Walk into the module entitled Windows security in this module will look at the technologies that further
improve the safety and reliability of this operating system.
The first function to further protect Windows users is the User Account Control which was widely commented
on particularly during its premier and for some time afterwards its operation is based on the assumption
that we have two types of users users with standard privileges and users with administrative privileges.
These are users who either belong or don't belong to the computers local Administrators group.
If a user launches any program or process a personal access token for this user is attached to the program.
This means that when logging on to the system we receive a certain token that will identify us it'll
contain our security identifier plus a list of privileges that we have directly or through membership
in various groups
when this automatically attaches such a token to each program we run.
How does a User Account Control function work
in newer versions.
Windows automatically checks user tokens if they're privileged.
The system automatically creates for such a user an additional token which is invisible.
This is a token that's devoid of administrative privileges.
If the administrator logs onto the computer he has two tokens an administrative token or 80 tea and
a standard user access token or set
an important note is that the process can only receive one of these tokens either the token or the set
token
the set token is attached to all processes by default
after receiving the token the process cannot be changed in any way.
This is due to the fact that some programs are closed and restarted when we request additional privileges.
This was the case with Process Explorer such programs must receive a new token with additional privileges
for this mechanism to be somewhat functional.
The designers of Windows assume that the program which requires additional privileges for actions will
ask for such.
In the course of its action the user will be able to decide whether to allow such a program to modify
the user privileges for a work session as well as the entire operating system.
The principle of token inheritance always works
if we have a program running with the administrative token the program activated by it will also receive
this token.
It's worth remembering for example before you run the command with an 8 token
the set token will automatically be assigned to the processes run by the user.
If you belong to the privileged groups
these are predefined groups.
For example groups created during the installation of the operating system.
They are automatically given certain rights.
One of the privileged groups is the administrators group.
Another is the backup operators make create and restore
they have access to data of other users.
For the needs of creating a copy we can read files and folders that we normally don't have access to
this clearly requires raising the privileges
members of the network configuration Operators Group may change system settings including lowering the
level of the security system the advanced user group is really an unused group or at least shouldn't
be used.
This is a group created in order to ensure backward compatibility with certain programs that otherwise
do not want to operate on the Windows environment.
In addition windows checks to see if we have one of the nine specific privileges each of these privileges
may compromise security.
So if we have it it will be automatically withdrawn.
As we create token privilege allows creating new tokens this privilege must be disabled because otherwise
there will be a gap in the entire mechanism.
A person who has the s e TCB privilege may start system processes.
These are processes which operate at a high level of confidence as you take ownership.
Privilege allows taking ownership of objects as the load driver privilege allows installing drivers.
These are processes running in kernel mode system as Restore privilege restores the system's backup
S-E impersonate privilege allows impersonating other users.
We can launch processes acting as someone else
thanks to the SC relabel privilege.
We can change the levels of responsibilities in this way or we can change the integrity and User Account
Control mechanism.
Any person who has the SC debug privilege may connect to other processes and debug or monitor their
action.
Also the previously shown P.W. dump works this way.