[Intro]
Welcome to a video that would clearly rank 10 out of 10 on the recent... *chuckles*
bruh..~
Okay, let's not be sad. So, let's get started.
When I was 8 years old and I did not have my own computer, and in principle, I did not really need it then and I was fine, ...
...I always used my dad's computer.
Although theoretically we considered this computer as a shared or, to speak more simply, a family computer.
This computer had accounts for each family member, which made sense in principle.
If everyone had an account with administrator privileges, they always created a restricted one for me, so that I wouldn't do anything harmful to the computer.
Spoiler alert: it didn't help in part.
And as soon as I sat down at PC, the system would immediately declare that "Your computer might be at risk"
And there's probably something to that, I'm sure.
In this video we'll look at how accounts work: how the process of creating a user account happens; ...
...let's do a little experiment and see how things are in the other system.
By the way, how does the user creation process work?
When you created a user, no matter how you created it: through the Settings app, ...
...via Control Panel or just by telekinesis - you won't see any changes in the Users folder and Registry Editor initially.
But in fact, when we click "Done" in the account creation window, the SAM file, which is located at C:\Windows\System32\config, ...
...our new account and its original data in the form of name, password and type are entered.
By the way, speaking of SAM. SAM stands for Security Account Manager...
And not like this text-to-speech converter of yours :)
*angry Microsoft Sam* :D
Our accounts, which contains the username, password and other proprietary information, are stored there.
Windows has full access to the SAM file, so while the system is booted, access to the file is denied even to administrators.
The first Windows NT uses 2 algorithms to hash user passwords: ...
...LM, as a legacy of Lan Manager and NT, based on the MD4 hashing algorithm.
And over the years, programs like NTPWEdit have also appeared, which help to view account data, ...
...created in the system and seamlessly change their passwords.
For those who don't know what Lan Manager is, it is a network operating system developed by Microsoft in cooperation with 3Com Corporation.
It was developed to replace the 3Com network server software of the same name, ...
...which was running on a heavily modified version of MS-DOS.
And it contains the protocol of the same name used to authenticate Windows clients for network operations, including domain connections, ...
...access to network resources and authentication of the user or computer.
If you, for example, want a video about Windows registry, let's say: how it all originated, its further evolution and work with this very registry, ...
...then like this video, subscribe to the channel, or...show some activity under this video
And we continue
When you log in for the first time and see the animated intro, ...
...a folder with our account name is created in the Users folder and the NTUSER.DAT file is created, which contains the registry bush with our personal settings and file associations
And I think we can go to the next point at this moment...
How you can create users and what types of accounts are available in the system
There are several options for creating a user...
Through the command line by entering "net user [yourname] /add"
If you create an account that will be named in Cyrillic, then the name of the future account must be enclosed in quotation marks.
Through the Microsoft Management Console component called "Local Users and Groups".
There you can not only create an account, but also see the groups, of which, by the way, there are many (from Administrators to Event Log Readers); ...
...set the set password to "live" or block its change; and disable the account as a whole.
And the most simply - through the Settings app.
Whereas in Windows XP when we created an account we were asked who our account would be, an administrator or a limited person, ...
...then starting with Windows 8 and the subsequent emergence of the Microsoft account system, the ability to choose has disappeared and now any account is created with limited rights.
Want a promotion? Change the settings yourself or do it with one small command.
In addition to all of this, Windows had the option to enable a guest account, but this account has more restrictions than the standard account.
For example...
The guest account will automatically be denied access to system and administrator folders
From under the guest account will be denied installation of programs that will need administrative privileges for further work.
And the funniest thing is the ability to personalize your guest account.
Here... you can change... only the picture :D
That's it, our incredible and fascinating account setup comes to its logical end.
As you may have noticed, the guest account does not have the ability to set its own password, but there is one amusing, to put it mildly, bug (?)
I'll show this on Windows XP, although theoretically it's probably still in Windows 11.
