This is a pretty basic question but I can't seem to find the right answer. Everything points to file and sharing permissions, NTFS permissions in general. I know how that all works.

My question is what is the purpose of the System account in NTFS permissions on folders and files? I realize that services use the system account to run. But if I have a server for file sharing and I have my share setup and group permissions on all my directories do I need system to be in there?

To me the less you want the better. Will this cause issues with the OS?

I wouldn't remove the system account. There will be services and processes that need access and I doubt you'd want to grant them admin access to the server.

Simple examples I can think of are antivirus software or VSS if you use it. Both probably wouldn't run, or more precisely run properly, without the system account being in the folders

I thought that also. So if you were to get infected wouldn't the simplest action by a hacker be to remove the system account permissions from a folder, copy the virus in and then run it from there now protected by the fact AV can't see it and clean it? I am assuming once it loaded into memory AV would catch it then but still couldn't remove it.

Again this all makes sense and I will leave it. My boss doesn't like vague answers as "because it needs to be there". He asked me to provide him with a reason for the system account being in the permissions. So I am just trying to get a more technical reasoning to be able to say this is why.

Anyway, I appreciate you responding. I was starting to think no one had an answer or wanted to take a shot.