Client/Server Access Control

A server application provides services to clients. For example, a server could perform the following services on behalf of a client:

• Save and retrieve information from a private database
• Access network resources
• Start processes in the client's security context on the server's computer

A protected server controls access to its services. Windows provides security support that enables a server to do the following:

• Impersonate a client's security context, which causes the system to perform most access and privilege checks against the client's access token rather than the server's
• Log a client on to the server's computer
• Connect to network resources using the client's security context
• Create security descriptors to protect private objects
• Determine whether a security descriptor allows access to a client
• Determine whether a set of privileges are enabled in a client's token
• Generate audit messages in the security event log to record attempts by a client to access objects or use privileges