How Windows 98 Handled Multiple User Accounts
Microsoft Windows 98 introduced multi-user functionality designed to let multiple people share a single personal computer while retaining their own personalized settings. However, unlike modern operating systems or its contemporary enterprise counterpart, Windows NT, Windows 98 featured zero security isolation between users. The multi-user system was built entirely around personalization and convenience rather than access control, meaning any user could view, modify, or delete another user's files with minimal effort.
The Purpose: Personalization Over Protection
The multi-user feature in Windows 98 was managed through "User
Profiles" in the Control Panel. When enabled, the operating system
allowed each user to configure their own desktop arrangement, Start menu
shortcuts, web favorites, and color schemes. When a user logged in,
Windows simply loaded their specific registry hive
(HKEY_USERS\<Username>) and pointed shell folders to
their respective directory inside
C:\Windows\Profiles\<Username>.
The Illusion of Authentication
Windows 98 prompted users with a login screen asking for a username and a password. Despite this prompt, the operating system provided no real authentication barrier:
- The Cancel Button Bypass: If a user pressed the "Cancel" or "Escape" key at the login dialog, Windows 98 did not restrict access. Instead, it booted straight to the default desktop with full system privileges.
- Trivial Password Storage: Passwords were saved
locally in
.PWL(Password List) files located in the Windows directory. These files used weak encryption algorithms that were easily cracked or bypassed entirely.
Lack of File-Level Permissions
The fundamental reason Windows 98 lacked security isolation was its reliance on the FAT and FAT32 file systems. Unlike NTFS (used by Windows NT), FAT32 had no concept of Access Control Lists (ACLs), file permissions, or ownership.
Because the file system treated all read and write requests equally:
- Any user could open Windows Explorer, navigate to
C:\Windows\Profiles, and open the private documents, browser history, or desktop files of any other user. - Programs run by one user could freely alter system files or data belonging to another account.
- System-wide tools like MS-DOS mode gave unrestricted read and write capabilities across the entire hard drive.
Underlying Architecture
Windows 98 was built as a hybrid 16-bit/32-bit operating system layered on top of MS-DOS. It lacked a secure kernel space, protected memory architecture, and a dedicated security subsystem like the Local Security Authority Subsystem Service (LSASS) found in Windows NT. Because the operating system granted all executing code direct access to the hardware and the single global file system, true isolation was architecturally impossible.
Ultimately, Windows 98 handled multiple user accounts solely as an organizational tool for cosmetic preferences, relying on a system of mutual trust among users rather than technical enforcement.