In order to protect a Windows administrator account from attacks such a Pass-the-Hash and other Token Passing tehcniques (e.g. via Incognito tool), can you tell me if it is a good idea to remove the privilege "SeImpersonatePrivilege" on which Incognito rely on ? If this privilege is removed, it should be impossible to impersonate a token, right ? (of course we assume the admin does not need this privilege in his tasks).
On the other hand, a malware with admin privileges can call PrivilegeCheck and then add the "SeImpersonatePrivilege" privilege to the admin account.
That's why I am asking if removing SeImpersonatePrivilege is a good & strong idea ? Or useless ?