> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/processes/privileges.md).

# Privileges

A *privilege* grants a security principal with the right to perform a system-related operation, such as changing the time zone (requires SeTimeZonePrivilege) or shutting down the computer (requires SeShutdownPrivilege). These [privileges ](https://learn.microsoft.com/en-us/windows/win32/secauthz/privilege-constants)are granted by the system administrators, typically via GPOs or locally with [secpol](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings). 

Before a process can perform the desired operation, it must first enable the corresponding privilege within its access token using [AdjustTokenPrivileges](<https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges&#xD;&#xA;>). If the privilege has not been granted to them, the call with fail. When the process attempts to perform the operation, the callee uses [LsaEnumerateAccountRights ](https://learn.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsaenumerateaccountrights)to verify that the required privilege is enabled in the callers token.

There are privileges that are so powerful that any user that can enable them can effectively take control of the entire computer, even if they are not administrators. These include:

* **SeDebugPrivilege** - Obtain read/write handles to any process, even those owned by other users or SYSTEM.
* **SeTakeOwnershipPrivilege** - Take ownership of any securable object including files, handles, and threads.
* **SeRestorePrivilege** - replace any file on the system.
* **SeloadDriverPrivilege** - load a device driver into the kernel.
* **SeCreateTokenPrivilege** - create arbitary access tokens to impersonate any user with any privilege and any domain group membership.