Access Token Manipulation

Opens a handle to an existing process with a requested access mask.

Opens the access token associated with a process and returns a handle to it.

Opens the access token of a process and lets the caller specify handle attributes such as OBJ_INHERIT.

Enables or disables privileges in a specified access token.

Enables or disables groups (SIDs) in an access token, or resets group attributes to their default state.

Retrieves a specified class of information about an access token.

Writes a property on an access token — integrity level, session id, owner, default DACL, audit policy, linked token.

Creates a new access token that duplicates an existing token, optionally changing its type and impersonation level.

Creates a restricted (filtered) copy of an existing access token by disabling SIDs, deleting privileges, or adding restricted SIDs.

Assigns the well-known ANONYMOUS LOGON token to the specified thread.

Causes the server thread to impersonate the security context of the client thread.

Legacy LPC: lets a server thread impersonate the security context of the client that sent a port message.

Derives a LowBox (AppContainer) token from an existing token — sets the package SID and capability list that gate broker IPC access.

Reverts a Server Silo / Argon Container impersonation back to the host security context.

Emits a Security event-log entry reporting the use of one or more privileges on a specific object.

Server-side helper that opens a HANDLE to the process that sent a given ALPC message.

Server-side helper that opens a HANDLE to the thread that sent a given ALPC message.

Extended variant of NtOpenKey accepting OpenOptions — required for symlink-following and backup-semantics opens.