> The explanations on MS's site are vague enough that they're meaningless. > What services running on Windows allow clients to access them? And if they > do, do they restrict access to the Local Machine? Or do they allow Remote > Access? (For example, RPC is clearly remote. Is the Windows Time service?)
Actually, the explanations are not vague or meaningless. It just helps to have an understanding of what this privilege governs. Lets start with the fact that in essence it only applies to Server operating systems, and only to Windows 2000 SP4, or Windows 2003. http://msdn.microsoft.com/library/default.asp?url=/library/en- us/secauthz/security/authorization_constants.asp Mike Howard also demonstrates the technique here: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure03132003.asp RPC is not clearly remote. It is merely a mechanism which is capable of delivering remote calls. According to MSDN this is a list of API that require SeImpersonatePrivelege: RpcImpersonateClient ImpersonateAnonymousToken ImpersonateClient ImpersonateLoggedOnUser ImpersonateSecurityContext RpcGetAuthorizationContextForClient Reading the API, and the MSDN Documentation on IMpersonation and Delegation should illuminate this issue. The short story is though, that any case where any process or thread will execute, either locally or remotely, under another users security context, impersonation is required. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