So, to do this, we log into an account that has administrator privileges, in my case Daniel - personal account
In the "Run" window we enter the following command - lusrmgr.msc This command will open the M.M.C., more specifically the "Local Users and Groups" section
In the same section, we are looking for the "Guest" user.
In the account settings, uncheck all the checkboxes and put a checkmark in the "Require password change at the next login" checkbox.
You save and log out, click on the "Guest" account and oops - we are kindly forced to change the password.
Change the password and voilà - our account is now password-protected.
But in the "User Accounts" section, there is no action button with the password.
And now that we've disassembled the guest account, we can finally break down the common types and groups of user accounts in Windows.
The first would be the most obvious - the Administrator.
I think it's pretty self-explanatory. This group can control other users on the system, even if they have the same administrator privileges as you do.
The next is a limited account.
This type of user cannot edit important system parameters in any way and has limited work with the registry
Cannot access the folders of users with administrator privileges or use those same administrator privileges at all
At this point, you can already remember that a similar list of restrictions already exists in the guest account.
However, unlike a guest account, restricted accounts can legally and without problems...
...set ways to protect your account in the form of a password, pin code, or by enabling Windows Hello.
In addition to these two groups, there are also "Hyper-V Administrators", "Device Owners", "Remote Desktop Users", and so on.
Each group has its own special authority, ...
...but the average consumer doesn't need that many groups, so everything is limited to the administrators and ordinary users group
In addition to the Administrator, the guest account, and our account, you may notice some unusual, and even disabled, and even unused accounts in the list.
WDAGUtilityAccount, or Windows Defender Application Guard Utility Account.
The system account that is managed and used by the Application Guard component of the Windows Defender.
Application Guard allows you to view untrusted websites in a separate browser window, thereby protecting your device from any threats.
If the untrusted website you are trying to visit seems suspicious or turns out to be malicious, it continues to remain in an isolated Application Guard environment and does not log into your system.
This component is not included with the system by default and is installed separately in the Microsoft Store. This account is also associated with the Windows Sandbox.
A user named defautuser0 appears only during the OOBE in modern Windows
The purpose of this account is simply to conduct this OOBE and after its completion, the account automatically deletes itself.
However, such a mechanism can fail and defaultuser0 may remain.
If this happens, then this very account is available in the list on the login screen. However, unusually, it has a password, which we don't actually know.
ASP.NET Machine Account.
In the Windows XP era, this account was only created when you installed the .NET Framework.
It can also be created when you update your system via Windows Update (or Legacy Update) and there are .NET libraries available for installation.
In modern versions of Windows, there is no such thing for a long time.
HelpAssistant и Support_...
These accounts were present in the Windows XP era.
HelpAssistant is used to operate the "Remote Assistant" function.
This account is automatically disabled if there are no remote assistance requests.
The Support account, which had a random value of letters and numbers at the end of its name, was intended in cases where ...
...when you requested Microsoft technical support through the Help and Support Center.
With the release of Windows Vista, these accounts ceased to exist and were no longer created with a clean installation of the system.
But if you were upgrading from Windows XP to Windows Vista, those accounts were still on the system, but they were no longer meaningful.
TrustedInstaller
If you've noticed, in today's Windows, when setting system folder permissions or deleting them ...
...you may see the TrustedInstaller account or the "Request TrustedInstaller permission" warning.
The thing is that TrustedInstaller is more than just an ordinary account, it is an entire system service - the "Windows Modules Installer", ...
...which allows you to install, modify and uninstall Windows updates and their optional components.
And when any system update takes place, this account becomes the default owner of the new system files.
If you look through the standard user account management applications, you won't find it there - it's hidden intentionally.
And log in is also not possible - the system will say that such an account does not exist.
Although there are ways on the Internet to disable TrustedInstaller, log in to this hidden account and do something there, but I somehow don't see the point.
I may be wrong, though.
Since there are so many accounts that are created for system purposes, I have a question: What is the user limit on the system in general?
