AccessToken Class

Namespace: Meziantou.Framework.Win32
Assembly: Meziantou.Framework.Win32.AccessToken.dll
Package: Meziantou.Framework.Win32.AccessToken 3.0.10
Source: AccessToken.cs
Available in package assets: net10.0net11.0

Supported on windows5.1.2600

Represents a Windows access token that identifies a security context for a process or thread.

[SupportedOSPlatform("windows5.1.2600")]
public sealed class AccessToken : IDisposable

Example

// Open the current process token. Adjusting privileges requires the AdjustPrivileges access right.
using var token = AccessToken.OpenCurrentProcessToken(TokenAccessLevels.Query | TokenAccessLevels.AdjustPrivileges);

// Check if the process is elevated
bool isElevated = token.IsElevated();
Console.WriteLine($"Elevated: {isElevated}");

// Get token information
Console.WriteLine($"Token Type: {token.GetTokenType()}");
Console.WriteLine($"Elevation Type: {token.GetElevationType()}");
Console.WriteLine($"Owner: {token.GetOwner()}");

// Enumerate groups
foreach (var group in token.EnumerateGroups())
{
    Console.WriteLine($"Group: {group.Sid} ({group.Attributes})");
}

// Enumerate privileges
foreach (var privilege in token.EnumeratePrivileges())
{
    Console.WriteLine($"Privilege: {privilege.Name} ({privilege.Attributes})");
}

// Enable a privilege. The token must hold it: SeDebugPrivilege is only granted to administrators.
token.EnablePrivilege(Privileges.SE_DEBUG_NAME);

Implements

IDisposable

Methods

Name	Description
DisableAllPrivileges()	Disables all privileges for this token.
DisablePrivilege(string)	Disables a privilege for this token.
Dispose()	Releases the unmanaged resources used by the `AccessToken`.
Duplicate(SecurityImpersonationLevel)	Creates a duplicate of this token with the specified impersonation level.
EnablePrivilege(string)	Enables a privilege for this token.
EnumerateGroups()	Enumerates all groups (security identifiers) associated with the token.
EnumeratePrivileges()	Enumerates all privileges held by the token.
EnumerateRestrictedSid()	Enumerates the restricted SIDs in the token.
GetElevationType()	Gets the elevation type of the token.
GetLinkedToken()	Gets the linked token associated with this token.
GetMandatoryIntegrityLevel()	Gets the mandatory integrity level of the token.
GetOwner()	Gets the owner security identifier (SID) of the token.
GetTokenType()	Gets the type of the token (primary or impersonation).
IsElevated()	Determines whether the token is elevated (running with administrative privileges).
IsLimitedToken()	Determines whether the current process is running with a limited token.
IsRestricted()	Determines whether the token is restricted.
OpenCurrentProcessToken(TokenAccessLevels)	Opens the access token associated with the current process.
OpenProcessToken(Process, TokenAccessLevels)	Opens the access token associated with the specified process.
RemovePrivilege(string)	Removes a privilege from this token.

DisableAllPrivileges()

AccessToken.cs

Disables all privileges for this token.

public void DisableAllPrivileges()

Exceptions

Win32Exception: The operation failed.

DisablePrivilege(string)

AccessToken.cs

Disables a privilege for this token.

public void DisablePrivilege(string privilegeName)

Parameters

privilegeName string: The name of the privilege to disable (e.g., Privileges.SE_DEBUG_NAME).

Exceptions

ArgumentNullException: privilegeName is null.
Win32Exception: The privilege could not be disabled.

Dispose()

AccessToken.cs

Releases the unmanaged resources used by the AccessToken.

public void Dispose()

Duplicate(SecurityImpersonationLevel)

AccessToken.cs

Creates a duplicate of this token with the specified impersonation level.

public AccessToken Duplicate(SecurityImpersonationLevel impersonationLevel)

Parameters

impersonationLevel SecurityImpersonationLevel: The impersonation level for the duplicate token.

Returns

AccessToken A new AccessToken representing the duplicate.

Exceptions

Win32Exception: The token could not be duplicated.

EnablePrivilege(string)

AccessToken.cs

Enables a privilege for this token.

public void EnablePrivilege(string privilegeName)

Parameters

privilegeName string: The name of the privilege to enable (e.g., Privileges.SE_DEBUG_NAME).

Exceptions

ArgumentNullException: privilegeName is null.
Win32Exception: The privilege could not be enabled.

