Meziantou.FrameworkPrivileges Class
Provides constants for Windows privilege names that can be enabled or disabled on access tokens.
public static class PrivilegesRemarks
For more information about privileges, see https://docs.microsoft.com/en-us/windows/win32/secauthz/privilege-constants.
Example
using var token = AccessToken.OpenCurrentProcessToken(TokenAccessLevels.AdjustPrivileges | TokenAccessLevels.Query);
// Enable debug privilege to access other processes
token.EnablePrivilege(Privileges.SE_DEBUG_NAME);
// Enable backup privilege to bypass file security checks
token.EnablePrivilege(Privileges.SE_BACKUP_NAME);
// Disable a privilege
token.DisablePrivilege(Privileges.SE_SHUTDOWN_NAME);Constants
| Name | Description |
|---|---|
| SE_ASSIGNPRIMARYTOKEN_NAME | Required to assign the primary token of a process. |
| SE_AUDIT_NAME | Required to generate audit-log entries. |
| SE_BACKUP_NAME | Required to perform backup operations. |
| SE_CHANGE_NOTIFY_NAME | Required to receive notifications of changes to files or directories. |
| SE_CREATE_GLOBAL_NAME | Required to create named file mapping objects in the global namespace. |
| SE_CREATE_PAGEFILE_NAME | Required to create a paging file. |
| SE_CREATE_PERMANENT_NAME | Required to create a permanent object. |
| SE_CREATE_SYMBOLIC_LINK_NAME | Required to create a symbolic link. |
| SE_CREATE_TOKEN_NAME | Required to create a primary token. |
| SE_DEBUG_NAME | Required to debug and adjust the memory of a process owned by another account. |
| SE_ENABLE_DELEGATION_NAME | Required to mark user and computer accounts as trusted for delegation. |
| SE_IMPERSONATE_NAME | Required to impersonate a client after authentication. |
| SE_INCREASE_QUOTA_NAME | Required to increase the quota assigned to a process. |
| SE_INC_BASE_PRIORITY_NAME | Required to increase the base priority of a process. |
| SE_INC_WORKING_SET_NAME | Required to allocate more memory for applications that run in the context of users. |
| SE_LOAD_DRIVER_NAME | Required to load or unload a device driver. |
| SE_LOCK_MEMORY_NAME | Required to lock physical pages in memory. |
| SE_MACHINE_ACCOUNT_NAME | Required to create a computer account. |
| SE_MANAGE_VOLUME_NAME | Required to enable volume management privileges. |
| SE_PROF_SINGLE_PROCESS_NAME | Required to gather profiling information for a single process. |
| SE_RELABEL_NAME | Required to modify the mandatory integrity level of an object. |
| SE_REMOTE_SHUTDOWN_NAME | Required to shut down a system using a network request. |
| SE_RESTORE_NAME | Required to perform restore operations. |
| SE_SECURITY_NAME | Required to perform a number of security-related functions. |
| SE_SHUTDOWN_NAME | Required to shut down a local system. |
| SE_SYNC_AGENT_NAME | Required for a domain controller to use the LDAP directory synchronization services. |
| SE_SYSTEMTIME_NAME | Required to modify the system time. |
| SE_SYSTEM_ENVIRONMENT_NAME | Required to modify firmware environment variables. |
| SE_SYSTEM_PROFILE_NAME | Required to gather profiling information for the entire system. |
| SE_TAKE_OWNERSHIP_NAME | Required to take ownership of an object without being granted discretionary access. |
| SE_TCB_NAME | Required to act as part of the operating system. |
| SE_TIME_ZONE_NAME | Required to adjust the time zone associated with the computer's internal clock. |
| SE_TRUSTED_CREDMAN_ACCESS_NAME | Required to access Credential Manager as a trusted caller. |
| SE_UNDOCK_NAME | Required to remove a computer from a docking station. |
| SE_UNSOLICITED_INPUT_NAME | Required to read unsolicited input from a terminal device. |
SE_ASSIGNPRIMARYTOKEN_NAME
Required to assign the primary token of a process.
public const string SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege"SE_AUDIT_NAME
Required to generate audit-log entries.
