ACL’s are an integral part of most filesystems.
So yes the drive absolutely has a say in this (technically the NTFS filesystem) in combination with the OS’s filesystem driver.
The Windows folder is set to be owned by the TrustedInstaller SID (S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464) which is a “well known” Security Identifier.
This identifier is the same accross Windows systems in a similar way root is UID 0 on Linux.
Therefore the access rights for TrustedInstaller persists across Windows installs, and also other rights that are defined on the filesystem object.
Linux uses mainly POSIX ACL which is “fairy simple”, while NTFS ACL can be very complex.
Should also note that the the UNIX and UNIX-like world there is also NFSv4 ACL which is comparable to NTFS ACL.
But the basic idea persists across almost all filesytem ACL.
The user that is running the command must have the right user ID (that is UID/GID in Linux and SID in Windows) that has the correct access rights to do the action you want.
With Windows administrator rights you can indeed delete everything if you really want.
But then you have to give your administrator account the right access tokens or you need to impersonate the account in question (both of which are possible if you have an local administrator account, but does require the techincal know-how).
In Windows a lot of these things are in place both to prevent users from shooting themselves in the foot, but also to provide defence-in-depth against malware.
Then why does it matter that your an admin if the drive should have no say?
because a non administrator shouldnt be able to mount drives and other admin operations. an admin should be able to do anything on that machine
You can do anything, you just need to own the files first.
Removed by mod
Linux is exactly the same for file access. Unless you run your session as root, which is a bad idea.
ACL’s are an integral part of most filesystems.
So yes the drive absolutely has a say in this (technically the NTFS filesystem) in combination with the OS’s filesystem driver.
The Windows folder is set to be owned by the TrustedInstaller SID (S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464) which is a “well known” Security Identifier.
This identifier is the same accross Windows systems in a similar way root is UID 0 on Linux.
Therefore the access rights for TrustedInstaller persists across Windows installs, and also other rights that are defined on the filesystem object.
Linux uses mainly POSIX ACL which is “fairy simple”, while NTFS ACL can be very complex.
Should also note that the the UNIX and UNIX-like world there is also NFSv4 ACL which is comparable to NTFS ACL.
But the basic idea persists across almost all filesytem ACL.
The user that is running the command must have the right user ID (that is UID/GID in Linux and SID in Windows) that has the correct access rights to do the action you want.
With Windows administrator rights you can indeed delete everything if you really want.
But then you have to give your administrator account the right access tokens or you need to impersonate the account in question (both of which are possible if you have an local administrator account, but does require the techincal know-how).
In Windows a lot of these things are in place both to prevent users from shooting themselves in the foot, but also to provide defence-in-depth against malware.