SeTakeOwnershipPrivilege can let a domain user take ownership of protected System32 files on a Domain Controller and escalate to SYSTEM via Utilman.exe or osk.exe abuse. #SeTakeOwnershipPrivilege #DomainController #Utilman.exe
Windows Privilege Escalation: SeTakeOwnershipPrivilege
A single delegated Windows right, SeTakeOwnershipPrivilege, can be abused to take ownership of protected System32 binaries on a Domain Controller and escalate a standard domain user to SYSTEM. The article shows two paths—hijacking Utilman.exe to reset the built-in Administrator password and replacing osk.exe with a reverse shell payload—then outlines mitigation and detection steps. #SeTakeOwnershipPrivilege #Utilman.exe #osk.exe #DomainController #winlogon.exe
www.hendryadrian.com
July 13, 2026 at 9:30 PM
SeTakeOwnershipPrivilege can let a domain user take ownership of protected System32 files on a Domain Controller and escalate to SYSTEM via Utilman.exe or osk.exe abuse. #SeTakeOwnershipPrivilege #DomainController #Utilman.exe
→ 𝗦𝗲𝗕𝗮𝗰𝗸𝘂𝗽𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 ⇤ That 𝗦𝗲𝗕𝗮𝗰𝗸𝘂𝗽𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 is important; it tells you this session can read the SAM/SECURITY/SYSTEM hives.
Then you have the below flow of events in that order:
• 5140 File Share Access – IPC$ connection
• 4674 Sensitive Privilege Use – SC Manager with SeTakeOwnershipPrivilege
Then you have the below flow of events in that order:
• 5140 File Share Access – IPC$ connection
• 4674 Sensitive Privilege Use – SC Manager with SeTakeOwnershipPrivilege
October 22, 2025 at 4:36 AM
→ 𝗦𝗲𝗕𝗮𝗰𝗸𝘂𝗽𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 ⇤ That 𝗦𝗲𝗕𝗮𝗰𝗸𝘂𝗽𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 is important; it tells you this session can read the SAM/SECURITY/SYSTEM hives.
Then you have the below flow of events in that order:
• 5140 File Share Access – IPC$ connection
• 4674 Sensitive Privilege Use – SC Manager with SeTakeOwnershipPrivilege
Then you have the below flow of events in that order:
• 5140 File Share Access – IPC$ connection
• 4674 Sensitive Privilege Use – SC Manager with SeTakeOwnershipPrivilege