Overview
Windows privilege escalation begins with understanding Windows identities — the accounts, groups, and privilege levels that define access. This lesson introduces the Windows identity model for escalation.
Learning objectives
- Describe the Windows identity and privilege model.
- Identify key accounts and privilege levels.
- Frame escalation relative to Windows identities.
Core concept
Windows represents identity through user accounts, groups, and privileges/tokens. Key levels include standard user accounts, Administrator accounts, and highly privileged system contexts (e.g. the built-in SYSTEM account, the most privileged local context). Group membership (notably Administrators) and specific privileges (rights assigned to accounts/tokens) determine what an identity can do. Windows privilege escalation means moving from a lower-privileged identity (standard user) toward Administrator or SYSTEM — crossing a Windows privilege boundary.
How it works
Windows checks actions against the acting identity's account, group memberships, and the privileges in its access token. A standard user is limited; membership in Administrators or possession of certain powerful privileges grants far more; and SYSTEM is the most powerful local context (used by many services). Escalation seeks to move up this hierarchy — e.g. from standard user to Administrator, or to SYSTEM (often via a privileged service, as later lessons show). Understanding which identity a process runs as, and what privileges its token holds, is prerequisite to identifying escalation paths (in authorized testing) and to enforcing/monitoring boundaries (defense).
Practical example
In an authorized Windows lab, the tester notes they have a standard user account, while certain services run as SYSTEM (the most privileged local context) and administrative functions require Administrator. Escalation, conceptually, would mean crossing from the standard user to Administrator or SYSTEM. Recognizing these identities and their privilege levels — standard user vs Administrator vs SYSTEM — frames exactly which boundaries the subsequent lessons (services, permissions, tasks, configuration) examine.
Cybersecurity relevance
Understanding Windows identities is foundational to Windows escalation (a critical post-foothold stage in attacks on Windows environments) and to defense. Defensively, it underpins least privilege (limiting Administrator membership and powerful privileges), monitoring privileged accounts, and protecting the SYSTEM context. It mirrors the privilege-boundary concept applied to Windows. Later lessons detail Windows-specific escalation via services, permissions, scheduled tasks, and configuration; all are understood relative to moving between these identities. Knowing the model is the first step to both finding and closing Windows escalation paths.
Common mistakes
- Not distinguishing standard user, Administrator, and SYSTEM contexts.
- Overlooking token privileges/group membership that grant elevated capability.
- Assuming boundaries are enforced without checking which identity processes run as.
Key takeaways
- Windows identity is defined by accounts, groups (notably Administrators), and token privileges; key levels include standard user, Administrator, and the highly privileged SYSTEM context.
- Windows escalation moves from a lower identity (standard user) toward Administrator or SYSTEM, crossing a privilege boundary.
- Understanding the identity model is prerequisite to finding escalation paths (in authorized testing) and to least-privilege defense and monitoring.
Check your understanding
- What are the key Windows privilege levels involved in escalation, and which is the most privileged local context?
- Why is understanding a process's identity and token privileges important for both escalation testing and defense?