What is a Process-Level Token?
Every program running on a system requires specific permissions to access files, networks, and other resources. A process-level token acts as an identity for each program, defining what it is allowed to do and which system resources it can access.
Process-level tokens are critical to core Windows functionality. For example, Task Scheduler relies on tokens to start and manage processes on behalf of different users.
What Does Replacing a Process-Level Token Mean?
This Windows security setting allows a token to be changed by a user or another program after the process has already started. It also allows one process or service (the parent process) to start another process or service (the child process) with a different access token, including permission to modify the child process’s token.
This behavior is implemented using the CreateProcessAsUser() API.
Why This Privilege Is Risky if Misconfigured
The Replace a process-level token privilege allows a process to start another process under a different security context. If assigned too broadly, it can be abused to escalate privileges, bypass access controls, or run processes with higher permissions than intended.
On hardened systems, this privilege should be tightly controlled. Granting it unnecessarily increases the risk of privilege escalation and makes it harder to trace how and why a process was able to execute with elevated rights.
How to Configure Replace a Process Level Token
To establish the recommended configuration via GP, set the following UI path to LOCAL SERVICE, NETWORK SERVICE:
| Computer ConfigurationPoliciesWindows SettingsSecurity SettingsLocal PoliciesUser Rights AssignmentReplace a process level token |
Or, to configure via Windows Settings use the following path:
| Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesUser Rights Assignment |
Default value
LOCAL SERVICE, NETWORK SERVICE.
Recommended settings
The recommended state for this setting is: LOCAL SERVICE, NETWORK SERVICE.
Best Practices
-
Apply server hardening to reduce the overall attack surface.
-
Restrict the Replace a process-level token privilege to only the accounts and services that explicitly require it.
-
Patch operating systems and applications regularly to close known privilege-escalation paths.
-
Disable unnecessary services, scheduled tasks, and legacy components.
-
Use strong authentication for both user and service accounts.
-
Monitor and review the use of sensitive privileges to detect misuse or configuration drift.
These practices help prevent privilege abuse, reduce lateral movement risk, and keep systems stable and predictable over time.
