title: SeImpersonatePrivilege and the Standard User
body: <p>I gave the standard user "Joe" SeImpersonatePrivilege on Windows Server 2008 R2, the only domain controller on the network. Joe isn't a member of any administrator group; when Joe starts a process it runs at Medium Integrity Level.</p>
  
  <p>When the administrator runs "gpresult /z" on the server I see this partial listing:</p>
  
  <pre><code>    User Rights
      -----------
          GPO: Default Domain Controllers Policy
              Policy:            ImpersonatePrivilege
              Computer Setting:  Administrators
                                 Joe
                                 LOCAL SERVICE
                                 NETWORK SERVICE
                                 SERVICE
  </code></pre>
  
  <p>However when Joe runs a program that uses GetTokenInformation and LookupPrivilegeName to display Joe's privileges it produces these results on the server:</p>
  
  <pre><code>Integrity level : Medium Process
  
  SeShutdownPrivilege
  SeChangeNotifyPrivilege
  SeUndockPrivilege
  SeIncreaseWorkingSetPrivilege
  SeTimeZonePrivilege
  
  Press any key to continue
  </code></pre>
  
  <p>and these on a workstation:</p>
  
  <pre><code>Integrity level : Medium Process
  
  SeChangeNotifyPrivilege
  SeIncreaseWorkingSetPrivilege
  
  Press any key to continue
  </code></pre>
  
  <p>I'd like to know whether it's possible for Joe to have SeImpersontatePrivilege while running a Medium Process and if so, how to accomplish it. My goal is to have Joe impersonate other users at the "Impersonate" level, as opposed to "Identify", whether running on a workstation or server, using Get/AcceptSecurityContext. I'd appreciate any suggestions for background reading on the topic.</p>