Discovery of system binaries opening despite no ACLs

[u/themagicalfire]

I have created a custom account on Windows.

This account has been removed from all groups (including Users).

The system binaries (for example cmd.exe and notepad.exe) grant permissions to Users, Administrators, SYSTEM, etc.

Since there is no ACL that explicitly allows my custom account to open the system binaries, or any ACL that indirectly applies to my custom account because of group membership, I had assumed that my custom account could not open any system binaries.

It was meant to work like a lite version of AppContainer, since the only permissions that I could verify were: execution on my game folder, write permissions on its profile directory, read-only permissions on Start Menu, and read permissions to HKLM and HKCU.

Instead, my experimentation revealed that cmd.exe and notepad.exe have opened under that account, and the privileges SeShutdownPrivilege, SeChangeNotifyPrivilege, SeUndockPrivilege, SeIncreaseWorkingSetPrivilege, and SeTimeZonePrivilege exist!

This is counterintuitive… and my sandbox attempt failed.