Token中的信息

最新推荐文章于 2025-07-11 16:31:03 发布

qinqin772

最新推荐文章于 2025-07-11 16:31:03 发布

阅读量7k

点赞数 3

CC 4.0 BY-SA版权

分类专栏： Token SID... ACCOUNT 文章标签： TOKEN WINDOWS 特权 SID

本文链接：https://blog.youkuaiyun.com/qq_26153041/article/details/52179289

本文探讨了Windows操作系统中Token的相关信息，包括如何通过GetTokenInformation API获取Token_USER和Token_GROUPS等详细资料，同时指出了TOKEN_PRIVILEGE与USER RIGHTS的区别。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Token中有哪些信息呢?这我们可以从一个api中得到,

GetTokenInformation https://msdn.microsoft.com/en-us/library/windows/desktop/aa446671(v=vs.85).aspx

想要获取的信息类别

TOKEN_INFORMATION_CLASS

typedef enum _TOKEN_INFORMATION_CLASS { 
  TokenUser                             = 1,
  TokenGroups,
  TokenPrivileges,
  TokenOwner,
  TokenPrimaryGroup,
  TokenDefaultDacl,
  TokenSource,
  TokenType,
  TokenImpersonationLevel,
  TokenStatistics,
  TokenRestrictedSids,
  TokenSessionId,
  TokenGroupsAndPrivileges,
  TokenSessionReference,
  TokenSandBoxInert,
  TokenAuditPolicy,
  TokenOrigin,
  TokenElevationType,
  TokenLinkedToken,
  TokenElevation,
  TokenHasRestrictions,
  TokenAccessInformation,
  TokenVirtualizationAllowed,
  TokenVirtualizationEnabled,
  TokenIntegrityLevel,
  TokenUIAccess,
  TokenMandatoryPolicy,
  TokenLogonSid,
  TokenIsAppContainer,
  TokenCapabilities,
  TokenAppContainerSid,
  TokenAppContainerNumber,
  TokenUserClaimAttributes,
  TokenDeviceClaimAttributes,
  TokenRestrictedUserClaimAttributes,
  TokenRestrictedDeviceClaimAttributes,
  TokenDeviceGroups,
  TokenRestrictedDeviceGroups,
  TokenSecurityAttributes,
  TokenIsRestricted,
  MaxTokenInfoClass
} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;

如此在这里我们一一获取下这些信息

1.TOKEN_USER: https://msdn.microsoft.com/en-us/library/windows/desktop/aa379634(v=vs.85).aspx

2.TOKEN_GROUPS: https://msdn.microsoft.com/en-us/library/windows/desktop/aa379624(v=vs.85).aspx

以及各种Attributes的意义

Value	Meaning
SE_GROUP_ENABLED 0x00000004L	The SID is enabled for access checks. When the system performs an access check, it checks for access-allowed and access-denied access control entries (ACEs) that apply to the SID. A SID without this attribute is ignored during an access check unless the SE_GROUP_USE_FOR_DENY_ONLY attribute is set.
SE_GROUP_ENABLED_BY_DEFAULT 0x00000002L	The SID is enabled by default.
SE_GROUP_INTEGRITY 0x00000020L	The SID is a mandatory integrity SID.
SE_GROUP_INTEGRITY_ENABLED 0x00000040L	The SID is enabled for mandatory integrity checks.
SE_GROUP_LOGON_ID 0xC0000000L	The SID is a logon SID that identifies the logon session associated with an access token.
SE_GROUP_MANDATORY 0x00000001L	The SID cannot have the SE_GROUP_ENABLED attribute cleared by a call to the