What are the windows privileges that deserve to pay attention to prevent a user (non-admin) to escalate his privileges to the local admin group ? I know SeDebugPrivilege, but what else ?


Edit for clarification : I am looking for a list of privileges that can be abused during escalation attempts. The goal is to check user's privileges to prevent escalade.

  • I'm not sure what you're asking, but if you have UAC on, you don't need to worry in 99% of the cases. (The other 1% are from maybe exploits..) Jan 7, 2014 at 14:20
  • 1
    @SomeNickName err, no. If you have the requisite privileges UAC won't do anything to protect from a malicious user.
    – Steve
    Jan 7, 2014 at 18:05

1 Answer 1


Aside from SeDebugPrivilege, the other major privilege that is abused during escalation attempts is SeImpersonatePrivilege (leveraged in tools like Incognito). This privilege can allow the user to steal impersonation and/or delegation tokens that are present on the machine.

That being said, there are a number of administrative privileges that theoretically have the potential to assist during privilege escalation attempts, including:

  • SeAssignPrimaryTokenPrivilege
  • SeTakeOwnershipPrivilege (owning and modifying objects to elevate privileges)
  • SeCreateTokenPrivilege
  • SeTcbPrivilege
  • SeRestorePrivilege (write access to any file)
  • SeLoadDriverPrivilege
  • SeSecurityPrivilege

An exhaustive list would be difficult to compose, and I couldn't say with any degree of certainty that any administrative privilege could not be somehow leveraged in this way.

Furthermore, similar to how SeTakeOwnershipPrivilege and SeRestorePrivilege might be abused, a common method of escalation from Domain User that I see regularly involves overwriting binaries or other code that will be executed by a higher-privileged account. As such, write access to service binaries, System32, the All Users 'Startup' directory, application executables etc can lead to other accounts (Local System, Administrators) executing an attacker's code. I have personally found that poorly configured file permissions are a more common attack vector when escalating from basic users.

A good overview of different methods, including some of those above: https://www.netspi.com/blog/entryid/112/windows-privilege-escalation-part-1-local-administrator-privileges

  • 1
    SeLoadDriverPrivilege and SeSecurityPrivilege are also sensitive. But really a skilled attacker could potentially leverage almost any privilege to at least get closer to admin access. Jan 7, 2014 at 21:53
  • @MarkBurnett Agreed and edited post accordingly.
    – itscooper
    Jan 7, 2014 at 22:34
  • Thank you @itscooper. I thought I could write a batch file to look after the odd privileges of my users according to a list like you did. It seems to be a bad idea as @"Mark burnett" said that any privilege could be abused ?
    – Jeremy
    Jan 8, 2014 at 15:05
  • @Jeremy I think the difficulty is that privilege escalation is a category of attack in which there are a number of different vectors that might abuse various granted privileges. This makes it difficult to definitively categorise any of these privileges as not being helpful to an attacker for escalation.
    – itscooper
    Jan 8, 2014 at 15:21
  • @Jeremy Given your scenario (the batch file), maybe you could check for any privileges that you know should only be assigned to administrators? You could use the recommendations here as guidance to generate a list: technet.microsoft.com/en-us/library/dd277311.aspx This means you will be checking for any overly-privileged users, not just those who might be able to escalate.
    – itscooper
    Jan 8, 2014 at 15:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.