Tokenmon 1.01
Tokenmon is a tool which monitors and displays a variety of security-related activity taking place on a system.
|
0.00 
Freeware
0K
Windows Vista 
Tokenmon is a tool which monitors and displays a variety of security-related activity taking place on a system. Tokenmon gets its name from the fact that Windows NT/2000 stores a process' security information, including the user account context in which the process executes, in an object called a token. Tokenmon monitors includes the following:
User logon/logoff
Applications enabling or disabling security privileges in their process tokens
Process startup and exit (token creation/deletion)
Impersonation
Tokenmon has advanced filtering and search capabilities that make it a powerful tool for exploring the way NT works, seeing how applications use security functions, or tracking down problems in system or application configurations.
Simply run the Tokenmon GUI (Tokenmon.exe). Note that you must have administrative privilege to run Tokenmon. Menus, hot-keys, or toolbar buttons can be used to clear the window, save the monitored data to a file, and to filter and search output.
When a thread impersonates you'll see the thread's primary identity in the domainuser column and the identity its adopting in the Other column. Any security actions it performs at that point are in the impersonation context. When it reverts back to its own identity the thread's primary identity is again shown in the domainuser column.
As events are printed to the output, they are tagged with a sequence number. If Tokenmon's internal buffers are overflowed during extremely heavy activity, this will be reflected with gaps in the sequence number.
Each time you exit Tokenmon it remembers the position of the window and the widths of the output columns.
Tokenmon intercepts logon by hooking the NtCreateToken native API. The local security authority uses this API to create an initial login token when a user logs in either remotely or locally. When a user logs on the Local Security Authority Subsystem (LSASS) assigns the logon session a locally unique identifer (LUID) called a logon ID. To see a corresponding logoff, Tokenmon registers with the Security Reference Monitor (SRM) using the SeRegisterLogonSessionTerminatedRoutine kernel function, which requests that the SRM call the driver back whenever a user is logged off.
In order to see a process enable and disable privileges, Tokenmon hooks the NtAdjustPrivilegesToken function, which is the native API-equivalent of the Win32 AdjustTokenPrivileges functions. This function takes an array of privileges with a flag for each indicating whether the process wants to enable or disable it. Tokenmon shows the action for each privilege affected by a single call in separate output lines.
Tokenmon uses the PsSetCreateProcessNotifyRoutine kernel function, which is documented in the Windows 2000 DDK (but available on NT 4), to register a callback function whenever a process starts or exits.
Finally, there are several functions that applications can use to impersonate another user. Tokenmon hooks NtSetInformationThread, a variant of which is the native API-equivalent of the ImpersonateLoggedOnUser and ImpersonateSelf Win32 APIs, the FSCTL_PIPE_IMPERSONATE variant of NtFsControlFile (the native-equivalent of ImpersonateNamedPipeClient), and NtImpersonateClientOfPort, which is called by applications using the Local Procedure Call (LPC) facility and local RPC for impersonating the remote end of a LPC connection.
Tokenmon relies on several undocumented SRM functions to obtain a logon ID from a thread's primary and impersonation tokens, and GetSecurityUserInfo, an undocumented function exported by the KSecDD (Kernel Security-support driver) that retrieves a logon session user's name, domain name, and logon server given a logon ID. Another interesting implementation detail is that several of the native API functions that Tokenmon hooks are not exported by ntoskrnl.exe for use by drivers. Thus, the Tokenmon GUI must reach into NTDLL.DLL, extract their system call numbers, and pass them to the driver. This contrasts with Regmon, which reaches into ntoskrnl.exe using Registry function exports to obtain system call numbers.
tags
native api the native the local function which tokenmon hooks call numbers ntoskrnl exe using the logon session kernel function functions that api equivalent user logs
Download Tokenmon 1.01
Authors software
Bluescreen 3.2
Mark Russinovich
One of the most feared colors in the NT world is blue.
Du v 1.00 r 7
Mark Russinovich
Du (disk usage) will report the disk space usage for the directory you specify.
Sigcheck 1.0
Mark Russinovich
Verify that images are digitally signed and dump version information with this simple command-line utility called Sigcheck.
AccessChk 1.03
Mark Russinovich
As a part of ensuring that they've created a secure environment Windows administrators often need to know what kind of accesses specific users or groups have to resources including files, directories, Registry keys, and Windows services.
CacheSet 1.0
Mark Russinovich
CacheSet is an applet which helps you manipulate the working-set parameters of the system file cache.
Similar software
Tokenmon 1.01
Mark Russinovich
Tokenmon is a tool which monitors and displays a variety of security-related activity taking place on a system.
Ascella Log Monitor 1.0
AAR Software Ltd.
Ascella Log Monitor monitors the Windows event logs at real-time for any activity that matches the specified rules.
Active Security Monitor 2.0.0.18
AOL
Active Security Monitor is a free diagnostic application which continuously monitors your PC and Home Network giving you a consolidated view of your overall security.
HSSVSS Home Security Video system 2012
Fernpages
HSSVSS can turn your cameras or webcam into a video and motion detecting surveillance system.
Homeland Security Monitor 2.0
Beau Blaser Software
The Homeland Security Monitor is a free application which monitors the current threat level as posted at http://www.
Log Monitor 0.2
Silviu Lita
Log Monitor is a simple package tool to trace MySQL activity like MS SQL Server Profiler and can also be used as a generic log monitor software.
Security Config Wizard NT 1.5
Falk Schmal
Security Config Wizard NT was developed as an Remote Security Administration tool.
Activity Indicator 1.0
New Way Studio Ltd
Activity Indicator will show your working activity during the day in a small XP styled window that you can place anywhere on the screen.
ConfigInspector 1.22
Softvoile
ConfigInspector is a free and useful application for system information analysis.
Port Magic 1.0
Fresh Software
Port Magic monitors ports on your computer that you specify to watch for threatening activity, including portscans.
Other software in this category
Nullsoft Beep 0.3
Nullsoft, Inc
Nullsoft Beep is an application that makes your computer sound like computers sound in the movies.
AR Soft RAM Disk 1.20
AR Soft
The AR RAM Disk is a freeware driver for Windows NT or Windows 2000.
DBX Plugin for Windows Commander Beta
Labs99
DBX Plugin is an additional component for Windows Commander allowing you to read contents of Microsoft Outlook Express files.
4th split 1.1.9.0
Sergey S. Tkachenko
4th split is used for splitting impossibly large files on blocks.
HDCopy 2.104
Kurt Zimmermann
HDCopy is recommended to make a boot disk.
RSS