> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/credentials/windows-authentication-and-authorization.md).

# Windows 中的身份验证与授权

针对 Windows 中的身份验证与授权的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。

<details>

<summary>资源</summary>

{% embed url="<https://learn.microsoft.com/en-us/windows/win32/secauthz/access-tokens>" %}

{% embed url="<https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication#BKMK_CrentialInputForUserLogon>" %}

</details>

> **后台**：本节说明 Windows 如何处理身份验证、登录会话、访问令牌，以及内存中或缓存的凭据。所述操作是在一个 **授权实验室** 中进行的，以了解与 Active Directory 域中 Windows 工作站被入侵相关的风险。

#### 一般原理

当用户在 Windows 上成功进行身份验证时，系统会创建一个 **登录会话**，也就是说，一个连接会话。

然后认证包会将信息传输给 **LSA**或 **本地安全机构**.

LSA 使用这些信息创建一个 **访问令牌** 与新用户关联的。

该令牌尤其包含：

* 用户的身份；
* 他所属的组；
* 其特权；
* 其完整性级别；
* 一个称为以下名称的本地唯一凭据 **LUID**;
* 会话的安全上下文。

该 **LUID**或 **本地唯一标识符**，可用于在本地标识一个连接会话。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/active-directory/credentials/windows-authentication-and-authorization.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.