KBI 220702 Windows Event Log User Rights Codes
Version
N/A
Date
1 Jul 2007
Summary
Windows security event log events ID 608 and 609 enumerate user rights that have been assigned to or removed from the user account.
Technical Background
The following are important codes that need investigation in the case they have been assigned to a user account. They enable access to some critical parts of the operating system and have a great potential for misuse or malicious activity.
Code |
Description |
SeTcbPrivilege |
Act as part of the operating system. This right allows a process to assume the identity of any user. |
SeBackupPrivilege |
Allows user to backup files and directories, effectively ignoring the file and directory permissions. |
SeSystemTimePrivilege |
Allows user to modify the system time. |
SeDebugPrivilege |
Allows user to attach a debugger to any process. This allows for potential access to many hidden / internal data and structures. |
SeRemoteShutdownPrivilege |
Force system shutdown from a remote computer. |
SeLoadDriverPrivilege |
Allows user to install and remove device drivers. Because device drivers run as trusted, highly privileged code, installing incorrect or malicious driver can lead to system instability. |
SeSecurityPrivilege |
Allows user to manage and modify Security auditing policy settings. It also gives user right to clear security log. |
SeManageVolumePrivilege |
Allows user to manage disks and volumes. |
SeRestorePrivilege |
Allows user to restore files and directories from the backup storage circumventing folder and files security permissions. |
SeShutdownPrivilege |
User can shutdown the system. |
SeTakeOwnershipPrivilege |
Enables user to take ownership of any securable object on the system. |
SeSynchAgentPrivilege |
Enables user to read all objects and properties in the Active Directory regardless of security permissions set for them. |
Resolution
N/A