WinSecWiki > Security Settings > Local Policies > User Rights > User Rights In-Depth > Impersonate a client
Impersonate a client after authentication
KA: SeImpersonatePrivilege, Impersonate a client after authentication
Default assignment: Administrators, SERVICE
This sensitive right allows a server application that accepts authenticated client connections over one of Windows inter process communications components (e.g. RPC, named pipes or COM) to impersonate that client user while accessing resources on the server on behalf of the user. Restricting this right prevents just anybody from creating a RPC, named pipe or COM based application and then convincing users to access it for the purpose of hijacking their credentials.
Since this right is assigned by default to the special principle, SERVICE, all services and COM servers started by the COM infrastructure and that are configured to run under a specific account also have this right by virtue of SERVICE being in their access token. Because of this, be aware that any code you run as a service or through COM automatically gets the right to impersonate clients that connect to it.
This right should only be assigned to trusted server applications that need to be able to impersonate the client user. Note that programmers modifying code that runs in such an application could insert malicious code to perform actions as a targeted end-user. This is just one reason why code reviews and change control are so important in a development environment.
Back to top