What is client impersonation
The Impersonate a client after authentication Windows security setting allows a program or service to act on behalf of a user after the user has logged in. This is essential to the running of many applications, from printing and accessing user files in web applications, to the systems service control manager.
This ability to temporarily act as another user is also known as impersonation and the application must have the correct security configuration in order to do so. Although necessary, client impersonation needs to be carefully managed to prevent security risks, such as unauthorized access and privilege escalation.
The importance of correct configuration
While necessary for the function of some applications, it is important to understand and be careful what other applications the impersonate a client privilege is given to. Under the right circumstances, it is possible for an attacker with access to this setting to use privilege escalation to gain access to the entire system, data and files included. In another scenario it might be possible to exploit this setting in order to bypass normal security checks in order to gain access to the system.
Attacks such as remote procedure call (RPC) or named pipes can escalate the privilege of an unauthorized user, elevating their permissions potentially to administrative levels and gaining them access to privileged information.
How to change impersonate a client settings
To establish the recommended configuration via GP, configure the following UI path:
| Computer ConfigurationPoliciesWindows SettingsSecurity SettingsLocal PoliciesUser Rights AssignmentImpersonate a client after authentication |
Default value
Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE.
The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
| Server type or GPO | Default value |
| Default Domain Policy | Not defined |
| Default Domain Controller Policy | Administrators
Local Service Network Service Service |
| Stand-Alone Server Default Settings | Administrators
Local Service Network Service Service |
| Domain Controller Effective Default Settings | Administrators
Local Service Network Service Service |
| Member Server Effective Default Settings | Administrators
Local Service Network Service Service |
| Client Computer Effective Default Settings | Administrators
Local Service Network Service Service |
Recommended setting for client impersonation
The recommended state for this setting is: Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE.
Best practices
To mitigate risk, it is crucial to restrict the ‘Impersonate a client after authentication’ privilege to only the most trusted accounts and services. Regular auditing and monitoring of the usage of this privilege can also help in detecting and preventing potential abuse.
Additionally, implementing server hardening practices, such as applying security patches, disabling unnecessary services, and enforcing strict authentication mechanisms, can further enhance system security and reduce vulnerabilities associated with this setting.
