Access Tokens

Overview

In Windows operating system, Access Tokens are used to provide security context to processes, threads, and other system objects, indicating the identity and privileges of the user or process. Access Tokens contain a security identifier (SID) that identifies the user or process, along with a set of security attributes, such as security groups and privileges.

Windows also uses Integrity Levels as a security mechanism to restrict the level of access and permission that processes have to system resources. Integrity Levels are assigned to objects, such as files and registry keys, and determine whether a process can read, write, or execute the object.

There are four Integrity Levels in Windows, in order of decreasing privilege:

• System: This level is reserved for the operating system and its components and has the highest level of privilege. Processes running at this level can access and modify system resources without restrictions.

• High: This level is typically assigned to processes that have been elevated through User Account Control (UAC) prompts or are running with administrative privileges. Processes running at this level can access and modify most system resources.

• Medium: This level is assigned to standard user processes and restricts access to system resources. Processes running at this level can read and write to user-specific folders and objects but cannot modify system-level objects.

• Low: This level is used for processes that are deemed untrusted or have been downloaded from the internet. Processes running at this level have limited access to system resources and cannot modify system-level objects.

Access Tokens can be used to enforce Integrity Levels by assigning a level to a process based on the privileges of the user or process that the Access Token represents. When a process is started, its Access Token is checked against the Integrity Level of the object that it is attempting to access. If the Integrity Level of the object is higher than the Integrity Level of the process, the process is denied access to the object.