{"id":20208283,"url":"https://github.com/cubiclesoft/gettokeninformation-windows","last_synced_at":"2025-09-08T03:36:16.187Z","repository":{"id":145129078,"uuid":"361221993","full_name":"cubiclesoft/gettokeninformation-windows","owner":"cubiclesoft","description":"A complete, robust command-line utility to dump the contents of Windows security tokens using the GetTokenInformation() Windows API as JSON.  MIT or LGPL.","archived":false,"fork":false,"pushed_at":"2021-05-14T15:14:05.000Z","size":148,"stargazers_count":10,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-04T11:23:30.095Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cubiclesoft.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-04-24T17:15:31.000Z","updated_at":"2024-12-07T20:24:22.000Z","dependencies_parsed_at":null,"dependency_job_id":"e99a4053-4fb8-41c0-a3fc-002afb2d4524","html_url":"https://github.com/cubiclesoft/gettokeninformation-windows","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cubiclesoft/gettokeninformation-windows","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cubiclesoft%2Fgettokeninformation-windows","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cubiclesoft%2Fgettokeninformation-windows/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cubiclesoft%2Fgettokeninformation-windows/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cubiclesoft%2Fgettokeninformation-windows/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cubiclesoft","download_url":"https://codeload.github.com/cubiclesoft/gettokeninformation-windows/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cubiclesoft%2Fgettokeninformation-windows/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274129163,"owners_count":25227181,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-08T02:00:09.813Z","response_time":121,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-14T05:34:55.741Z","updated_at":"2025-09-08T03:36:16.166Z","avatar_url":"https://github.com/cubiclesoft.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"GetTokenInformation Windows API Command-Line Utility\n====================================================\n\nA complete, robust command-line utility to dump the contents of Windows security tokens using the GetTokenInformation() Windows API as JSON.  Released under a MIT or LGPL license.\n\nLearn about security tokens, the GetTokenInformation() API, this tool, and much more:\n\n[![Windows Security Objects:  A Crash Course + A Brand New Way to Start Processes on Microsoft Windows video](https://user-images.githubusercontent.com/1432111/118288197-0574ec00-b489-11eb-96e5-fab0f6149171.png)](https://www.youtube.com/watch?v=pmteqkbBfAY \"Windows Security Objects:  A Crash Course + A Brand New Way to Start Processes on Microsoft Windows\")\n\n[![Donate](https://cubiclesoft.com/res/donate-shield.png)](https://cubiclesoft.com/donate/) [![Discord](https://img.shields.io/discord/777282089980526602?label=chat\u0026logo=discord)](https://cubiclesoft.com/product-support/github/)\n\nFeatures\n--------\n\n* Command-line action!\n* Dumps the results of the GetTokenInformation() as JSON.  Easily consumed by most programming and scripting languages.\n* Retrieve the token for any process or thread.  Can also find a token that has specific SIDs and privileges.\n* Create and test custom tokens using the /createtoken option.\n* Pre-built binaries using Visual Studio (statically linked C++ runtime, minimal file size of ~112K, direct Win32 API calls).\n* Windows subsystem variant.\n* Unicode support.\n* Has a liberal open source license.  MIT or LGPL, your choice.\n* Sits on GitHub for all of that pull request and issue tracker goodness to easily submit changes and ideas respectively.\n\nUseful Information\n------------------\n\nRunning the command with the `/?` option will display the options:\n\n```\n(C) 2021 CubicleSoft.  All Rights Reserved.\n\nSyntax:  gettokeninformation [options]\n\nOptions:\n        /v\n        Verbose mode.