Security

!acl

Decode an ACL and its ACEs.

!acl <address> [1]

Also: acl

The optional 1 adds the names of well-known SIDs.

!objsd

Decode the security descriptor that an object header references.

!objsd <object>

Also: objsd

The command masks the low four bits of the OBJECT_HEADER.SecurityDescriptor fast reference before it decodes the descriptor.

!sd

Decode a SECURITY_DESCRIPTOR and its ACLs.

!sd <address> [1]

Also: sd

Decodes a self-relative or absolute security descriptor, and decodes each SID and each ACE separately. The optional 1 adds the names of well-known SIDs.

!sid

Decode a SID in guest memory.

!sid <address>

Also: sid

!token

Show the primary token of the selected or current process.

!token

The command shows the token IDs, user and groups, privileges, type, impersonation level, and flags. It gets each field independently, and if the metadata or memory for a field is missing, it shows this in that field.