Windows access tokens, groups, and privileges

Mechanism

Windows access tokens describe a security principal, group membership, privileges, integrity level, and restrictions. A group listed in the token may be deny-only, and a privilege may be present but disabled. Access checks evaluate the token against an object security descriptor; process name or administrative membership alone does not describe effective authority.

Practical method

Inspect the current identity, groups, privileges, and integrity level. Distinguish primary and impersonation tokens. For a target resource, examine its ACL and compare the desired operation with granted rights. Verify whether a sensitive privilege must be enabled before use.

whoami /all
Get-Acl C:\Lab\fixture.txt | Format-List

Interpreting evidence

Record the exact privilege state and token type at the operation. A successful read does not prove ownership or write access to the same object.

Pitfalls and limits

UAC creates different token contexts. Restricted tokens and deny entries change apparent group authority. Impersonation level constrains what a service can do with a client identity.