Data stored by a Windows Service running as “Local System Account”

The data you are looking by default, be located in "C:Documents and SettingsDefault User". That is the location of the default user profile, which is the template for new user profiles. Its only function is to be copied to a new folder for use as a user profile when a user logs onto the computer for the first time.

If the service is following Microsoft’s guidelines, it will be storing data in the application data folder (%APPDATA%) or the local application data folder (%LOCALAPPDATA% on Windows Vista and later). It should not use the My Documents or Documents folders, but you might want to check there as well.

On a typical installation of Windows XP or Windows Server 2003, check the following locations for application data for programs running as Local System (NT AUTHORITYSYSTEM):

  1. C:Windowssystem32configsystemprofileApplication DataVendorProgram
  2. C:Windowssystem32configsystemprofileLocal SettingsApplication DataVendorProgram
  3. C:Windowssystem32configsystemprofileMy Documents

On a typical installation of Windows Vista and later versions, check the following locations for application data for programs running as Local System (NT AUTHORITYSYSTEM):

  1. C:Windowssystem32configsystemprofileAppDataRoamingVendorProgram
  2. C:Windowssystem32configsystemprofileAppDataLocalVendorProgram
  3. C:Windowssystem32configsystemprofileAppDataLocalLowVendorProgram
  4. C:Windowssystem32configsystemprofileDocuments

Of course, substitute the appropriate vendor name and program name for Vendor and Program.

On XP there is a "System Profile" located at C:WINDOWSsystem32configsystemprofile

I thought that was where the Local System acct was located. The Network Service and Local Service accounts both have hidden profiles in the Documents and Settings folder.

The Default User folder is typically used as the base folder that new user accounts are created from. So if a new user were to log on to a system for the first time. Their settings would be copied from the Default User profile initially.

 

Reference: http://serverfault.com/questions/9325/where-can-i-find-data-stored-by-a-windows-service-running-as-local-system-accoun

Leave a Reply

Your email address will not be published. Required fields are marked *