In Microsoft Windows based systems, each user has a user account with which he/she logs on, and each account is represented by a unique Security Identifier (SID) that uniquely represents that account across the system.
User accounts are generally of two types -
local user accounts and
domain user accounts.
A
local user account is an account that is local to a single machine running a version of Microsoft's family of operating systems, such as Windows XP, Windows 7, Windows Server 2008 etc. A local account can only be authenticated by the local machine and used on the local machine.
In contrast,
a domain user account is an account that belongs to an Active Directory domain in Microsoft Windows Server environments. A domain user account is authenticated by the Active Directory and can be used on any domain-joined machine that belongs to the same domain as does the domain user account, or to a domain or forest with which there exists a trust relationship with the domain/forest of the domain user account.
User accounts almost always are made members of security groups. These security groups can be
local security groups or
domain security groups. Domain security groups (also known as Active Directory Security Groups) include domain local groups, global groups, universal groups. Groups can also be of type Builtin on a domain, and such groups are like local groups except that they only exist on all domain controllers of a domain and they can only be used to control access to resources on Domain Controllers.
 |
Group Memberships and Access Tokens together control and enforce access |
In most environments, group memberships are used to collectively grant a set of user's access to a set of resources across the system as per the organization's resource authorization model/strategy..
What is an Access Token
The memberships of a domain user account are generally calculated by the system during the user's logon and inserted in a structure known as the
user's access token.The user's access token thus contains a list of all security groups to which a user belongs.
An
access token is thus used by the system when making access-control decisions, such as when determining whether or not to grant a user the access requested by the user on a resource. The way the system make this determination is to compare SIDs in the resource's access control list (ACL) with the SIDs in the user's access token. If an "allow" match is found, access is granted.
It is often helpful to be able to view a
user's access token. The most important thing one can find out by looking at a user's access token is what security groups the user belongs to. This information can be very helpful when trying to find out what all the user might have access to.
However this information can also be sensitive, because for example, the name of the groups could reveal certain sensitive aspects about a user's status at an organization. For instance, if a user is being tracked for suspicious activity, and he/she is made a member of a group called "
Monitored Users", anyone who could view the user's access token could find out that this is user's activity is being monitored.
Viewing Access Tokens
All users can view their own access token at anytime, and Microsoft provides tools to be able to view access tokens, such as the
whoami utility, which can be used to peek into one's own token.
 |
Using whoami to view one's own access token |
However, it is very difficult to be able to look into another user's token, because the algorithm involved in generating/computing a user's access token is very sophisticated, and although it is baked into the operating system, it is not easy to try and simulate/calculate with sufficient level of accuracy.
As a result, IT administrators and IT security personnel do not have the means to be able to view into another user's access token. There are ways like
KerberosS4U that can be used to try and obtain a logon session for another user's behalf, or
Delegation of Authentication, which can also be used to impersonate another user, but these ways do not provide an easy means by which to view another user's access token.
Gold Finger's access token viewer is unique in that regard, in that it lets IT personnel easily view the access token of any domain user account. It is arguably the only automated access token viewer capability for the Microsoft Windows platform, and it makes viewing another user's token, as easy as touching a button.
 |
Using Gold Finger to View Another User's Access Token |
Gold Finger's
access token viewer can generate domain-specific access-tokens for any domain user specified by the IT administrator. It takes domain-specific information into account to ensure that the right types of groups from the right domains are included in the simulated access-token.
For example, it ensures that all relevant global groups and universal groups are included from the user's domain, as well as that all relevant domain-local groups are included from the target domain. It also obviously includes any nested group memberships for accuracy, and thus delivers the complete and accurate picture.
Gold Finger's access token viewer capability can be used to determine/analyze -
- The list of all domain security groups to which a user belongs
- The list of all domain security groups to which an IT administrator belongs
- The list of all domain security groups to which an employee belongs
- The list of all domain security groups to which a contractor's account belongs
This information is also very helpful when trying to find out
who has access to a particular file/folder/Active Directory object, because it lets you instantly compare the target object's ACL with the user's access-token and determine whether or not the user has the access in question.
The ability to view a user's access token is thus very valuable and helpful in many situations including when performing an
Active Directory Audit, when finding out whether or not a user has access to a specific file/folder, and to find out all what a user might have access to across the system.
For more information on Gold Finger's access token viewing capability, please visit -
http://www.paramountdefenses.com/goldfinger_capabilities_access_token_viewer_for_active_directory
The ability to be able to view into a user's Access Token when evaluating Cyber Security related risks to Active Directory deployments in the DMZ, or when auditing security rights in Active Directory. In addition it can be helping when you are trying to list all the groups to which a user belongs.
