Hardware is actually mapped as an object namespace, which is presented to the user as the drive letters. This was exposed with Windows XP booting in safe mode; during the boot process it would print file paths as object paths, not drive paths.
Much as I'm more in the *nix way now, there's plenty of curiosities to explore and tinker in Windows.
Well, you do have:
- capabilities (which are so coarse-grained as to be practically useless)
- 8 types of namespaces
- seccomp-bpf
- LSM (AppArmor, SELinux, TOMOYO, etc)
https://docs.microsoft.com/en-us/troubleshoot/windows-server...
Windows also differentiates between the human ADMINISTRATOR account and machine "root" accounts like "LOCALSYSTEM".
User accounts are also disambiguated by "domain"; ADMINISTRATOR on the local machine is not automatically the same as the domain-wide ADMINISTRATOR.
The limitation is that there is one user ID, 0 which can do everything and all the other IDs can do almost nothing.
This has nothing to do with domains and everything with the distinction you describe between the Windows Administrator, local system or even more powerful trustedinstaller accounts.
This does technically give Windows some advantage here as SID's are namespaced - you can have multiple domains in a forest, domain trusts, etc - but I don't think as far as realistic number of users accessing a network it makes much of a difference.
Where it does suck on Linux, however, is user namespaces. 32-bits is a lot when it comes to just giving out accounts, but it's nowhere near enough to give every user a 16-bit chunk of accounts for mapping the traditional 0-65535 (because nobody) ranges for use with unprivileged user namespaces. I'd really like to see a push for 64-bit uid/gid's for this reason.
Also, Windows SIDs are fixed-size 128 bit. They were supposed to be GUIDs, but they are not that random; user SIDs contain common prefix from the domain SID.
A lot of innovations on NT are late as well to be fair, like the whole Application Views (?) of the system (basically an FS/Registry app sandboxing)
Linux has this, but it is, as you say, underused.
Sadly, that usually means it’s bugged as hell and impossible to use unless you’ve been trained for many years at ms to do that.
* it is optimized for integration with third party software from people who don’t have the source, so for instance the driver model is interesting
* the built in configuration system (the registry) and how it’s used throughout
* the (underused) personalities system you can use to show different apis to different binaries
* the security model is much more interesting, while in Linux you have ‘root’ and everything else, on Windows this is much more granular (unfortunately it’s so complex it’s basically impossible to use).
The architecture is really quite interesting, even though Microsoft didn’t make a lot of use of a large part of it.