• Muddybulldog@mylemmy.win
        link
        fedilink
        English
        arrow-up
        19
        ·
        1 year ago

        The drive doesn’t have a say. The permissions surrounding the TrustedInstaller account have a say. The account existed on your first Windows install and also on your new one hence the permissions and associated restrictions persevere. This is expected behavior.

        • stappern@lemmy.oneOP
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          16
          ·
          1 year ago

          because a non administrator shouldnt be able to mount drives and other admin operations. an admin should be able to do anything on that machine

          • SuperFlue@kbin.social
            link
            fedilink
            arrow-up
            9
            ·
            1 year ago

            ACL’s are an integral part of most filesystems.
            So yes the drive absolutely has a say in this (technically the NTFS filesystem) in combination with the OS’s filesystem driver.
            The Windows folder is set to be owned by the TrustedInstaller SID (S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464) which is a “well known” Security Identifier.
            This identifier is the same accross Windows systems in a similar way root is UID 0 on Linux.
            Therefore the access rights for TrustedInstaller persists across Windows installs, and also other rights that are defined on the filesystem object.

            Linux uses mainly POSIX ACL which is “fairy simple”, while NTFS ACL can be very complex.
            Should also note that the the UNIX and UNIX-like world there is also NFSv4 ACL which is comparable to NTFS ACL.

            But the basic idea persists across almost all filesytem ACL.
            The user that is running the command must have the right user ID (that is UID/GID in Linux and SID in Windows) that has the correct access rights to do the action you want.

            With Windows administrator rights you can indeed delete everything if you really want.
            But then you have to give your administrator account the right access tokens or you need to impersonate the account in question (both of which are possible if you have an local administrator account, but does require the techincal know-how).

            In Windows a lot of these things are in place both to prevent users from shooting themselves in the foot, but also to provide defence-in-depth against malware.