After studying the official Microsoft documentation, I realized that there is no specific limit reported.
So there are two options here: either the accounts will be created until the free space on the drive is full, or there is still a limit of 32 bits.
And since there is no official limit in the documentation, but only some speculation, it's time to experiments
And what if one computer is used not by 2-3 people as usual, but let's say 10,000...
10,000 persons and 10,000 accounts sounds kind of crazy...
I did a similar experiment a long time ago, and that without the voice using regular subtitles.
Now I want to show it again, but not for the purpose of any entertainment, but purely for example and demonstration.
What was then, and what is now, the creation of a huge number of users will be handled by the "UserOverflow" program.
The interface and meaning of the program is simple - it will create new accounts in the system, the number of which you specify yourself.
For example: we create 2 accounts, click "Start!", log out and see that besides me there is now both user1 and user2.
You can also set a password for all new accounts you create in advance.
Но внизу есть кнопка с названием “REST IN PEPPERONI”, которая и позволяет создать 10 тысяч аккаунтов.
Select this option and click "Start!"
During the creation of so many accounts the program will freeze, and it will freeze for a long time, so... we'll have to wait.
After a very long time has passed and we have been told that everything is ready, we do not log off in any way.
We need to enable the classic login option.
You will ask "Why?" The answer to that you will find out later.
By the way, the "User Accounts" section in the control panel, does not show all the created active accounts, but only the first 100 of the entire list.
So now it's time to answer "why we included the classic login option".
When we have this login option enabled, we are prompted to enter our username and password, which we must remember and know.
There are no downloads and no support for user switching in the system with this option.
And at that time, the modern welcome screen at the "Windows is starting up..." stage begins to check the existence and status of accounts on the system, ...
...and most likely one user at a time.
For I personally do not know how to explain the sudden high CPU load and the subsequent gradual consumption of RAM immediately on the welcome screen.
The welcome screen starts to freeze up after 40-50 users, and it's only with 512 megabytes of RAM in the virtual machine.
If you provide more RAM, the situation will not change.
If Windows XP has one big nightmare going on, with Windows 11 the situation is a little bit better.
Accounts are still created, but when we click on our account name in the Start menu to open the actions menu and show other accounts, the system starts to slow down a bit.
And with the Task Manager enabled, we see that during the loading of the user list, there is a load on the processor from the group of services that are bound to the lsass.exe file
This file is responsible for accounts and user sessions. Without this file, logins are simply not possible.
And if it is terminated via the Task Manager, the system immediately reports a "sudden failure" and schedules a reboot after a minute.
But if you cancel this reboot with the shutdown /a command, Windows may at one point simply hang up and do an abrupt reboot.
As is already clear - the outcome will still be the same.
On Linux systems the user logic is slightly different.
There are three types of users in Linux: superuser, system users and regular users.
Each user has a numeric user ID, or UID, in addition to his name.
The root user has an ID of 0. System users have IDs from 1 to 100. Normal users have UIDs of 100 and above.
Users in Linux as well as in Windows can be grouped together.
Each user is necessarily a member of one group or another.
I wrote a little bash script that just creates users on the system before any number is reached.
So I set it to 10,000 and... the system does not care, although at the moment of user change, ...
...at least in the SDDM display manager, the system starts to freeze, but still quickly comes to its senses.
What are the results?
10,000 users in the system is a bad idea?
Yes, it's bad, and it's a little crazy.
I don't think anyone would do something like that, but still, who knows. I could be wrong.
I personally don't use accounts - one account is always enough for me. A local account.
And I don't have a Microsoft account, because I don't see the point of such a service.
Somehow.
Well now I suggest you like this video if you like it.
Also subscribe to the channel and click on the bell if you don't want to miss new videos and in general - it's more interesting together.
Let's reach 75,000 subscribers :3
Thank you for watching and thank you to the people who support the channel.
See you again, dear friends!
[...]