Greetings,
I am looking at a process token (using !token addr) but it does not expand
the RestrictedSids list. Is there any easy way to look at the list?
I know how to read the _SID_AND_ATTRIBUTES but I just wondered if windbg had
native support for it.
here is an example:
0: kd> !token e130f888
_TOKEN e130f888
TS Session ID: 0
User: S-1-5-21-763359486-337149147-3206701031-500
Groups:
00 S-1-5-21-763359486-337149147-3206701031-513
Attributes - Mandatory Default Enabled
01 S-1-1-0
Attributes - Mandatory Default Enabled
02 S-1-5-32-544
Attributes - Mandatory Owner DenyOnly
03 S-1-5-32-545
Attributes - Mandatory Default Enabled
04 S-1-5-4
Attributes - Mandatory Default Enabled
05 S-1-5-11
Attributes - Mandatory Default Enabled
06 S-1-5-5-0-37727
Attributes - Mandatory Default Enabled LogonId
07 S-1-2-0
Attributes - Mandatory Default Enabled
Primary Group: S-1-5-21-763359486-337149147-3206701031-513
Privs:
00 0x000000017 SeChangeNotifyPrivilege Attributes - Enabled
Default
Authentication ID: (0,e066)
Impersonation Level: Anonymous
TokenType: Primary
Source: User32 TokenFlags: 0x91 ( Token in use )
Token ID: 9bb8d ParentToken ID: fbe4
Modified ID: (0, 9bb63)
RestrictedSidCount: 8 RestrictedSids: e130fa60 ( <<<<< !!!)
thanks!