navigation Home Database Screenshots Gallery Image Uploader Server Info FTP Servers Wiki Forum RSS Feed Rules Please Donate
UP: 1d, 12h, 49m | CPU: 3% | MEM: 4429MB of 8191MB used
{The community for beta collectors}

Post new topic Reply to topic  [ 19 posts ] 
Author Message
 PostPost subject: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sat Mar 14, 2020 7:20 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
Running explorer on the login screen on Windows XP, Vista,7,8.1, and 10 causes it to break. Why is this?

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sat Mar 14, 2020 7:44 pm 
Reply with quote
Donator
User avatar
Offline

Joined
Thu Oct 25, 2012 8:19 pm

Posts
1835

Location
shell32.dll
Because it's not designed to be used this way.

_________________
Windows Defender for great justice! Bugs are an international trading company. I need to defeat the anti-debugging and obfuscation methods. It wasn't for Intel's absurd ability to load in ie6. Why even waste time with people in an envelope?


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sat Mar 14, 2020 9:54 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
Wheatley wrote:
Because it's not designed to be used this way.

I know that, is there a registry value/key or a dll/exe/sys/whatever that causes this?

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 12:19 am 
Reply with quote
FTP Access
User avatar
Offline

Joined
Fri Jan 31, 2014 12:07 am

Posts
427

Location
Winnipeg, Manitoba, Canada, North America, Earth, Solar System, Milky Way, Universe, Existence

Favourite OS
Windows XP SP3, Windows 1.0 DR5
Possibly because no user is logged in, not even Administrator. Why would you want to do that anyways?

_________________
Instagram


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 3:41 am 
Reply with quote
Offline

Joined
Mon Nov 26, 2018 2:40 am

Posts
63

Location
Northern Territories

Favourite OS
950B, 2195SP4, 3790, 6002
That would be a very serious security vulnerability. Anyone who happens to have possession of your PC would be able to access its files that way.

_________________
What is the name of the application software guaranteed to make your computer faster?

Quicken.


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 4:34 am 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
win32 wrote:
That would be a very serious security vulnerability. Anyone who happens to have possession of your PC would be able to access its files that way.

Replacing sethc.exe with cmd is worse.


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 5:23 am 
Reply with quote
FTP Access
User avatar
Offline

Joined
Sun Mar 16, 2014 6:56 am

Posts
156

Favourite OS
DOS
Meow wrote:
Running explorer on the login screen on Windows XP, Vista,7,8.1, and 10 causes it to break. Why is this?

Interesting question. I tried it myself. I've never done anything like this before but based on your hint I figured out that replacing sethc.exe with cmd.exe and then hitting shift 5 times is all I need to do to get a Command Prompt, then I ran Explorer.exe from there.

I assume by "break" you mean that My Computer, Control Panel, etc. don't work properly - they show some entries but you can't interact with them, or they show some distorted toolbar background? Then eventually it seems to just spontaneously close Explorer.exe and its child processes for some reason.

I tried running with sysinternals Process Monitor to see if I could figure out what it was that Windows Explorer was having trouble with, but nothing jumped out at me - there were lots of errors, hard to tell if any of them meant anything, and if you try the same thing when logged in normally you'll see lots of errors too. Maybe with a lot of effort you could try to figure out which errors are unique to running under the SYSTEM account.

JimOlive wrote:
Possibly because no user is logged in, not even Administrator. Why would you want to do that anyways?

NT AUTHORITY\SYSTEM is a user isn't it?


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 12:44 pm 
Reply with quote
Donator
User avatar
Offline

Joined
Sun Aug 12, 2012 4:33 pm

Posts
2050

Location
Czechia
Meow wrote:
Wheatley wrote:
Because it's not designed to be used this way.

I know that, is there a registry value/key or a dll/exe/sys/whatever that causes this?

Yes, explorer.exe.

_________________
AlphaBeta, stop brainwashing me immediately!

Image


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 3:52 pm 
Reply with quote
FTP Access
Offline

Joined
Thu Mar 29, 2012 4:14 pm

Posts
1245
Explorer and most other user facing things straight up aren't made to run under SYSTEM. NT has had this magical thing called Security and Access Control Lists since its inception. These dictate what sorts of files and objects a certain user (and processes running under it) can see. Objects required for proper functioning of the shell are likely inaccessible from the SYSTEM account. Additionally, the SYSTEM account isn't even a fully fleshed out one. For example, it has no Desktop directory.


