Security

!acl

Decode an ACL and its ACEs.

!acl <address>

Also: acl

!objsd

Decode the security descriptor referenced by an object header.

!objsd <object>

Also: objsd

The OBJECT_HEADER.SecurityDescriptor fast-reference low four bits are masked before decoding.

!sd

Decode a SECURITY_DESCRIPTOR and its ACLs.

!sd <address> [1]

Also: sd

The optional 1 annotates well-known SIDs. Self-relative descriptors and absolute descriptors are both supported; each SID/ACE is decoded independently.

!sid

Decode a SID in guest memory.

!sid <address>

Also: sid

!token

Inspect the selected/current process primary token.

!token

Reports independently available token IDs, user/groups, privileges, type, impersonation level, and flags. Missing metadata or memory is shown per field.