\n\n        /login\n        Use a Windows credentials dialog to create and retrieve a token.\n        Incompatible with '/pid', '/tid', '/usetoken', and '/createtoken'.\n\n        /pid=ProcessID\n        The process ID to retrieve token information from.\n        Incompatible with '/login', '/tid', '/usetoken', and '/createtoken'.\n\n        /tid=ThreadID\n        The thread ID to retrieve token information from.\n        Incompatible with '/login', '/pid', '/usetoken', and '/createtoken'.\n\n        /usetoken=PIDorSIDsAndPrivileges\n        Uses the primary token of the specified process ID,\n        or a process matching specific comma-separated user/group SIDs\n        and/or a process with specific privileges.\n        Requires SeDebugPrivilege.\n        Incompatible with '/login', '/pid', '/tid', and '/createtoken'.\n\n        /createtokenwild=ProcessID\n        The primary token of the specified process ID is used\n        with '/createtoken' for wildcard parameters.\n\n        /createtoken=Parameters\n        Creates a primary token from scratch.\n        Requires SeDebugPrivilege.\n        Incompatible with '/login', '/pid', '/tid', and '/usetoken'.\n        Uses an undocumented Windows kernel API.\n        The 'Parameters' are semicolon separated:\n                UserSID;\n                GroupSID:Attr,GroupSID:Attr,...;\n                Privilege:Attr,Privilege:Attr,...;\n                OwnerSID;\n                PrimaryGroupSID;\n                DefaultDACL;\n                SourceInHex:SourceLUID\n\n        /raw\n        Include retrieved hex encoded raw data.\n\n        /file=OutputFile\n        File to write the JSON output to instead of stdout.\n\n        /c=TokenInfoClass\n        A token information class to retrieve.\n        Multiple /c options can be specified.\n        Each 'TokenInfoClass' can be one of:\n                TokenUser\n                TokenGroups\n                TokenPrivileges\n                TokenOwner\n                TokenPrimaryGroup\n                TokenDefaultDacl\n                TokenSource\n                TokenType\n                TokenImpersonationLevel\n                TokenStatistics\n                TokenRestrictedSids\n                TokenSessionId\n                TokenGroupsAndPrivileges\n                TokenSessionReference\n                TokenSandBoxInert\n                TokenAuditPolicy\n                TokenOrigin\n                TokenElevationType\n                TokenLinkedToken\n                TokenElevation\n                TokenHasRestrictions\n                TokenAccessInformation\n                TokenVirtualizationAllowed\n                TokenVirtualizationEnabled\n                TokenIntegrityLevel\n                TokenUIAccess\n                TokenMandatoryPolicy\n                TokenLogonSid\n                TokenIsAppContainer\n                TokenCapabilities\n                TokenAppContainerSid\n                TokenAppContainerNumber\n                TokenUserClaimAttributes\n                TokenDeviceClaimAttributes\n                TokenRestrictedUserClaimAttributes\n                TokenRestrictedDeviceClaimAttributes\n                TokenDeviceGroups\n                TokenRestrictedDeviceGroups\n                TokenSecurityAttributes\n                TokenIsRestricted\n                TokenProcessTrustLevel\n                TokenPrivateNameSpace\n                TokenSingletonAttributes\n                TokenBnoIsolation\n                TokenChildProcessFlags\n                TokenIsLessPrivilegedAppContainer\n                TokenIsSandboxed\n                TokenOriginatingProcessTrustLevel\n```\n\nExample usage:\n\n```\nC:\\\u003egettokeninformation /login\n{\"success\": true,\n\n\"TokenUser\": {\"success\": true, \"info\": {\"sid\": \"S-1-5-21-1304824241-3403877634-2989090281-1005\", \"domain\": \"MY-PC\", \"account\": \"Bob\", \"type\": 1, \"attrs\": 0}},\n\n...