Mastering Windows Access Control: Understanding SeDebugPrivilege

This post analyzes how Windows SeDebugPrivilege alters process and thread access evaluations, showing that it bypasses MIC, DACL, and Trust Label checks while leaving Protected Process checks and driver pre-operation callbacks intact. Using LSASS and MsMpEng examples, it walks through kernel paths (e.g., SePrivilegeCheck, ObOpenObjectByPointer, SeAccessCheckWithHintWithAdminlessChecks, PspProcessOpen) to explain why administrators with SeDebugPrivilege can gain specific access levels depending on requested rights and protection levels. It concludes with defensive takeaways, recommending monitoring for privilege enablement (Event ID 4703) as a signal of potentially suspicious activity.