• Muddybulldog@mylemmy.win
      link
      fedilink
      English
      arrow-up
      19
      ·
      1 year ago

      The drive doesn’t have a say. The permissions surrounding the TrustedInstaller account have a say. The account existed on your first Windows install and also on your new one hence the permissions and associated restrictions persevere. This is expected behavior.

      • stappern@lemmy.oneOP
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        16
        ·
        1 year ago

        because a non administrator shouldnt be able to mount drives and other admin operations. an admin should be able to do anything on that machine

        • SuperFlue@kbin.social
          link
          fedilink
          arrow-up
          9
          ·
          1 year ago

          ACL’s are an integral part of most filesystems.
          So yes the drive absolutely has a say in this (technically the NTFS filesystem) in combination with the OS’s filesystem driver.
          The Windows folder is set to be owned by the TrustedInstaller SID (S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464) which is a “well known” Security Identifier.
          This identifier is the same accross Windows systems in a similar way root is UID 0 on Linux.
          Therefore the access rights for TrustedInstaller persists across Windows installs, and also other rights that are defined on the filesystem object.

          Linux uses mainly POSIX ACL which is “fairy simple”, while NTFS ACL can be very complex.
          Should also note that the the UNIX and UNIX-like world there is also NFSv4 ACL which is comparable to NTFS ACL.

          But the basic idea persists across almost all filesytem ACL.
          The user that is running the command must have the right user ID (that is UID/GID in Linux and SID in Windows) that has the correct access rights to do the action you want.

          With Windows administrator rights you can indeed delete everything if you really want.
          But then you have to give your administrator account the right access tokens or you need to impersonate the account in question (both of which are possible if you have an local administrator account, but does require the techincal know-how).

          In Windows a lot of these things are in place both to prevent users from shooting themselves in the foot, but also to provide defence-in-depth against malware.