\n}\n\nC:\\\u003egettokeninformation /createtokenwild=1592 /createtoken=S-1-5-21-1304824241-3403877634-2989090281-1003;*;SeCreateTokenPrivilege:0,SeAssignPrimaryTokenPrivilege:3,SeTcbPrivilege:3;S-1-5-32-544;S-1-5-32-544;*;*\n{\"success\": true,\n\n\"TokenUser\": {\"success\": true, \"info\": {\"sid\": \"S-1-5-21-1304824241-3403877634-2989090281-1003\", \"domain\": \"MY-PC\", \"account\": \"T2\", \"type\": 1, \"attrs\": 0}},\n\n\"TokenGroups\": {\"success\": true, \"info\": [{\"sid\": \"S-1-16-16384\", \"domain\": \"Mandatory Label\", \"account\": \"System Mandatory Level\", \"type\": 10, \"attrs\": 96},\n{\"sid\": \"S-1-1-0\", \"domain\": \"\", \"account\": \"Everyone\", \"type\": 5, \"attrs\": 7},\n{\"sid\": \"S-1-5-32-545\", \"domain\": \"BUILTIN\", \"account\": \"Users\", \"type\": 4, \"attrs\": 7},\n{\"sid\": \"S-1-5-6\", \"domain\": \"NT AUTHORITY\", \"account\": \"SERVICE\", \"type\": 5, \"attrs\": 7},\n{\"sid\": \"S-1-2-1\", \"domain\": \"\", \"account\": \"CONSOLE LOGON\", \"type\": 5, \"attrs\": 7},\n{\"sid\": \"S-1-5-11\", \"domain\": \"NT AUTHORITY\", \"account\": \"Authenticated Users\", \"type\": 5, \"attrs\": 7},\n{\"sid\": \"S-1-5-15\", \"domain\": \"NT AUTHORITY\", \"account\": \"This Organization\", \"type\": 5, \"attrs\": 7},\n{\"sid\": \"S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456\", \"domain\": \"NT SERVICE\", \"account\": \"UmRdpService\", \"type\": 5, \"attrs\": 14},\n{\"sid\": \"S-1-5-5-0-84581\", \"domain\": \"NT AUTHORITY\", \"account\": \"LogonSessionId_0_84581\", \"type\": 11, \"attrs\": 3221225487},\n{\"sid\": \"S-1-2-0\", \"domain\": \"\", \"account\": \"LOCAL\", \"type\": 5, \"attrs\": 7},\n{\"sid\": \"S-1-5-32-544\", \"domain\": \"BUILTIN\", \"account\": \"Administrators\", \"type\": 4, \"attrs\": 14}]},\n\n\"TokenPrivileges\": {\"success\": true, \"info\": [{\"luid\": 2, \"attrs\": 0, \"name\": \"SeCreateTokenPrivilege\"},\n{\"luid\": 3, \"attrs\": 3, \"name\": \"SeAssignPrimaryTokenPrivilege\"},\n{\"luid\": 7, \"attrs\": 3, \"name\": \"SeTcbPrivilege\"}]},\n\n\"TokenOwner\": {\"success\": true,\n\"info\": {\"sid\": \"S-1-5-32-544\", \"domain\": \"BUILTIN\", \"account\": \"Administrators\", \"type\": 4}},\n\n\"TokenPrimaryGroup\": {\"success\": true,\n\"info\": {\"sid\": \"S-1-5-32-544\", \"domain\": \"BUILTIN\", \"account\": \"Administrators\", \"type\": 4}},\n\n\"TokenDefaultDacl\": {\"success\": true, \"info\": \"D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456)\"},\n\n\"TokenSource\": {\"success\": true, \"info\": {\"name\": \"4164766170692020\", \"id\": 84583}},\n\n...\n}\n```\n\nThe first command dumps out the current token.  The second command creates a token and then dumps it.\n\nWindows Subsystem Variant\n-------------------------\n\nWhile `gettokeninformation.exe` is intended for use with console apps, `gettokeninformation-win.exe` is intended for detached console and GUI applications.  Starting `gettokeninformation.exe` in certain situations will briefly flash a console window before displaying the error message.  Calling `gettokeninformation-win.exe` instead will no longer show the console window.\n\nThere is one additional option specifically for `messagebox-win.exe` called `/attach` which attempts to attach to the console of the parent process (if any).\n\nMore Information\n----------------\n\nSee the [GetTokenInformation() API documentation](https://docs.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-gettokeninformation) for details.\n\nRelated Tools\n-------------\n\n* [GetSIDInfo](https://github.com/cubiclesoft/getsidinfo-windows) - Dumps information about Windows Security Identifiers (SIDs) as JSON.\n* [CreateProcess](https://github.com/cubiclesoft/createprocess-windows) - A powerful Windows API command-line utility that can start processes with all sorts of options including custom user tokens.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcubiclesoft%2Fgettokeninformation-windows","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcubiclesoft%2Fgettokeninformation-windows","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcubiclesoft%2Fgettokeninformation-windows/lists"}