public const string SE_AUDIT_NAME = "SeAuditPrivilege"SE_BACKUP_NAME
Required to perform backup operations.
public const string SE_BACKUP_NAME = "SeBackupPrivilege"SE_CHANGE_NOTIFY_NAME
Required to receive notifications of changes to files or directories.
public const string SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege"SE_CREATE_GLOBAL_NAME
Required to create named file mapping objects in the global namespace.
public const string SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege"SE_CREATE_PAGEFILE_NAME
Required to create a paging file.
public const string SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege"SE_CREATE_PERMANENT_NAME
Required to create a permanent object.
public const string SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege"SE_CREATE_SYMBOLIC_LINK_NAME
Required to create a symbolic link.
public const string SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege"SE_CREATE_TOKEN_NAME
Required to create a primary token.
public const string SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege"SE_DEBUG_NAME
Required to debug and adjust the memory of a process owned by another account.
public const string SE_DEBUG_NAME = "SeDebugPrivilege"SE_ENABLE_DELEGATION_NAME
Required to mark user and computer accounts as trusted for delegation.
public const string SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege"SE_IMPERSONATE_NAME
Required to impersonate a client after authentication.
public const string SE_IMPERSONATE_NAME = "SeImpersonatePrivilege"SE_INCREASE_QUOTA_NAME
Required to increase the quota assigned to a process.
public const string SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege"SE_INC_BASE_PRIORITY_NAME
Required to increase the base priority of a process.
public const string SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege"SE_INC_WORKING_SET_NAME
Required to allocate more memory for applications that run in the context of users.
public const string SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege"SE_LOAD_DRIVER_NAME
Required to load or unload a device driver.
public const string SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege"SE_LOCK_MEMORY_NAME
Required to lock physical pages in memory.
public const string SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege"SE_MACHINE_ACCOUNT_NAME
Required to create a computer account.
public const string SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege"SE_MANAGE_VOLUME_NAME
Required to enable volume management privileges.
public const string SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege"SE_PROF_SINGLE_PROCESS_NAME
Required to gather profiling information for a single process.
public const string SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege"SE_RELABEL_NAME
Required to modify the mandatory integrity level of an object.
public const string SE_RELABEL_NAME = "SeRelabelPrivilege"SE_REMOTE_SHUTDOWN_NAME
Required to shut down a system using a network request.
public const string SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege"SE_RESTORE_NAME
Required to perform restore operations.
public const string SE_RESTORE_NAME = "SeRestorePrivilege"SE_SECURITY_NAME
Required to perform a number of security-related functions.
public const string SE_SECURITY_NAME = "SeSecurityPrivilege"SE_SHUTDOWN_NAME
Required to shut down a local system.
public const string SE_SHUTDOWN_NAME = "SeShutdownPrivilege"SE_SYNC_AGENT_NAME
Required for a domain controller to use the LDAP directory synchronization services.
public const string SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege"SE_SYSTEMTIME_NAME
Required to modify the system time.
public const string SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege"SE_SYSTEM_ENVIRONMENT_NAME
Required to modify firmware environment variables.
public const string SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege"SE_SYSTEM_PROFILE_NAME
Required to gather profiling information for the entire system.
public const string SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege"SE_TAKE_OWNERSHIP_NAME
Required to take ownership of an object without being granted discretionary access.
public const string SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege"SE_TCB_NAME
Required to act as part of the operating system.
public const string SE_TCB_NAME = "SeTcbPrivilege"SE_TIME_ZONE_NAME
Required to adjust the time zone associated with the computer's internal clock.
public const string SE_TIME_ZONE_NAME = "SeTimeZonePrivilege"SE_TRUSTED_CREDMAN_ACCESS_NAME
Required to access Credential Manager as a trusted caller.
public const string SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege"SE_UNDOCK_NAME
Required to remove a computer from a docking station.
public const string SE_UNDOCK_NAME = "SeUndockPrivilege"SE_UNSOLICITED_INPUT_NAME
Required to read unsolicited input from a terminal device.
public const string SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege"