Logging in
A user is
authenticated by either
- interactive logon or
- network logon
Creating access tokens
When a user logs in, Windows (the
Local Security Authority Subsystem lsass.exe) creates a logon session and an
access token for this user.
If this user is an administrator, an additional (second) access token is created. Thus, an administrator session has two access tokens: a standard user access token and a an administrator access token.
Load the user's registry hive
The following
registry keys are parsed for applications and commands to run when when the system boots up and a user logs in:
-
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce
-
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
-
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
-
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run
-
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
-
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
The 2nd and 4th key are not run when another user logs in after the first one (see KB 137367 and
here)
Start explorer.exe
explorer.exe is started with the created (standard user) access token.
explorer.exe then becomes (directly and indirectly) the parent process for all user-initiated
processes.
Automatically starting apps
The
Windows Settings ms-settings:startupapps can be used to configure which apps are automatically started up when a user logs in.
Logging out
The current user can log him/herself out on the command line with
C:\> shutdown /L
TODO
During the logon process, the
Group Policy engine loads
fdeploy.dll.
Adminstrator accounts vs standard accounts
Each account is either an
- administrator account or a
- standard user account
The
administrator account has full (in Linux parlance: root) access over all ressources that are controlled by the local server. Such an account is needed, for example, to
- Install or remove executables (»apps«?)
- Create, modify or delete other accounts
- Access system files or files that belong to another user
- Change all users' settings
- Change security reated options
This account's
SID is
S-1-5-domain-500 and has the display name
Administrator.
At least in Windows, the administrator account is hidden by default.
A standard user account can be further divided into
- an adult account or a
- child account.
In order to see which accounts belong to the
users and to the
administrators group,
net localgroup can be used:
C:\> net localgroup Users
C:\> net localgroup Administrators
TODO
c:\> start ms-settings:otherusers
Query information about the current user with PowerShell
PS C:\> [security.principal.windowsIdentity]::getCurrent()
AuthenticationType : Kerberos
ImpersonationLevel : None
IsAuthenticated : True
IsGuest : False
IsSystem : False
IsAnonymous : False
Name : FOO\RENE
Owner : S-1-5-21-1234567890-1234567890-1234567890-969913
User : S-1-5-21-1234567890-1234567890-1234567890-969913
Groups : {S-1-5-21-1234567890-1234567890-1234567890-513, S-1-1-0, S-1-5-32-545, S-1-5-4...}
Token : 1176
User account control
The __COMPAT_LAYER variable.
Special predefined local accounts
Special predefined local accounts (that are not recognized by the security subsystem and don't have a password) are
- LocalService
- NetworkService
- LocalSystem
LocalSystem seems to be the user with the most rights: it includes the
NT AUTHORITY\SYSTEM and
BUILTIN\Administrators SIDs.
See also
quser.exe displays information about users that are currently logged in.
A user's profile is stored in the directories below
%USERPROFILE%.
Some information about user accounts can be queried with wmic
c:\> wmic useraccount get name, sid
c:\> wmic useraccount where name='peter' get sid
C:\> wmic useraccount where "localAccount='true'" get caption, disabled, domain, lockout, passwordExpires, SID, status