> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/processes/access-tokens.md).

# Access Tokens

When a process is spawned, it is assigned with a primary access token that describes the security context of the user that started it. This information includes the user's SID, their group SIDs, and their privileges (described below). When a process performs an action on the system, it occurs under the context of the user.

By default, new threads do not have a specific access token assigned to them, and therefore inherit the security context of the process's primary access token. However, a thread can also impersonate the access token of another user and any work that thread performs will be under the security context of that impersonated user.

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/1db704b10e46dfae377ac9e6dd7a23aa.png" alt=""><figcaption></figcaption></figure>

Every securable object (files, processes, threads, etc) in Windows has discretionary access control list (DACL), which specifies who has what access to the object. When a caller attempts to perform an action against an object, an access check is performed against the object's DACL and the information contained in the caller's access token. Acess is granted if the checks pass, otherwise access is denied.