jperezduerto.info
Security in depth · Unit 22 · Lesson 24 of 44
Windows access tokens
Read group attributes in the token used for a particular access check.
Helpful before thisWindows privilege escalation
After this lesson you can
- Explain why account membership and usable token groups are different evidence.
One idea. One situation. One reasoned decision.
How it works
An access token describes a process or thread’s security context, including identity, groups, privileges, and other attributes. Windows uses that context in authorization decisions. Membership of an administrative group does not mean every process is running with the same effective authority. Review the token relevant to the operation, and distinguish account configuration from the context of a running process.
Read the supplied record
A fictional support application presents this simplified token excerpt:
| Field | Recorded value |
|---|---|
| User | Jordan |
| Helpdesk group | Enabled |
| Administrators group | Deny-only |
The presence of Administrators does not mean that this token can use an allow entry for that group. A deny-only identifier can still be considered for denial. The account’s directory memberships are therefore insufficient to describe this process’s access.
Next identify the object and requested rights. If a thread is using an impersonation token, that context may be relevant instead of relying solely on the process’s primary token. An existing handle raises a further question about the rights already granted to it.
This excerpt does not establish a final access result: it omits the object’s policy and other applicable controls. The useful finding is precisely what the excerpt supports and which evidence is missing.
The key distinction: The same account can operate in different security contexts.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
A token lists a group as deny-only. Does that group satisfy an allow entry for the requested access?
Show the answer
Correct answer: No. It can matter to a deny check, but does not supply that allow grant. Interpret the group identifier together with its attributes and the requested rights.
Try it
- WriteWrite a two-sentence interpretation of the supplied token excerpt: what it establishes about the group, and what resource policy still needs checking.