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 4:14 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
Lukas Marsik wrote:
Explorer and most other user facing things straight up aren't made to run under SYSTEM. NT has had this magical thing called Security and Access Control Lists since its inception. These dictate what sorts of files and objects a certain user (and processes running under it) can see. Objects required for proper functioning of the shell are likely inaccessible from the SYSTEM account. Additionally, the SYSTEM account isn't even a fully fleshed out one. For example, it has no Desktop directory.

Explorer does not need any user directories to work, it would just give some errors but the shell itself would still run. Also the files should be accessible on the SYSTEM account. Objects might be the issue.

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 4:18 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
DOS wrote:
Meow wrote:
Running explorer on the login screen on Windows XP, Vista,7,8.1, and 10 causes it to break. Why is this?

Interesting question. I tried it myself. I've never done anything like this before but based on your hint I figured out that replacing sethc.exe with cmd.exe and then hitting shift 5 times is all I need to do to get a Command Prompt, then I ran Explorer.exe from there.

I assume by "break" you mean that My Computer, Control Panel, etc. don't work properly - they show some entries but you can't interact with them, or they show some distorted toolbar background? Then eventually it seems to just spontaneously close Explorer.exe and its child processes for some reason.

I tried running with sysinternals Process Monitor to see if I could figure out what it was that Windows Explorer was having trouble with, but nothing jumped out at me - there were lots of errors, hard to tell if any of them meant anything, and if you try the same thing when logged in normally you'll see lots of errors too. Maybe with a lot of effort you could try to figure out which errors are unique to running under the SYSTEM account.

JimOlive wrote:
Possibly because no user is logged in, not even Administrator. Why would you want to do that anyways?

NT AUTHORITY\SYSTEM is a user isn't it?

What version of Windows did you try this on? XP? On later versions it gives errors or just fails to work instead.

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sun Mar 15, 2020 4:24 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
DOS wrote:
Then eventually it seems to just spontaneously close Explorer.exe and its child processes for some reason.

Sethc.exe is in a job that after some time ends.

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Wed Mar 18, 2020 12:36 pm 
Reply with quote
FTP Access
User avatar
Offline

Joined
Sun Mar 16, 2014 6:56 am

Posts
156

Favourite OS
DOS
Meow wrote:
What version of Windows did you try this on? XP? On later versions it gives errors or just fails to work instead.

Yeah, XP SP3.

Meow wrote:
Sethc.exe is in a job that after some time ends.

Ahh. If instead of running "explorer" from the Command Prompt, I ran "start explorer", would it separate the job in any way so that Explorer doesn't get killed?


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Wed Mar 18, 2020 8:45 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
DOS wrote:

Meow wrote:
Sethc.exe is in a job that after some time ends.

Ahh. If instead of running "explorer" from the Command Prompt, I ran "start explorer", would it separate the job in any way so that Explorer doesn't get killed?


Possibly. I never tried this so I’m going to start process explorer and then Explorer and see if Explorer is in a job.

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Wed Mar 18, 2020 8:52 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
Unfortunately running start explorer does not work. Explorer is still in a job.

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Wed Mar 18, 2020 8:55 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
It appears that there IS no way to take a process out of a job, so explorer has to relaunched every time the sethc.exe job ends.

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Wed Mar 25, 2020 8:55 pm 
Reply with quote
FTP Access
Offline

Joined
Wed Mar 18, 2020 10:21 am

Posts
8

Favourite OS
6002
did you guys ever try launching userinit?


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Wed Mar 25, 2020 9:36 pm 
Reply with quote
Offline

Joined
Mon Feb 03, 2020 5:28 am

Posts
25

Favourite OS
Windows XP build 2600
Alphis wrote:
did you guys ever try launching userinit?

That doesn’t work.

_________________
Latest version of Windows: Windows 10 20H2 “Manganese”


Top  Profile
 PostPost subject: Re: Why does explorer.exe break on NT AUTHORITY/SYSTEM?        Posted: Sat Mar 28, 2020 1:37 pm 
Reply with quote
Offline

Joined
Wed Feb 26, 2020 3:58 pm

Posts
3

Favourite OS
17666
Did you try to start lsass.exe and winlogon.exe ?


Top  Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 19 posts ] 




Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  

All views expressed in these forums are those of the author and do not necessarily represent the views of the BetaArchive site owner.

Powered by phpBB® Forum Software © phpBB Group

Copyright © 2006-2020

 

Sitemap | XML | RSS