Will WebClient Start

This research analyzes if a low-privileged user can remotely start the Windows WebClient service to enable targeted NTLM relay, mapping the full trigger path from MPR/davclnt’s ETW event through the UBPM ETW consumer, WNF signaling, and services.exe, and testing EFS RPC-based approaches across Windows 10/11. It finds that while WebClient can be started locally by medium-integrity users (e.g., via davclnt-triggered ETW) and by admins/SYSTEM, remote low-privileged activation via RPC is prevented by UBPM’s security descriptor; Windows 11’s EFS changes further reduce viable paths. A PoC toolkit is provided, and the practical takeaway is that remote low-priv start is “almost but no,” reinforcing reliance on controls like SMB signing, LDAP signing/channel binding/EPA, and service hardening.