SeImpersonatePrivilege and the Standard User
<p>I gave the standard user "Joe" SeImpersonatePrivilege on Windows Server 2008 R2, the only domain controller on the network. Joe isn't a member of any administrator group; when Joe starts a process it runs at Medium Integrity Level.</p>

<p>When the administrator runs "gpresult /z" on the server I see this partial listing:</p>

<pre><code>    User Rights
    -----------
        GPO: Default Domain Controllers Policy
            Policy:            ImpersonatePrivilege
            Computer Setting:  Administrators
                               Joe
                               LOCAL SERVICE
                               NETWORK SERVICE
                               SERVICE
</code></pre>

<p>However when Joe runs a program that uses GetTokenInformation and LookupPrivilegeName to display Joe's privileges it produces these results on the server:</p>

<pre><code>Integrity level : Medium Process

SeShutdownPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
SeIncreaseWorkingSetPrivilege
SeTimeZonePrivilege

Press any key to continue
</code></pre>

<p>and these on a workstation:</p>

<pre><code>Integrity level : Medium Process

SeChangeNotifyPrivilege
SeIncreaseWorkingSetPrivilege

Press any key to continue
</code></pre>

<p>I'd like to know whether it's possible for Joe to have SeImpersontatePrivilege while running a Medium Process and if so, how to accomplish it. My goal is to have Joe impersonate other users at the "Impersonate" level, as opposed to "Identify", whether running on a workstation or server, using Get/AcceptSecurityContext. I'd appreciate any suggestions for background reading on the topic.</p>