Windows NTFS permissions are strictly enforced and depending on the identity the executable was launched under and that identity's group membership (and perhaps some additional "user rights assignments"), the executable can only access drives, files and folders where permissions are granted.
Now sure if you allow that executable to launch as SYSTEM then it's game over (much in the same way launching a binary as root is game over).
