Section 3: Access Tokens

The Big Picture: The Festival Wristband

At a music festival you show your ticket once at the gate. A guard snaps a wristband on you. From then on, nobody asks for the ticket again. Staff just glance at your wristband: "VIP", "Backstage", "General".

An access token is that wristband. When you sign in, Windows checks your password once, then builds a token. Every program you run carries a copy, and Windows looks at the token (not your password) whenever a program wants to open something.

What it is: An access token is a small kernel object (a data structure kept in protected memory that normal programs cannot edit) that describes who a process is and what it may do.

3.1 What an Access Token Contains

A token holds these main pieces:

┌────────────────────────── ACCESS TOKEN ──────────────────────────┐
│ User SID        : S-1-5-21-...-1001  (you)                       │
│ Group SIDs      : Everyone, Users, INTERACTIVE, Administrators*  │
│ Privileges      : SeShutdownPrivilege, SeChangeNotifyPrivilege   │
│ Integrity level : Medium                                         │
│ Logon session   : 0x3E7A1                                        │
│ Token type      : Primary                                        │
└──────────────────────────────────────────────────────────────────┘
 * "deny-only" until you approve a UAC prompt (see below)

Privileges, in plain words. A privilege is a right that does not belong to a single file. Two examples:

A privilege in your token can be Enabled or Disabled. A disabled one is present but "switched off" until a program turns it on. whoami /priv lists yours (you will do this in the lab). Seeing "Disabled" is normal and does not mean it is missing.

Primary vs impersonation tokens.

Analogy: a primary token is your own ID badge. An impersonation token is a visitor badge a bank clerk wears briefly to open one vault box on your behalf, then takes off. This is how a file server can open your files with your rights, not its own.

Administrators and UAC (User Account Control). If you are an administrator, Windows actually makes two tokens at sign-in:

That is why a normal PowerShell window and an "Run as administrator" window show different whoami /groups and whoami /priv results, even for the same person.

3.2 Token Creation at Logon

What it is: The token is built once, at sign-in, by the LSA (Local Security Authority, which runs inside lsass.exe).

Steps (the full chain is in Section 8):

1. You prove who you are (Section 1 and 6).
2. The authentication package says "valid".
3. LSASS looks up your SID and then collects every group you belong to (local groups, domain groups, plus special ones like Everyone and INTERACTIVE).
4. LSASS adds the privileges that your account and groups have been granted by the local security policy.
5. It creates a logon session (a record with a unique ID for this sign-in) and the access token tied to it.
6. It hands the token to Winlogon, which starts your desktop.

 credentials ──► LSASS ──► looks up: SID + groups + privileges
                                  │
                                  ▼
                       logon session  +  ACCESS TOKEN
                                  │
                                  ▼
                       Winlogon starts your shell with it

Important consequence: tokens are a snapshot. The token reflects your groups at the moment of sign-in. If an administrator adds you to a new group, your current programs do not see it until you sign out and in again. This is a very common support puzzle: "I was added to the group but still get Access Denied." The fix is to sign out and back in (or restart).

One logon, many sessions. The PC also creates logon sessions for services and the system itself, each with its own token (for example, SYSTEM, LOCAL SERVICE and NETWORK SERVICE). You may see the Username column in Task Manager show these names. Hedge: the exact list varies by Windows version.

3.3 Token Attached to Every Process and Thread the User Starts

What it is: Every process (a running program) has a primary token attached. A new process does not ask you for a password. It inherits a copy of its parent's token.

 explorer.exe     (token: you, Medium)
     │  you double-click
     ▼
 notepad.exe      (copy of the same token: you, Medium)
     │
     ▼
 any program Notepad starts: same token again

Exceptions that change the token:

Threads and impersonation. A thread is a single line of work inside a process. By default a thread uses its process's token. A server thread can temporarily attach an impersonation token so that one request is checked with the client's rights.

What Windows does on every access. When any thread tries to open a file, registry key, or other object, the kernel reads that thread's token (the impersonation token if there is one, else the process token). Then it compares it with the object's access list (Section 5).

See it yourself: In Task Manager → Details tab, right-click a column header → Select columns → tick User name. You will see explorer.exe, notepad.exe and others all running as you, while lsass.exe and winlogon.exe show SYSTEM.

Safety note: Because a token is the master key for everything a program may do, Windows keeps tokens in the kernel and never lets programs edit their own. Protecting tokens is why malware tries to run as SYSTEM or as an administrator, and why running as a standard user helps.

Summary