Details

Create a token object

This security setting determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token.

This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System.

Caution

Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.

Default: None

Solution

Policy Path: Local PoliciesUser Rights Assignment
Policy Name: Create a token object

Supportive Information

The following resource is also helpful.

• https://www.microsoft.com/en-us/download/details.aspx?id=55319

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Windows.

References

• 800-53|AC-6(7)(b)
• CSCv6|5.1

Source

• Tenable.com/audits