A user can connect with different levels of privileges:
Operating system accounts (user) must be members of the OSDBA or OSOPER groups to connect to the database with administrator privileges.
When you connect with a privilege issuing a 'CONNECT / AS SYSDBA' (OR SYSOPER), Oracle checks if your account is a member of the corresponding OS group (for Windows: 'ORA_sid_DBA' or 'ORA_DBA' group).