The most modern linux distribution use a very adjustable and highly configurable tool called sudo. You may have already heard of it. In Windows, when installing a program you have to provide the Adminsitrators password.
In Ubuntu the Administrator user (root) is defaultly deactivated. You even don't know his password, no one does, until you changed his password with
sudo. A user may gain root priviledges for a short amount of time or for a single task (installing a program for example). This user must have the rights to use
sudo (configured in
sudo the program that is executed is executed as the root user.
Then in graphical sessions driven by gnome, there are other mechanisms to do administrative tasks. One of them is policyKit. There is a daemon running in the background with root priviledges. If, for example, a user wants to shutdown the machine (what only root can) the user talks to this daemon through a secure context (called D-Bus). If granted, the daemon executes the the system's shutdown command. Those rules are defined in
Gnome often comes with a single-sign-on solution called Gnome Keyring. In this keyring your credetials can be stored. When you authenticate via a network share (in nautilus for example) you will be prompted for a password and there is a checkbox to remember you password. That will be stored in the keyring, a database protected with a password. This database will be unlocked during a graphical login process via PAM.
Then there is AppArmor that is based on SELinux. AppArmor defines profiles for different applications running on the system. Those profiles handle and restrict the access that a specific application needs.
All those mechanisms are also implemented into Windows operating systems. Just in a different, less transparent way.
I can really recommend some lecture of the above mentioned mechanisms, to understand how they work together.