Lesson 1.17: The Windows security model
Most companies run Windows too. Its model in brief: local accounts and the SAM, the Administrators group, the SYSTEM account, access tokens and privileges, User Account Control, services that run with high rights, and domains (Active Directory, a course of its own). In the lab you review command output a colleague exported from a Windows file server, the same way you'd review a Linux host: who is a local administrator, which dangerous privileges a service account holds, a service path that Windows may read the wrong way, and whether UAC is on.
17 min
You will learn to
- Name the main parts of Windows security (SAM, SYSTEM, tokens, privileges, UAC)
- Review local administrators
- Recognise dangerous privileges
- Recognise an unquoted service path
- Map Windows concepts to their Linux counterparts
Key terms
- SAM
- The Security Account Manager database that stores local accounts and their password hashes.
- SYSTEM (LocalSystem)
- The built-in account the operating system runs as; more powerful than any administrator.
- Access token and privileges
- Every process carries a token listing its user, groups and privileges, special rights such as SeDebugPrivilege or SeBackupPrivilege.
- User Account Control (UAC)
- Runs administrators' programs with standard rights until they confirm an elevation prompt.
- Service
- A background program started by the Service Control Manager, often as SYSTEM.
- LAPS
- Local Administrator Password Solution: gives every Windows machine a unique, rotated local admin password stored in the directory.
← Network devices: network cards, switches, routers and access points · All lessons · The OWASP Top 10, and what attacks look like in a log →