EnumerateGroups()

AccessToken.cs

Enumerates all groups (security identifiers) associated with the token.

public IEnumerable<TokenGroupEntry> EnumerateGroups()

Returns

IEnumerable<TokenGroupEntry> A collection of TokenGroupEntry objects representing the groups.

EnumeratePrivileges()

AccessToken.cs

Enumerates all privileges held by the token.

public IEnumerable<TokenPrivilegeEntry> EnumeratePrivileges()

Returns

IEnumerable<TokenPrivilegeEntry> A collection of TokenPrivilegeEntry objects representing the privileges.

EnumerateRestrictedSid()

AccessToken.cs

Enumerates the restricted SIDs in the token.

public IEnumerable<TokenGroupEntry> EnumerateRestrictedSid()

Returns

IEnumerable<TokenGroupEntry> A collection of TokenGroupEntry objects representing the restricted SIDs.

Remarks

Restricted SIDs are used to limit the token's access to resources beyond the standard access checks.

GetElevationType()

AccessToken.cs

Gets the elevation type of the token.

public TokenElevationType GetElevationType()

Returns

TokenElevationType A TokenElevationType value indicating the elevation status.

Remarks

The elevation type indicates whether the token is elevated, limited, or default. This is useful for User Account Control (UAC) scenarios.

GetLinkedToken()

AccessToken.cs

Gets the linked token associated with this token.

public AccessToken? GetLinkedToken()

Returns

AccessToken? The linked AccessToken, or null if no linked token exists.

Remarks

In UAC scenarios, an administrator account has two tokens: a limited token for normal operations and an elevated token for administrative tasks. This method retrieves the linked token.

GetMandatoryIntegrityLevel()

AccessToken.cs

Gets the mandatory integrity level of the token.

public TokenEntry GetMandatoryIntegrityLevel()

Returns

TokenEntry A TokenEntry containing the integrity level SID.

Remarks

The mandatory integrity level (e.g., Low, Medium, High, System) determines what resources the token can access.

GetOwner()

AccessToken.cs

Gets the owner security identifier (SID) of the token.

public SecurityIdentifier GetOwner()

Returns

SecurityIdentifier The SecurityIdentifier of the token owner.

GetTokenType()

AccessToken.cs

Gets the type of the token (primary or impersonation).

public TokenType GetTokenType()

Returns

TokenType A TokenType value indicating the token type.

IsElevated()

AccessToken.cs

Determines whether the token is elevated (running with administrative privileges).

public bool IsElevated()

Returns

bool true if the token is elevated; otherwise, false.

IsLimitedToken()

AccessToken.cs

Determines whether the current process is running with a limited token.

public static bool IsLimitedToken()

Returns

bool true if the current process is running with a limited token; otherwise, false.

Remarks

A limited token is created when User Account Control (UAC) is enabled and an administrator logs in. The limited token has fewer privileges than the full administrative token.

IsRestricted()

AccessToken.cs

Determines whether the token is restricted.

public bool IsRestricted()

Returns

bool true if the token is restricted; otherwise, false.

Remarks

A restricted token has restricted security identifiers (SIDs) added to it. These restrictions limit the resources that can be accessed with the token.

OpenCurrentProcessToken(TokenAccessLevels)

AccessToken.cs

Opens the access token associated with the current process.

public static AccessToken OpenCurrentProcessToken(TokenAccessLevels accessLevels)

Parameters

accessLevels TokenAccessLevels: The access levels required for the token.

Returns

AccessToken An AccessToken representing the current process token.

Exceptions

Win32Exception: The token could not be opened.

OpenProcessToken(Process, TokenAccessLevels)

AccessToken.cs

Opens the access token associated with the specified process.

public static AccessToken OpenProcessToken(Process process, TokenAccessLevels accessLevels)

Parameters

process Process: The process whose token to open.
accessLevels TokenAccessLevels: The access levels required for the token.

Returns

AccessToken An AccessToken representing the process token.

Exceptions

ArgumentNullException: process is null.
Win32Exception: The token could not be opened.

RemovePrivilege(string)

AccessToken.cs

Removes a privilege from this token.

public void RemovePrivilege(string privilegeName)

Parameters

privilegeName string: The name of the privilege to remove (e.g., Privileges.SE_DEBUG_NAME).

Exceptions

ArgumentNullException: privilegeName is null.
Win32Exception: The privilege could not be removed.