Windows Privileges Overview

Privileges are rights an account can be granted to perform operations on the local system (manage services, load drivers, shut down, debug applications, etc.). They differ from access rights, which grant or deny access to securable objects.

Stored in a database and granted via the access token at logon.
Can differ per machine, including for domain accounts.
On each privileged action, the system checks the token for the privilege and whether it is enabled. Most are disabled by default.
Goal during an assessment: use the target account’s privileges to escalate locally or move toward admin/Domain Admin.

Windows Authorization Process

Security principals: anything that can be authenticated (users, computer accounts, processes running in an account’s context, security groups). Each has a unique SID for its lifetime.
On access to a securable object, the user’s access token (user SID, group SIDs, privilege list, extra access info) is compared against the ACEs in the object’s security descriptor (owner SID, group SID, SACL, DACL). The system walks the ACEs until a match is found, then grants or denies access.
Privesc work involves abusing access rights or inserting ourselves into this process.

Privileged Groups

Group	Notes
Default Administrators	Domain Admins and Enterprise Admins are “super” groups
Server Operators	Modify services, access SMB shares, back up files
Backup Operators	Log on to DCs locally; treat as Domain Admins. Can shadow copy SAM/NTDS, read registry remotely, access DC file system via SMB. Sometimes added to local Backup Operators on non-DCs
Print Operators	Log on to DCs locally and trick Windows into loading a malicious driver
Hyper-V Administrators	If virtual DCs exist, treat as Domain Admins
Account Operators	Modify non-protected accounts and groups
Remote Desktop Users	No useful default permissions, but often granted Allow Log On Through Remote Desktop Services; RDP lateral movement
Remote Management Users	Log on to DCs with PSRemoting (sometimes added to local group on non-DCs)
Group Policy Creator Owners	Create GPOs; need delegated rights to link them to a domain/OU
Schema Admins	Modify AD schema; can backdoor future Group/GPO objects by adding a compromised account to the default object ACL
DNS Admins	Can load a DLL on a DC but can’t restart DNS; DLL loading often crashes the service and works as persistence after reboot. More reliable: create a WPAD record

User Rights Assignment

Set via local/domain Group Policy and group membership.

Constant	Setting Name	Standard Assignment	Description
`SeNetworkLogonRight`	Access this computer from the network	Administrators, Authenticated Users	Connect over the network; required by SMB, NetBIOS, CIFS, COM+
`SeRemoteInteractiveLogonRight`	Allow log on through Remote Desktop Services	Administrators, Remote Desktop Users	Access the login screen via RDP (may connect but not log on to the console)
`SeBackupPrivilege`	Back up files and directories	Administrators	Bypass file/dir/registry permissions for backup
`SeSecurityPrivilege`	Manage auditing and security log	Administrators	Set object audit options (SACLs); view and clear the Security log
`SeTakeOwnershipPrivilege`	Take ownership of files or other objects	Administrators	Take ownership of any securable object (AD objects, NTFS, printers, registry keys, services, processes, threads)
`SeDebugPrivilege`	Debug programs	Administrators	Attach to/open any process, including ones not owned by the user; access to sensitive OS components
`SeImpersonatePrivilege`	Impersonate a client after authentication	Administrators, Local Service, Network Service, Service	Impersonate another account and act on its behalf
`SeLoadDriverPrivilege`	Load and unload device drivers	Administrators	Dynamically load/unload drivers (run as highly privileged code)
`SeRestorePrivilege`	Restore files and directories	Administrators	Bypass permissions when restoring; set valid principals as object owner
`SeTcbPrivilege`	Act as part of the operating system	Administrators, Local Service, Network Service, Service	Assume the identity of any user and access their resources; reserve for service accounts that need it (AV, backup)

Enumerating Privileges

whoami /priv

Lists privileges assigned to the current user and their state.
UAC (introduced in Vista) restricts rights in non-elevated sessions, so an admin’s rights differ drastically between non-elevated and elevated consoles. Some rights only appear/work in an elevated cmd or PowerShell.
Disabled means the privilege is assigned but can’t be used until enabled in the token. Windows has no built-in command/cmdlet to enable privileges; use a script that adjusts token privileges (e.g. an enable-privilege PowerShell script).

Elevated local administrator

SeIncreaseQuotaPrivilege, SeSecurityPrivilege, SeTakeOwnershipPrivilege, SeLoadDriverPrivilege,
SeSystemProfilePrivilege, SeSystemtimePrivilege, SeProfileSingleProcessPrivilege,
SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeBackupPrivilege, SeRestorePrivilege,
SeShutdownPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeChangeNotifyPrivilege (Enabled),
SeRemoteShutdownPrivilege, SeUndockPrivilege, SeManageVolumePrivilege, SeImpersonatePrivilege (Enabled),
SeCreateGlobalPrivilege (Enabled), SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege,
SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege

All others are Disabled.

Standard user

SeChangeNotifyPrivilege        Bypass traverse checking        Enabled
SeIncreaseWorkingSetPrivilege  Increase a process working set  Disabled

Backup Operators

SeShutdownPrivilege            Shut down the system            Disabled
SeChangeNotifyPrivilege        Bypass traverse checking        Enabled
SeIncreaseWorkingSetPrivilege  Increase a process working set  Disabled

UAC restricts other rights, but SeShutdownPrivilege alone lets a member shut down a DC if they log on locally (not via RDP/WinRM), causing a major outage.

Detection

Log and alert on Event ID 4672 (Special privileges assigned to new logon).
Tune by monitoring privileges that should never be assigned, or that should only go to specific accounts.

Takeaways

Review membership of the privileged groups above; low-privileged users are often found in one or more of them.
These can compromise a single host or extend access across an AD environment.

Keyboard shortcuts

notebook