---
title: "Commonly Abused Windows Token Privileges: SeCreateTokenPrivilege"
description: SeCreateTokenPrivilege — Create a token object Determines which accounts a process can use to create a token, and which accounts it can then use to gain access to local resources…
---

[Senteon Blog ](https://senteon.co/blog)

# [Commonly Abused Windows Token Privileges: SeCreateTokenPrivilege](https://senteon.co/blog/2021/09/commonly-abused-windows-token-privileges-secreatetokenprivilege)

 Written by [Henry Zhang](https://senteon.co/blog/author/henry-zhang) | Sep 27, 2021 12:00:00 PM

#### SeCreateTokenPrivilege — Create a token object

Determines which accounts a process can use to create a token, and which accounts it can then use to gain access to local resources when the process uses NtCreateToken() or other token-creation APIs.

When a user logs on to the local device or connects to a remote device through a network, Windows builds the user’s access token. Then the system examines the token to determine the level of the user’s privileges. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user’s access token until the next time the user logs on or connects.

##### GPO Setting Path

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

##### GPO Setting Name

Create a token object

##### Token Privilege

SeCreateTokenPrivilege

##### Associated ATT&CK Tactic(s)

Privilege Escalation (TA0004), Defense Evasion (TA0005)

[View full post](https://senteon.co/blog/2021/09/commonly-abused-windows-token-privileges-secreatetokenprivilege)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Henry Zhang"
  },
  "dateModified" : "2025-11-04T17:54:11.107Z",
  "datePublished" : "2021-09-27T12:00:00Z",
  "headline" : "Commonly Abused Windows Token Privileges: SeCreateTokenPrivilege",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://senteon.co/blog/2021/09/commonly-abused-windows-token-privileges-secreatetokenprivilege",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Senteon Blog"
  }
}
```